This repository presents an evidence-based investigation into ShortDot SA, a Luxembourg registry operator controlling seven TLDs, revealing that 70.4% of its 6.2 million domains are phantom registrations with zero DNS records, zero verified legitimate businesses, and significant brand-impersonation phishing at scale.
110
No data
8
0
MIT
2026-07-27
It systematically documents structural conflicts of interest (e.g., registry execs also lead the brand-protection firm NameBlock), provides daily-updated zone enumeration and threat-intel cross-references, and challenges the registry's claim of serving legitimate users with transparent data and an open challenge to find a single real business.
7 zones. 6.2 million domains. Zero verified legitimate businesses.We enumerated every single one.
ShortDot SA (Luxembourg) — a registry operator that charges ICANN $1.74M/year in fees while its zones host 51,670 brand-impersonation domains targeting Chase, Binance, MetaMask, Ledger. 70.4% of all registered domains carry no DNS records. They were never meant to be used. They were meant to be counted. This repository counts them back.
9.5% of all global phishing originates in ShortDot zones · .bond ranks #3 globally by phishing domain count · 100% of .bond phishing domains were maliciously registered — Interisle Consulting Group, Phishing Landscape 2025 · 1,542,922 phishing domains measured
🔴 LIVE INVESTIGATION FEED · Auto-updated · Last fetch
2026-07-27
📦 Domains tracked6,242,647 💰 Est. ShortDot revenue$12,557,633 💸 ICANN fees (registry)$1,741,262 ✅ Confirmed malicious0.1% (3) 🏛️ Verified legitimate0 sites found ⚡ Fresh (≤7d)100.0%
| TLD | Domains | Active | No IP (dead) | Confirmed Malicious | Verified Legit | Est. Revenue |
|---|---|---|---|---|---|---|
.icu | 976,416 | 277,727 (28.4%) | 698,689 | 3 | — | $634,670 |
.bond | 1,325,001 | 106,034 (8.0%) | 1,218,967 | 0 | — | $8,612,506 |
.cyou | 756,981 | 265,657 (35.1%) | 491,324 | 0 | — | $492,038 |
.sbs | 1,912,083 | 596,569 (31.2%) | 1,315,514 | 0 | — | $1,242,854 |
.cfd | 952,385 | 407,496 (42.8%) | 544,889 | 0 | — | $619,050 |
.buzz | 209,416 | 130,210 (62.2%) | 79,206 | 0 | — | $680,602 |
.qpon | 110,365 | 61,237 (55.5%) | 49,128 | 0 | — | $275,912 |
Table auto-generated on each daily fetch run.
| Date | Domains | × Average |
|---|---|---|
2026-07-27 | 5,141 | 1.0× |
bonus (13) · eos (10) · dia (7) · gaming (6) · tron (6) · portal (6) · hop (4) · ledger (4) · unlock (3) · connect (3) · aura (3) · auth (3) · rug (3) · account (3) · access (2)
**Full zone files (all doma
ShortDot SA zone abuse evidence (6.2M domains). Automated Threat Intelligence & daily updated IOCs for .icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon.
Similar projects matched by category, topics, and programming language.
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.
mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.