Download websites that use NTLM

About NTLM

The acronym keeps two words that date it: LAN, which is where this was meant to stay, and NT, from a product line retired long ago. The protocol authenticates users against Windows accounts through a challenge and a response, and a server announces it in an HTTP response header when it asks a client to authenticate, which is the only reason any of this is observable from outside. A public host answering with that challenge is telling the internet that it is wired into a Windows environment.

Microsoft introduced the protocol in 1993 and has spent much of the time since encouraging customers away from it, first towards Kerberos and later towards modern federated sign in. The protocol stays Proprietary and stays supported because it still covers what Kerberos cannot: access by IP address instead of hostname, machines outside a domain, workgroup setups, and a long tail of applications nobody wants to touch. Deprecation in documentation and disappearance from production are very different events.

As of October 2026 we record NTLM on 528 hosts, in the Security group. What those hosts share is not an industry but an architecture. Internal web applications published to the internet, intranet portals, document management systems, mail and collaboration front ends, device management consoles and old line of business software all end up in the same set, usually because somebody opened a port for remote access and left the authentication method exactly as it was.

The security reading is straightforward and worth stating plainly. Challenge and response authentication reachable from the open internet is exposed to relay and credential attacks the protocol was never designed to withstand, and each host in the file is a public endpoint bound to an internal directory. Anyone doing attack surface work, on their own estate or across a portfolio of acquired companies, wants the enumeration and not a single answer.

Detection has a firm floor and a soft ceiling. A host appears only if it presents the challenge on a path we actually reach, so anything behind a VPN, behind a proxy that terminates authentication, or wrapped in a login form will be absent even though the protocol is running underneath. The honest description of the count is a lower bound on exposure.

Asking whether one hostname negotiates the protocol is a single request anyone can make. The value of a downloadable list is that it turns a per host check into a map: which countries, top level domains and organisations still expose Windows authentication to the open internet, how that population shrinks between snapshots, and which of those domains also carry the other software that tends to travel with an unmaintained perimeter.