Cybercriminals exploit the .arpa domain and IPv6 addresses to deliver phishing pages, bypassing traditional security and stealing credentials.