shortdot-evidence
ShortDot SA zone abuse evidence — 6,242,647 domains across .icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon. 237,894 classified IOC (153,775 HIGH), 6,169 feed/intel confirmed. Daily updated IOC feeds, STIX 2.1 bundle, SIEM CSV.
A daily updated dataset and dashboard tracking millions of suspicious domains registered across seven top level domains, aimed at exposing phishing and brand impersonation activity.
This repository is an automated investigation into domain name abuse across seven top level domain zones operated by a registry called ShortDot SA, covering endings like .icu, .bond, .cyou, .sbs, .cfd, .buzz, and .qpon. The project's own framing is blunt: it claims to have enumerated all 6.2 million domains registered in these zones and found zero verified legitimate businesses among them, while a large share carry brand impersonation attempts against companies like Chase, Binance, MetaMask, and Ledger. It cites a report from Interisle Consulting Group stating these zones account for a meaningful share of global phishing activity.
A script runs daily and rebuilds a live statistics table at the top of the README, showing the current domain count, how many are active versus dead with no DNS records, how many have been confirmed malicious, and an estimate of the registry's revenue and the fees it pays to ICANN. A breakdown table shows these same numbers split out per TLD, along with a list of registration burst days and the brand names and keywords most often targeted by the suspicious domains.
The repository publishes its underlying data as downloadable files rather than just claims in prose. For each TLD there are full domain lists split into deployed (domains pointing to a live IP) and phantom (registered but never connected to a server) sets. Separate indicator of compromise files list confirmed and high severity malicious domains in plain text and CSV format, and structured JSON files break domains down by targeted brand, by registrant who filed many domains at once, and by shared hosting infrastructure. There is also a bundle in the STIX 2.1 format meant to be imported directly into security tools like MISP or OpenCTI, and a live dashboard hosted on GitHub Pages.
The project is released under the MIT license and is tagged TLP CLEAR, meaning the information is meant to be shared without restriction. The full README is longer than what was shown.
Where it fits
- Download blocklists of confirmed and high severity phishing domains for a security feed.
- Pull the STIX 2.1 bundle into a threat intelligence platform like MISP or OpenCTI.
- Use the per brand JSON files to check whether a specific company is being impersonated.
- Cite the aggregated statistics as evidence in an ICANN compliance complaint.