RomHack 2025 - Philippe Caturegli

## Domain Collisions Still Matter

Philippe Caturegli presents red-team research on domain name collisions—cases where internal corporate names collide with real, publicly registered TLDs. Despite ICANN studies dating to 2013, enterprises still suffer from choices made decades ago.

## WPAD Gone Wrong

During an IT services engagement, his team registered initech.lc, mirroring a fictional internal domain. Remote employees' browsers queried WPAD URLs like wpad.initech.lc through public DNS when home routers could not resolve internal names, letting attackers host malicious proxy configs.

## Internal AD Names vs. New gTLDs

Many organizations adopted short internal domains before new gTLDs existed. Active Directory cannot rename domains, leaving companies stuck with names now owned by strangers—enabling phishing, credential interception, and VPN bypass scenarios.

## ICANN Mitigations and Gaps

Caturegli reviews ICANN's name collision framework from JAS Global Advisors and discusses newer TLD quirks (including memorable examples like .zip). Defenders should audit internal namespaces, disable unsafe WPAD, and plan migrations where collisions create external trust boundaries.