Internal host names (.internal, .local, .lan, home.arpa, .corp)

How nullcipher recognises it

A host name of at least two labels ending in a suffix kept for private networks — .internal, .local, .lan, .home.arpa, .localdomain, .intranet or .corp, written in lower case — or with a corp or intranet label between a host and a registered domain (db01.corp.example.com). Inside a URL only the host is masked; the scheme, port and path stay. localhost.localdomain, names that start with a dot (.env.local) or continue with a dot (settings.local.py), and dotted names starting com., org., net., java., javax., jdk., sun., kotlin., android. or androidx. (code packages) are left alone. A public domain is never masked by this rule; add it to your word list to hide it. Pattern-based: misses an internal host with a public-looking name (db01.example.com), a bare name with no dots (db01) and a suffix written in capitals; may flag a dotted module name that ends in one of these words, such as myapp.settings.local.

This is the rule text of the “Internal host name” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

connect to build-01.example.internal:8443 refused; retrying nas.example.home.arpa

nullcipher replaces it with [HOST_1] and [HOST_2]. Both host names contain the word example and name no real network. .internal and home.arpa are the private-use names the sources below reserve, so the example is shaped like a real log line without pointing anywhere.

Why it matters in an AI chat

Some top-level names exist only inside private networks. RFC 6762 makes every name ending in .local link-local (multicast DNS, which is how Macs, printers and many IoT devices name themselves); RFC 8375 sets aside home.arpa for home networks; and in July 2024 ICANN's board permanently reserved .internal from the DNS root for private use. .lan, .corp, .intranet and .localdomain are not reserved, but routers and company networks use them the same way.

Because these names are chosen by people, they describe things: db01.prod.acme.internal names the company, the environment and the role of the machine; a Mac's default Bonjour name is built from its owner's name, so Jens-MacBook-Pro.local names a person. A log full of them is a map of a network, which is exactly what someone planning an intrusion collects first.

The AI can answer the question without them. nullcipher masks only the host, so https://[HOST_1]:8443/v2/health still shows the scheme, the port and the path, and one host keeps one placeholder across the whole paste. A private IP address in a URL is masked by the IPv4 rule the same way: http://[IPV4_1]:8080/. A public domain such as github.com is never masked by this rule — it is usually what the AI needs to see — but if your own company domain should not appear either, add it to your word list on the front page.

If it already leaked

1. There is nothing to revoke: a host name is an address, not a key.
2. Check that the host is not reachable from the internet and that its name does not resolve in public DNS; a name under .internal, .local or home.arpa should never be published there by design. ^[1][2][3]
3. Do not rely on the name staying secret. If a service on that host is protected only by being hard to find, put it behind a login or a VPN.

Sources

1. RFC 6762: Multicast DNS (section 3: names ending in .local. are link-local) — checked 2026-09-26.
2. RFC 8375: Special-Use Domain 'home.arpa.' — checked 2026-09-26.
3. ICANN Board resolution 2024.07.29.06: Reserving .INTERNAL for Private-Use Applications — checked 2026-09-26.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 242 detectors, with a page for 59 secret types, and how to delete a chat you already sent.