monster.9.4.8.e.0.7.4.0.1.0.0.2.ip6.arpa

A simple demo showing how gaps in the Public Suffix List allow globally accessible cookies on ip6.arpa domains.

Cookie Monster 
Waiting to read cookie...
This demo highlights an oddity in how the Public Suffix List treats ip6.arpa.
Since 2.ip6.arpa is the only publicly routed reverse zone, cookies scoped here are effectively global, something normally blocked on TLDs like .com.
In practice this isn’t a security issue, since nobody sane runs normal websites directly on .ip6.arpa.

More info: elliott.diy • GitHub • lemonyte.com

Not sure what this is? Visit the cookie page first to use the demo.