Fritz!Box routers create a sub-domain on fritz.box to make browsing local devices in your network easier. 

Assume your NAS hostname is "nas". An address is added from the DHCP requests so your NAS can be accessible by using a domain name such as nas.fritz.box instead of an IP address.

This is a feature of the Fritz!Box DNS server. This server will always return a private IP address.

The .box TLD is now available and someone registered fritz.box. 

While this will not impact people using the default Fritz!Box DNS, it will be resolved if they use an external DNS such as 1.1.1.1, 8.8.8.8, AdGuard or even one run inside their network, like AdGuard or PiHole.

If you use an external DNS, your lookup for nas.fritz.box will return an external IP address controlled by unknown parties.

Again, this does not affect the Fritz!Box in its default configuration, only if you use a different DNS setting.

For example:

 
c:\> nslookup nas.fritz.box 8.8.8.8
 
Server:  dns.google
Address:  8.8.8.8 
Name:    nas.fritz.box
Addresses:  2001:19f0:6c00:1b0e:5400:4ff:fecd:7828  45.76.93.104
 

I have replaced my Fritz!Box a few years ago, but I have one Windows laptop that still adds ".fritz.box" to some lookups, even long after not being connected to a Fritz!box.

If your DNS service or router allows, you should block any lookup to a domain within .fritz.box to be safe.

This is what my network returns if I try the same lookup with my custom DNS:

 
c:\> nslookup nas.fritz.box
 
Server:  UnKnown
Address:  192.168.2.1
Name:    nas.fritz.box
Addresses:  ::   0.0.0.0
 

More information:  

https://crapts.org/2024/04/21/all-fritz-box-modems-have-been-hijacked/ 

https://news.ycombinator.com/item?id=40106336