phishdestroy/shortdot-evidence

This repository is an automated investigation into domain name abuse across seven top level domain zones operated by a registry called ShortDot SA, covering endings like .icu.bond.cyou.sbs.cfd.buzz, and .qpon. The project's own framing is blunt: it claims to have enumerated all 6.2 million domains registered in these zones and found zero verified legitimate businesses among them, while a large share carry brand impersonation attempts against companies like Chase, Binance, MetaMask, and Ledger. It cites a report from Interisle Consulting Group stating these zones account for a meaningful share of global phishing activity. A script runs daily and rebuilds a live statistics table at the top of the README, showing the current domain count, how many are active versus dead with no DNS records, how many have been confirmed malicious, and an estimate of the registry's revenue and the fees it pays to ICANN. A breakdown table shows these same numbers split out per TLD, along with a list of registration burst days and the brand names and keywords most often targeted by the suspicious domains. The repository publishes its underlying data as downloadable files rather than just claims in prose. For each TLD there are full domain lists split into deployed (domains pointing to a live IP) and phantom (registered but never connected to a server) sets. Separate indicator of compromise files list confirmed and high severity malicious domains in plain text and CSV format, and structured JSON files break domains down by targeted brand, by registrant who filed many domains at once, and by shared hosting infrastructure. There is also a bundle in the STIX 2.1 format meant to be imported directly into security tools like MISP or OpenCTI, and a live dashboard hosted on GitHub Pages. The project is released under the MIT license and is tagged TLP CLEAR, meaning the information is meant to be shared without restriction. The full README is longer than what was shown.