“Each request contained a username and a hashed Windows password, and upon searching the usernames online Caturegli concluded they all belonged to police officers in Memphis, Tenn.”
The Memphis police built their Active Directory on memrtcc.ad, a domain they never owned. Philippe Caturegli bought it for $160 plus $500 for the trademark paperwork. Hundreds of patrol car laptops started sending him credentials. His scan found more than 9,000 exposed domains, and the cheapest Windows breach on the market is a domain registration.