Local Networks Go Global When Domain Names Collide

This report examines namespace collisions in Active Directory and WPAD where organizations use internal domains in publicly routable TLDs (e.g., .ad, .llc), enabling researchers and attackers to register those domains (such as memrtcc.ad and wpad.ad) and collect large volumes of Windows authentication attempts and proxy auto-discovery requests; the research mapped thousands of exposed domains and demonstrated real credential leakage (including police systems), highlighting a widespread misconfiguration that can be exploited for credential harvesting and initial access.