{
  "document": "NameSilo Registrar Abuse Investigation — Forensic Evidence Manifest",
  "generated_utc": "2026-06-03T02:43:04Z",
  "investigator_note": "This manifest provides SHA-256 integrity hashes for all primary evidence files. Any modification of the data files will result in a different hash, invalidating the evidence.",
  "methodology": {
    "scan_tool": "aiohttp + asyncio (Python 3.11)",
    "http_timeout_seconds": 5,
    "concurrency_per_server": "400-600 async connections",
    "infrastructure": [
      "AWS Lambda: namesilo-scanner function, us-east-1, up to 400 concurrent",
      "GCP Cloud Run: domain-scanner-job, us-central1"
    ],
    "scan_period": "2026-06-02 to 2026-06-03 UTC",
    "classification_criteria": {
      "active_with_forms": "HTML forms present — login/credential harvesting pages",
      "active_content": "200+ words of content — active website",
      "parking": "Known parking page patterns (namesilo, godaddy, sedo, etc.)",
      "redirect_external": "HTTP redirect to off-domain URL",
      "empty": "Blank page or under 20 words",
      "low_content": "20-200 words, likely placeholder",
      "dead": "Connection timeout, refused, or DNS failure within 5s",
      "for_sale": "Domain marketplace / for-sale page"
    },
    "favicon_clustering": "MurmurHash3 (mmh3) of favicon bytes — identical hash = identical favicon = same operator",
    "server_fingerprinting": "SHA256 of (Server header + X-Powered-By + ETag pattern), truncated to 12 hex chars"
  },
  "dataset_summary": {
    "total_namesilo_domains": 5269357,
    "domains_without_dns": 1871944,
    "domains_with_dns_scanned": 3397413,
    "dead_no_response": 2255310,
    "active_responded": 1129114,
    "active_pct_of_total": "21.4%",
    "total_junk_pct_of_total": "87.3%",
    "cloudflare_fronted": 429079,
    "note_scan_phases": "active_responded and dead counts reflect the merged two-pass scan (garbage_5s.jsonl + all_missing_results.jsonl → final_garbage.jsonl). cloudflare_fronted and namesilo_self_parked counts are from the complete merged dataset."
  },
  "key_findings": {
    "brand_phishing_domains": 3726,
    "indonesian_gambling_domains": 24349,
    "chinese_adult_piracy_domains": 10571,
    "namesilo_self_parked_domains": 8684,
    "namesilo_self_parked_gambling_adult": 185,
    "single_server_fingerprint_domains": 328230,
    "cloudflare_flagged_phishing_on_that_server": 2062
  },
  "evidence_files": [
    {
      "file": "domains_to_scan.jsonl",
      "path": "E:/namesilo-scanner/domains_to_scan.jsonl",
      "description": "Input domain list (3,397,413 Namesilo domains with DNS)",
      "size_bytes": 522896924,
      "size_human": "498.7 MB",
      "sha256": "70782d6b6312f27533267fc34977a971b90c5ab394e075d76ba25d22bd866f23"
    },
    {
      "file": "final_garbage.jsonl",
      "path": "E:/namesilo-scanner/final_garbage.jsonl",
      "description": "Complete scan results — non-dead records (1,129,114 domains)",
      "size_bytes": 489752857,
      "size_human": "467.1 MB",
      "sha256": "b0d6cc1c80b2964593b310029fde4b7f4aeac6c702baaecae78359beab84b0f6"
    },
    {
      "file": "all_missing_results.jsonl",
      "path": "E:/namesilo-scanner/all_missing_results.jsonl",
      "description": "Rescan results — previously unscanned 894K domains",
      "size_bytes": 318317222,
      "size_human": "303.6 MB",
      "sha256": "e8224d3fd4928de67a5ba995a727c11fa28e6cbdb2e5a1cf4a8f78b1387181aa"
    },
    {
      "file": "garbage_5s.jsonl",
      "path": "E:/namesilo-scanner/garbage_5s.jsonl",
      "description": "Initial scan results — 911,188 non-dead records",
      "size_bytes": 257359881,
      "size_human": "245.4 MB",
      "sha256": "3f3d36ebc97fb97ef6ac492f66ff8301f80a98a161f28e726850863a8ac76f8e"
    },
    {
      "file": "report.html",
      "path": "E:/namesilo-scanner/report.html",
      "description": "Investigation report HTML",
      "size_bytes": 589713,
      "size_human": "0.6 MB",
      "sha256": "2e3f06488ba39e8b953d454d31c206f4a478285bd7aed375453bb3973a295839"
    },
    {
      "file": "1479_full.csv",
      "path": "E:/1479_full.csv",
      "description": "Source CSV — complete Namesilo registrar dump (5,269,357 domains)",
      "size_bytes": 364911632,
      "size_human": "348.0 MB",
      "sha256": "dd533dfa46077ba6c5bf204cd984f53fd4308f395d293a3e7ac561c596990907"
    }
  ],
  "manifest_sha256": "af7f81f859e1f7a3a0a8fa19a4ab92d94c1be7750e6b63e1e46ea0020c0f624b"
}