该仓库对卢森堡注册局运营商 ShortDot SA 进行基于证据的调查,揭示其管理的 7 个顶级域中 70.4% 的域名是幽灵注册(无 DNS 记录),未发现任何合法企业,且存在大规模品牌假冒钓鱼攻击。

Stars

110

7 天增长

暂无数据

Fork 数

8

开放 Issue

0

开源协议

MIT

最近更新

2026-07-27

AI 仓库情报摘要
FR-AI / ANALYSIS

为什么值得关注

系统性地记录了结构性利益冲突(如注册局高管同时领导品牌保护公司 NameBlock),提供每日更新的区域枚举与威胁情报交叉引用,并以透明数据和公开挑战(要求找出一个真实企业)质疑注册局的合法用户宣称。

适合谁使用

  • 网络安全研究员与威胁分析师
  • ICANN 合规与政策制定者
  • 品牌保护与反钓鱼团队
  • 域名行业监督者与记者

典型使用场景

  • 导入每日 IOC 数据(STIX 2.1、CSV)用于钓鱼检测与阻断
  • 为向 ICANN 提交注册局滥用投诉提供证据
  • 开展域名滥用与注册局问责的学术或政策研究
  • 评估域名组合的品牌风险或尽职调查

项目优势

  • 每日更新、100% 枚举七个顶级域的所有域名
  • 多重威胁情报交叉引用(Spamhaus、SURBL、URLScan、OTX 及八个钓鱼源)
  • 开放数据与可复现方法,提供完整区域文件与结构化分析
  • 清晰记录注册局-注册商利益冲突(如 NameSilo 55 倍集中异常)及收入流向

使用前须知

  • 仅覆盖 ShortDot 运营的顶级域,不涉及其它注册局
  • 合法性分类依赖自动信号与人工审核,可能漏判边缘案例
  • 幽灵域名(无解析)被归类为非恶意,但调查推断其为指标注水,缺乏直接意图证据

README 快速开始

7 zones. 6.2 million domains. Zero verified legitimate businesses.We enumerated every single one.

ShortDot SA (Luxembourg) — a registry operator that charges ICANN $1.74M/year in fees while its zones host 51,670 brand-impersonation domains targeting Chase, Binance, MetaMask, Ledger. 70.4% of all registered domains carry no DNS records. They were never meant to be used. They were meant to be counted. This repository counts them back.

9.5% of all global phishing originates in ShortDot zones  ·  .bond ranks #3 globally by phishing domain count  ·  100% of .bond phishing domains were maliciously registered — Interisle Consulting Group, Phishing Landscape 2025  ·  1,542,922 phishing domains measured


🔴 LIVE INVESTIGATION FEED · Auto-updated · Last fetch 2026-07-27

📦 Domains tracked6,242,647 💰 Est. ShortDot revenue$12,557,633 💸 ICANN fees (registry)$1,741,262 ✅ Confirmed malicious0.1% (3) 🏛️ Verified legitimate0 sites found ⚡ Fresh (≤7d)100.0%

🏷️ TLD Breakdown

TLDDomainsActiveNo IP (dead)Confirmed MaliciousVerified LegitEst. Revenue
.icu976,416277,727 (28.4%)698,6893$634,670
.bond1,325,001106,034 (8.0%)1,218,9670$8,612,506
.cyou756,981265,657 (35.1%)491,3240$492,038
.sbs1,912,083596,569 (31.2%)1,315,5140$1,242,854
.cfd952,385407,496 (42.8%)544,8890$619,050
.buzz209,416130,210 (62.2%)79,2060$680,602
.qpon110,36561,237 (55.5%)49,1280$275,912

Table auto-generated on each daily fetch run.

📈 Registration Burst Days

DateDomains× Average
2026-07-275,1411.0×

🎯 Top Targeted Brands & Keywords

bonus (13) · eos (10) · dia (7) · gaming (6) · tron (6) · portal (6) · hop (4) · ledger (4) · unlock (3) · connect (3) · aura (3) · auth (3) · rug (3) · account (3) · access (2)

📥 Download Threat Intelligence

**Full zone files (all doma

项目描述

ShortDot SA zone abuse evidence (6.2M domains). Automated Threat Intelligence & daily updated IOCs for .icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon.

相关仓库与替代方案

根据分类、Topic 和编程语言匹配的相似项目。

lopopolo
精选
lopopolo GitHub avatar

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI 与机器学习AI 智能体
2,390
slvDev
精选
slvDev GitHub avatar

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI 与机器学习大语言模型
1,960
littledivy
精选
littledivy GitHub avatar

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI 与机器学习
1,482