RFC 3514:The Security Flag in the IPv4 Header
RFC-Ref

5. Related Work

   Although this document only defines the IPv4 evil bit, there are
   complementary mechanisms for other forms of evil.  We sketch some of
   those here.

   For IPv6 [RFC2460], evilness is conveyed by two options.  The first,
   a hop-by-hop option, is used for packets that damage the network,
   such as DDoS packets.  The second, an end-to-end option, is for
   packets intended to damage destination hosts.  In either case, the

   option contains a 128-bit strength indicator, which says how evil the
   packet is, and a 128-bit type code that describes the particular type
   of attack intended.

   Some link layers, notably those based on optical switching, may
   bypass routers (and hence firewalls) entirely.  Accordingly, some
   link-layer scheme MUST be used to denote evil.  This may involve evil
   lambdas, evil polarizations, etc.

   DDoS attack packets are denoted by a special diffserv code point.

   An application/evil MIME type is defined for Web- or email-carried
   mischief.  Other MIME types can be embedded inside of evil sections;
   this permit easy encoding of word processing documents with macro
   viruses, etc.

Google
Web
RFC-Ref