phishdestroy/shortdot-evidence tracks and counts malicious ShortDot registry domains

🏆 *We must confess: we are massive fans of NameSilo. We are endlessly inspired by their mastery — not just their steadfast commitment to retro web design, but their unparalleled operational brilliance in reputation management.*

It takes true dedication to aggressively publish self-praising PR articles and manufactured reviews while systematically trying to silence independent security researchers. We watch in awe as they zealously defend phishing operators and scam networks, going so far as to blatantly lie about removing VirusTotal detections just to keep their most "valuable" clients online.

Their coordinated campaigns to deplatform truth-tellers, block researchers, and scrub the internet of any critical analysis are nothing short of breathtaking.

When a registrar fights this hard and spends this much energy protecting malicious infrastructure, it is only fair that we return the favor. This repository exists to give their tireless efforts the global public recognition they so desperately deserve.

Full NameSilo investigation → github.com/phishdestroy/namesilo-evidence

The Riedl Conflict — Registry Client and Backend Vendor Share a CEO

Michael Riedl sits simultaneously as:

• Chairman of ShortDot SA — the ICANN-contracted gTLD registry operator
• CEO of Team Internet Group plc (LSE: TIG, formerly CentralNic) — the London-listed company that provides ShortDot's technical registry infrastructure: DNS, EPP protocol, zone file management, SLA monitoring

CentralNic/Team Internet processes every registration event across ShortDot's 6.2 million domains. Contract terms, pricing, and service levels between ShortDot and Team Internet are negotiated by parties sharing a chairman/CEO. No arm's-length relationship exists.

Disclosed — but title downgraded. Team Internet's annual reports (2022, 2023, 2024) do disclose ShortDot SA as a related-party transaction — quantified at USD 1.3M (2022), USD 3.2M (2023, later restated to USD 308K), USD 573K (2024). Every instance describes Riedl's ShortDot role as "Director and Shareholder" — not Chairman. His board biography in all three annual reports contains no mention of ShortDot SA. Riedl's own website describes him as "Chair" of a "leading new top-level domain registry." Under UK AIM Rule 13, related-party disclosures must describe the nature of the relationship — Chairman of a counterparty is a materially different governance position than a passive directorship. Full analysis: case/FOUNDERS.md

The Kopas Conflict — Zone Operator on the Brand Protection Board

Kevin Kopas has served simultaneously as:

• COO of ShortDot SA — responsible for zone operations, registrar partnerships, and compliance posture
• SVP of Business Development + Board Member at NameBlock — a company whose revenue model requires persistent threat levels in ShortDot zones to generate demand for blocking services

NameBlock is legally separate from ShortDot (NameBlock AS, Norwegian org 991 279 466). But the separation is nominal: Lars Jensen is Chairman (Styrets leder) of NameBlock AS per the Norwegian business registry (brreg), updated 28 June 2025 — with sole signing authority. ShortDot's own website calls it "ShortDot's NameBlock tool." All seven ShortDot zones are enrolled in NameBlock's blocking marketplace.

ShortDot also publicly lists brand protection companies BrandShelter, BrandMa, BrandSight, and LexSynergy as "Leading Distribution Channels" — not registrars, but vendors whose revenue depends on threat levels in ShortDot zones. When ShortDot zones generate phishing domains, these companies alert brands, who then pay for defensive registrations — which generate wholesale revenue for ShortDot. The protection vendors are literally ShortDot's distribution channel for that secondary revenue stream.

Launched 2018. ShortDot's first and largest zone. Marketed as a personal branding TLD ("I See You").

Reality: Consistently top-ranked by abuse.ch, Spamhaus, and SURBL for phishing density. Active registrations are dominated by gambling infrastructure, crypto drain panels, and credential harvesters targeting financial brands. Verified legitimate use cases: 0 identified to date.

Premium pricing (~$9.99 retail). Marketed to financial services and "trusted brands."

Reality: chase.bond, bofa.bond, binance.bond, ledger.bond — these domains exist. None are operated by JPMorgan Chase, Bank of America, Binance, or Ledger SAS. All are phishing pages impersonating those brands. .bond has become a phishing trademark precisely because it implies financial trustworthiness to unsuspecting victims. 92.0% phantom — the highest in the portfolio.

.cyou = "See You." Marketed for personal brands, influencers, and communities.

Reality: Near-zero legitimate adoption. Populated predominantly by parked domains and fraudulent infrastructure. High-volume serial registrations with no corresponding active content.

Acquired April 2024 from Australian SBS Corporation (via IANA transfer). Previously associated with the Australian public broadcaster.

Reality: After ShortDot acquisition, registration volume spiked anomalously. The overwhelming majority of active .sbs domains serve phishing pages, fake shops, or remain permanently parked. NameSilo concentration in .sbs is 55× above market expectation — coinciding exactly with the acquisition date.

Acquired April 2024 from DotCFD Registry Ltd. "CFD" = Contract for Difference — a leveraged financial instrument.

Reality: A TLD named after a high-risk financial product, operated by a company with no financial regulation standing, populated primarily with fake investment platforms, crypto fraud, and financial phishing. The naming itself is a targeting signal.

Marketed as a social media / engagement TLD. Retail price ~$3–5/year.

Reality: Active abuse zone. Documented use cases include spam distribution infrastructure and click-fraud networks. No verified legitimate business adoption identified.

Marketed as a coupon/discount TLD. Extremely low wholesale pricing.

Reality: Primarily used for affiliate fraud and fake discount schemes. Low volume even by abuse standards.

Data Collection

All domains in ShortDot's seven zones are enumerated daily from ICANN gTLD zone data queried per-TLD. Coverage: 100% of zone registrations — no sampling.

       ╭───────────────────╮      ╭───────────────────╮      ╭───────────────────╮
       │  1. Zone pull     │ ───▶ │  2. TI cross-ref  │ ───▶ │  3. Legitimacy    │
       │  per-TLD (ICANN   │      │  Spamhaus DBL     │      │  classification   │
       │  public zone data)│      │  SURBL / URLScan  │      │  human review     │
       ╰───────────────────╯      │  OTX + 8 feeds    │      ╰───────────────────╯
                                  ╰───────────────────╯

Legitimacy Classification

Threat Intelligence Cross-Reference

DNS-based (no key required):

• Spamhaus DBL — spam / phishing / malware / botnet C&C classification
• SURBL multi — corroborating multi-source signal

Feed cross-reference (phishing domains):

• OpenPhish — community phishing feed (hourly)
• URLhaus (abuse.ch) — active malware distribution URLs
• PhishTank — verified phishing submissions
• mitchellkrogza/Phishing.Database — 300K+ active phishing domains (daily)
• Spam404 lists — spam/phishing domain blacklist
• davidonzo/Threat-Intel — Italian CERT-style feed
• hagezi dns-blocklists — multi-source aggregation (pro tier)
• GlobalAntiScam.org — scam domain blocklist

API-based (pre-scanned results):

• URLScan.io — per-TLD search for pre-scanned malicious pages
• AlienVault OTX — domain pulse lookup (requires OTX_API_KEY)

Correlation:

• PhishDestroy Destroylist — correlation with main blocklist

Full list: data/ioc/brand_domains.json

ShortDot SA (Luxembourg)
       │  Charges wholesale per-domain annual fee
       │  .icu/.sbs/.cfd/.cyou ~$0.65 · .bond ~$6.50 · .buzz ~$3.25 · .qpon ~$2.50
       ▼
400+ Registrar Partners (NameSilo · GoDaddy · Namecheap · Alibaba · GMO · Dynadot…)
       │  Register at retail — keep margin
       ▼
End registrant — phisher / spammer / scammer / phantom account
       │  Uses domain for phishing / carding / draining / metric inflation
       │  OR: domain never activates (phantom, dead-zone padding)
       ▼
Revenue flows UP regardless of what domain does
ShortDot collects · registrar collects · ICANN collects
The victim (end user phished) pays nothing — and loses everything

ICANN Fee Extraction

At 6,242,647 current active domains:

• ICANN volume cuts: $1,560,662/year
• ICANN zone fees: $180,600/year (7 zones)
• ShortDot wholesale: $12,557,633/year
• 4,397,717 phantom domains contribute to all three streams while serving no verifiable purpose

Nobody in this chain has a financial incentive to reduce registration volume — including by filtering out abuse.

NameSilo is a named partner of ShortDot. The 55× concentration anomaly — coinciding exactly with ShortDot's April 2024 acquisition of .sbs and .cfd — represents the most concrete financial link between registry and registrar in this ecosystem.

High-volume phantom registrations through a named partner registrar are consistent with metric padding: artificially inflating zone size to signal market adoption to investors, analysts, and ICANN during contract reviews.

Questions that require answers:

1. Who is purchasing hundreds of thousands of .sbs and .cfd domains through NameSilo and not activating them?
2. Where does the payment originate?
3. Does NameSilo's revenue reporting account for margin on phantom registrations separately?
4. Did the timing of the .sbs/.cfd acquisition and the NameSilo spike involve coordination?

A common defense for massive volumes of phantom registrations is that they serve backend infrastructure, private VPN nodes, or isolated telemetry endpoints.

1. Industry standard is subdomain routing. Vercel (*.vercel.app), Tailscale (*.ts.net), and major ISPs generate millions of unique endpoints using dynamic subdomains under a single root. Registering a million separate root domains costs millions in wholesale fees. No legitimate scalable infrastructure does this.

2. Certificate Transparency destroys the OPSEC argument. Every distinct root domain issued a certificate is permanently recorded in public CT logs. A VPN network using individual root domains actively broadcasts its entire topology to the public internet — an indelible trail of every node and deployment time. This is a fatal architectural flaw.

3. Wildcards provide actual privacy. A single root domain with *.internal.net secures millions of nodes without leaking hostnames to CT logs. Subdomains are opaque to passive enumeration; unlike root TLD zone files (publicly downloadable via ICANN CZDS), subdomain trees are invisible to outside observers.

Conclusion: The private infrastructure defense fails on cost, OPSEC, and architecture simultaneously. The actual function of phantom registrations is metric padding — inflating zone volume to signal adoption to investors and protect the registry from ICANN suspension reviews.

Step 1: ShortDot creates TLD zones (.icu, .sbs, .bond…)
                │
                ▼
Step 2: Phishers register brand-impersonating domains
        chase.bond · binance.icu · metamask.sbs · kraken.cyou
                │
                ▼
Step 3: Phishing begins. Brands are notified by their security teams.
                │
                ▼
Step 4: NameBlock approaches the brand:
        "For $X/year, we block your name across all ShortDot zones"
        "Without protection, anyone can register [brand].icu"
                │
                ▼
Step 5: Brand pays NameBlock defensive registration fees
                │
                ▼
Step 6: ShortDot collects wholesale + NameBlock collects service fee
                │
                ▼
Both profit from the same threat they created.

NameBlock is a separate Norwegian company (NameBlock AS). But ShortDot's COO (Kevin Kopas) sits on NameBlock's board, and Lars Jensen is Chairman (Styrets leder) of NameBlock AS (brreg confirmed, sole signing authority) — all seven ShortDot zones are enrolled in NameBlock's blocking marketplace. The entity whose principals created the attack surface (ShortDot) has board-level and ownership-governance stakes in the company selling protection from it (NameBlock). Insurance sold against a fire that the insurer's principals have a financial interest in not extinguishing.

If we look back at the Freenom case, the sheer volume of toxic infrastructure was colossal. At the time, automated scanning capabilities to process millions of domains at scale were not yet available, so exact historical metrics on their abuse levels cannot be provided. However, one key distinction applies: free is not cheap. Free is simply free.

ShortDot SA and its partner registrars operate on a completely different premise — they extract direct financial profit from every single registration. Logically, direct financial gain should dictate a higher level of accountability and stricter operational obligations. One would naturally assume that somewhere in their compliance policies there is a basic, undeniable rule: do not ignore phishing reports, and do not turn the internet into a toxic dumpster.

Unfortunately, the reality of how abuse reports are handled suggests that the drive for registration volume heavily outweighs the responsibility to maintain a clean namespace.

The Freenom defense — "we offer free domains, enforcement is hard" — was weak but coherent. ShortDot's equivalent — "we charge per domain and still cannot maintain basic hygiene" — has no coherent defense at all.

The financial accountability argument is straightforward: when a registry charges wholesale fees on every domain, profits from the NameBlock brand-protection racket running on top of its own zones, and collects revenue regardless of whether those domains serve phishing pages or nothing at all — the registry has removed every incentive to reduce registrations and retained every incentive to maximize them. The result is what this repository documents: 6.2 million domains, zero verified legitimate businesses, and $14.3 million in annual extraction from an ecosystem built around abuse.

When confronted with astronomical volumes of toxic registrations, registrars like NameSilo frequently attempt to cover their tracks by citing "regional affiliate marketing" or "legitimate gambling traffic." This defense is fundamentally flawed and structurally dishonest.

Let us be absolutely clear: no self-respecting, legitimate brand registers 100,000 disposable garbage domains across random zones.

Legitimate businesses — even in high-risk industries like gambling (e.g., Stake) — build their reputation around a single primary domain and its subdomains. They do this because brand recognition requires consistency, and fragmenting a brand across thousands of cheap TLDs actively destroys user trust while directly exposing their own customers to phishing.

When NameSilo sells these domains in bulk, they are not supporting legitimate affiliates. They are actively arming operators whose sole purpose is to bypass sovereign legal blocks (such as financial or gambling regulations in Turkey, Indonesia, and elsewhere). This is not a jurisdiction where ignoring foreign law is standard practice. You cannot violate the financial regulations of Indonesia or Turkey simply because such practices may be tolerated elsewhere. A globally accredited registrar operating under ICANN contract has no such exemption. Aggressively supplying infrastructure to circumvent the laws of other nations — and systematically ignoring the resulting abuse reports — is not a neutral business practice. It is complicity. Governments do not implement legal blocks just so a registrar can sell thousands of disposable mirror domains and claim plausible deniability.

The Financial Instrument: Metric Padding for the Canadian Exchange

What ShortDot actually provides to NameSilo is not a legitimate internet product; it is a financial instrument.

It is a mechanism to demonstrate hyper-growth, record registration volumes, and "super-profits" to investors, notably in their filings for the Canadian stock exchange. It is fascinating how a company operating with a 2008-era administrative interface suddenly demonstrates exponential volume growth. The math behind the heavily discounted bulk sales is designed for one purpose: to inflate quarterly reports. (Cross-reference the exact domain counts against their claimed revenue in our NameSilo investigation repository.)

The Regulatory Void

This pipeline thrives because the domain industry currently has no genuine regulatory body. ICANN cannot act as a regulator because it is a direct financial beneficiary. They are a technical coordinator that extracts a fee from every single one of these phantom and malicious registrations. It is an established standard of society: an entity cannot effectively regulate a system from which it extracts direct, volume-based profit.

Furthermore, ShortDot bypassed standard ICANN application scrutiny by simply purchasing existing, established zones (like .sbs and .cfd) and immediately pivoting them into this bulk-abuse model. This sets a highly dangerous precedent.

Ultimately, the ShortDot–NameSilo partnership has contributed absolutely nothing of utility to the global internet. It has generated only mass-scale phishing infrastructure, a corporate extortion loop disguised as "brand protection," and artificially inflated financial metrics built on a foundation of dead zones.

Convicted: LabHost PhaaS — ShortDot Domains in FBI Criminal Evidence

In April 2024, a coordinated operation across 19 countries dismantled LabHost — a phishing-as-a-service platform. Mastermind Zak Coyne was sentenced to 8.5 years imprisonment at Manchester Crown Court (14 April 2025). The FBI published the full list of 42,515 phishing domains from the platform's backend.

ShortDot TLDs in the FBI-published LabHost domain list:

Examples from criminal evidence: etransfer.icu · rbcroyalbank.icu · rbc-portal-support.cfd · metamask.rf82728.cfd · jpmorgan.chaes.sbs · scotia-app-support.sbs

Full parsed dataset: ioc/FBI_IC3_LabHost_ShortDot_only.csv

Active: Google RICO Suit — Lighthouse / Smishing Triad (SDNY 2025)

Google LLC v. DOES 1–25 (S.D.N.Y. 1:25-cv-09421, filed November 2025) — charges include RICO, CFAA, Lanham Act. Infrastructure: ~200,000 fraudulent domains at a time; 1M+ victims across 120 countries; $1B+ estimated losses. ShortDot TLDs .icu, .cfd, .sbs, .buzz documented as Smishing Triad infrastructure by Unit 42 (Palo Alto) and SilentPush.

Google LLC v. Yucheng Chang (S.D.N.Y. 1:25-cv-10440) — Darcula/Magic Cat PhaaS. Permanent Default Judgment and Permanent Injunction entered. .cyou documented in the same infrastructure cluster. In May 2026, Bulgarian police arrested two operators running .cyou campaigns from this kit.

Unindicted but Documented: Revolver Rabbit — 500,000 .bond Domains

A single unidentified threat actor ("Revolver Rabbit") registered 500,000+ .bond domains for XLoader/Formbook infostealer C2 infrastructure (concentrated May–July 2024, registrar: Key-Systems GmbH). Estimated cost: $1M+. One registrar alone — Key-Systems — registered 74,737 phishing .bond domains, placing it in the global top-5 registrars by phishing domain count. No indictment has been filed.

The Numbers That Require No Interpretation

ShortDot zones account for 9.5% of all phishing domains on Earth — nearly 1 in 10. Source: Interisle Consulting Group, Phishing Landscape 2025 (1,542,922 global phishing domains measured, May 2024–April 2025).

New gTLDs are 11% of the domain market but generate 51% of phishing. ShortDot operates the most abusive cluster within that 11%. 100% maliciously registered means every phishing domain in .bond was registered specifically to commit fraud — not a legitimate site that was later compromised. The registry collected wholesale revenue on each.

The Experience Argument

ShortDot's principals are not newcomers. Lars Jensen ran a wholesale registrar (Ascio/Speednames) from 2000. Kevin Kopas managed channel operations at PIR (which operates .org) and Radix Registry. Michael Riedl was CFO then CEO of CentralNic, which operates registry backends for hundreds of TLDs. Christian Tecar attended 6+ ICANN meetings as an industry stakeholder.

The Interisle abuse data has been presented at ICANN public meetings every year since 2021, naming ShortDot zones by name. Spamhaus published an open letter to ShortDot SA by name ("We hope you keep .sbs clean"). ICANN sent formal correspondence in June 2026 specifically citing .icu and .bond in connection with the FBI's LabHost domain list.

People with this background, receiving this information, operating these zones, cannot plausibly claim unawareness.

Full case documentation: case/CRIMINAL_CASES.md

shortdot-evidence/
├── case/
│   ├── INVESTIGATION.md        Full investigation document
│   ├── FINANCIAL.md            Follow-the-money analysis
│   ├── NAMEBLOCK.md            NameBlock structural conflict analysis
│   ├── FOUNDERS.md             Principal profiles & structural conflicts
│   ├── LEGITIMATE_SURVEY.md    Open challenge — verified legitimate sites
│   ├── CLUSTERS.md             Operator infrastructure clusters
│   └── HIGH_SEVERITY.md        High-severity confirmed cases
├── data/
│   ├── all.txt                 All tracked domains (all 7 zones)
│   ├── index.json              Full analytics snapshot
│   ├── ioc/                    IOC exports (STIX, serial registrants, shared IPs)
│   ├── snapshots/              Monthly analytics snapshots
│   └── new/YYYY/MM/            Daily domain additions
├── ioc/
│   ├── domains_all_malicious.txt
│   ├── domains_high.txt        HIGH severity (phishing/drain/carding)
│   └── indicators.csv          Full IOC table
├── scan/
│   ├── fetch_new.py            Daily data pipeline (zone fetch → stats → README)
│   ├── classify_brands.py      Brand/keyword matching + phishing feed cross-ref
│   └── check_intel.py          TI cross-ref: Spamhaus/SURBL/URLScan/OTX
├── stats/
│   ├── by_tld/                 Per-TLD badge JSON files
│   └── *.json                  Overall badge JSONs (shields.io format)
├── evidence/
│   ├── HASHES.txt              SHA-256 of all screenshots
│   └── [screenshots]           PNG evidence, SHA-256 verified
└── .github/workflows/
    └── update.yml              Daily automation