Internal Domain Name Collision 2.0

The talk begins with a red team engagement in which an external Exchange server leaked an internal NTLM domain name ending in .llc. That suffix had become a public top-level domain in 2018 and was still available to buy. Registering it and running a DNS server captured internal lookups, including WPAD and Active Directory discovery queries from workstations. The team then used the harvested domain credentials to reach the VPN, where the client's push-approval MFA was approved by a user.

The speaker explains name collisions: when new top-level domains are delegated while internal networks still use the same suffixes, lookups leak to the internet. ICANN's collision framework proposes a short interception period, but the speaker argues it mainly serves the registry's revenue. The research method gathered internal names from certificates, SMTP banners, email headers and NTLM challenges, then checked registration status through DNS records and registrar APIs, since WHOIS checks got the team blocked. Case studies included a Memphis police domain tied to a real-time crime center, the .ad domain, a blockchain .box TLD where router default suffixes leaked traffic, and Luxembourg, where hundreds of unregistered domains were tied to municipalities, a school and a bank.

The main takeaway is that organizations should register or sinkhole any internal-looking domain names they use, and reduce reliance on WPAD and unqualified internal names. The research reported about 89,000 unregistered domains, roughly 115 of which were registered, and hundreds of millions of DNS records captured over six months.