Active Investigation TLP:CLEAR IANA #1479 Full Disclosure Complete Zone Census — No Sampling Report v1.0

NameSilo LLC — Domain Registrar
Abuse Intelligence Report

Every single domain registered at NameSilo · 5,269,357 domains · complete zone file · June 2026

0
Domains — complete census
0%
Junk rate
0
Confirmed abuse
0
Single-FP network
namesilo-scan — bash 
$ python3 scan.py --registrar namesilo --threads 500 --timeout 5 --output ./evidence/
────────────────────────────────────────────────────────────────────────
[2026-06-02 23:41:07 UTC] Loaded 1479_full.csv  364.9 MB · 5,269,356 rows — complete NameSilo zone export
[INFO] No sampling. Every registered NameSilo domain will be processed.
[2026-06-02 23:41:09 UTC] 3,397,413 with DNS → HTTP scan queue · 1,871,944 no DNS → classified dead
[2026-06-03 07:21:17 UTC] Scan complete. All 5,269,357 domains accounted for.
────────────────────────────────────────────────────────────────────────
  SCAN RESULTS
  Total domains         5,269,357
  DNS-resolved          3,397,413   64.5%
  Active HTTP           1,129,114   21.4%
  Dead / timeout        2,255,310
  No DNS                1,871,944
────────────────────────────────────────────────────────────────────────
  ABUSE FINDINGS
  Brand phishing            3,726   single favicon cluster · all Login pages
  Indonesian gambling      24,349   12+ favicon clusters · slot/togel/4D
  Chinese adult/piracy     10,571   unlicensed streaming · adult content
                        ─────────
  TOTAL CONFIRMED          38,646
────────────────────────────────────────────────────────────────────────
  CRITICAL INFRASTRUCTURE
  Single-FP network       328,230   fingerprint: 811e0897f489
    └ CF-phishing            2,062   Cloudflare-confirmed on same server
  NameSilo self-park          144   gambling/adult on registrar's own parking
────────────────────────────────────────────────────────────────────────
[✓] SHA-256 evidence chain verified → evidence_manifest.json

Executive Summary

Executive Summary

This report documents an independent forensic analysis of every domain registered through NameSilo LLC (IANA #1479), a Phoenix, AZ-based domain registrar and publicly traded company (CSE: URL). This is not a sample — we obtained and processed the registrar's complete zone file: all 5,269,357 domains active as of June 2026, without exception.

87.3% of the NameSilo portfolio constitutes digital junk — domains with no DNS resolution, connection timeouts, or empty placeholder pages. Industry benchmarks for compliant registrars typically show 5–15% dead or parked domains; NameSilo's rate is 5–17× above that norm, indicating systematic domain warehousing and bulk registration abuse.

Within the active 21.4% subset, we identified three major organized abuse ecosystems: brand-impersonation phishing (3,726 domains sharing a single favicon fingerprint, all serving bare "Login" pages), Indonesian online gambling (24,349 domains across 12+ coordinated clusters), and Chinese adult content / piracy (10,571 domains). In aggregate these categories account for 38,646 confirmed abuse domains.

A critical infrastructure finding: 328,230 domains — 9.7% of all scanned — share a single server fingerprint (811e0897f489). Of these, 2,062 are independently flagged as phishing by Cloudflare. NameSilo's own parking platform hosts 144 domains serving gambling and adult content, confirming the registrar directly monetizes abuse through its revenue-share parking program.

Methodology Summary

  • Complete census: Full NameSilo zone export — 5,269,357 domains, zero sampling. Every registered domain is accounted for.
  • Passive analysis: DNS and WHOIS metadata correlation on all 5.27M source records.
  • Active probing: Async HTTP/TLS fingerprinting at 400–600 concurrent connections per node. 5-second timeout.
  • Favicon clustering: MurmurHash3 of raw favicon bytes — identical hash = identical favicon = same operator.
  • Server fingerprinting: SHA-256 of (Server + X-Powered-By + ETag) headers, truncated to 12 hex chars.
  • Page classification: Heuristic rules on content length, HTML form presence, language, parking patterns, keyword density.
  • PII handling: Raw registrant contact fields (email, phone) redacted from all public outputs.
  • Chain of custody: All evidence files SHA-256 hashed at collection. See Data Integrity.

Key Metrics

Registrar Baseline
0
Total domains — IANA #1479
DNS Validated
0
64.5% of total — active scan queue
Active Responders
0
21.4% of total · 33.2% of scanned
Confirmed Abuse
0
Phishing + gambling + piracy

Abuse Matrix

Brand Phishing3,726Single cluster · all "Login" pages
Indonesian Gambling24,34912+ favicon clusters · slot/togel/4D
Chinese Adult / Piracy10,571Unlicensed streaming · adult content
Cloudflare Fronted429,079True origin obscured by CDN
Single Server Network328,230Fingerprint: 811e0897f489
CF-Flagged Phishing2,062Cloudflare-confirmed on same server
Registrar Self-Parked8,684NameSilo own parking revenue
Self-Parked Abuse144Gambling/adult on NameSilo parking

Population Disposition

Domain Set Breakdown

5.27M
total
No DNS / No IP1,871,944
Dead / No HTTP2,255,310
Parked / Placeholder293,881
Active Content472,203
Confirmed Abuse38,646

Registration Year Distribution

YearDomains%
20252,086,44739.6%
20241,080,12620.5%
2026765,25414.5%
2023259,5104.9%
2022155,5603.0%
2021135,7962.6%
2020120,5582.3%
2019–2017263,4945.0%
74.6% of domains registered 2024–2026 — consistent with domain farm operations, not organic registrar growth.

Heuristic Page Classification

Page Type Distribution — Active Set (1,129,114 domains)

ClassificationCount% ScannedScale
Active content (200+ words)504,73814.9%
Empty / blank page272,1258.0%
Low content (20–200 words)163,0994.8%
Forms — credential harvesting63,8711.9%
External redirect55,4581.6%
Server error (5xx)26,4970.8%
Parking page21,7560.6%
Coming soon7,7120.2%
404 Not found6,5490.2%
Redirect loop1,2040.0%
63,871 domains with HTML forms — pages containing at least one HTML <form> element. Includes login pages, contact forms, sign-up flows, and other interactive pages. Subset may overlap with confirmed abuse categories; form presence alone is not a finding.

Parking Provider Distribution

ProviderCount% ParkedScale
NameSilo (self-operated)8,68439.9%
GoDaddy2,25510.4%
Uniregistry1,4506.7%
Sedo1,6967.8%
Dan.com1050.5%
ParkingCrew810.4%
Above.com130.1%
Afternic50.0%
Registrar conflict of interest: NameSilo operates its own parking platform on which 144 self-parked domains serve gambling and adult content. The registrar directly profits from hosting abuse under its own brand.

Server Fingerprint Analysis

Critical Finding: Fingerprint 811e0897f489 appears on 328,230 domains — 9.7% of all scanned. This SHA-256 of server response headers identifies a single server configuration. 2,062 of these domains are independently flagged as phishing by Cloudflare — one of the largest single-infrastructure abuse operations identified in a registrar dataset.
#Fingerprint (12-char SHA-256)Domains% ScannedClassificationScale
01811e0897f489328,2309.7%2,062 CF-phishing
02c7d46cc45975126,9563.7%unclassified
03d8c33640a2fc96,4932.8%adult / gambling
044492f7f3e69c56,2421.7%unclassified
05d035bde8b6a851,4901.5%parking / redirect
060e4ae99dea1747,7651.4%unclassified
0724be2aa9d59836,0181.1%unclassified
08310865488d6432,7861.0%Indonesian gambling

IP Hosting Geography

Top Hosting Countries (source-IP field in registrar dump)

CountryDomains% w/ IPScale
USUnited States965,74428.4%
DEGermany652,41819.2%
HKHong Kong88,9792.6%
SGSingapore84,4772.5%
NLNetherlands80,7392.4%
CACanada71,4252.1%
GBUnited Kingdom45,3651.3%
BGBulgaria23,7560.7%
RURussia22,2060.7%
FRFrance20,7300.6%
UAUkraine16,0460.5%
INIndia15,3740.5%

Top TLDs — Full CSV (5.27M)

TLDDomainsScale
.com2,198,391
.sbs378,383
.xyz372,257
.net250,943
.cfd227,370
.org223,677
.info222,058
.top128,160
.click98,744
.link70,138

Orange-highlighted TLDs are known abuse-concentration zones: .sbs, .xyz, .cfd, .top, .click, .link together account for 1.28M domains in the portfolio.

Active Page Title Analysis

Top keywords extracted from <title> tags across all active-responding domains. This vocabulary is diagnostic of the content ecosystem NameSilo actively hosts.

redirecting...117,162
just a moment...70,863
game24,161
online20,739
dengan9,865
bonus6,660
91JQ就要激情6,188
992kp快乐看片6,160
slot6,053
paling5,895
situs5,651
jackpot5,190
cuan5,067
casino4,994
besar4,722
gacor4,450
gaming4,107
please verify...4,981
Indonesian gambling vocabulary: gacor = hot/lucky machine · cuan = profit · situs = website · paling = most/best · dengan = with. Purple highlights: Chinese adult platform title signatures. These appear across thousands of unique domain titles, confirming systematic organized hosting of illegal operations.

Coordinated Networks — Favicon Cluster Analysis

MurmurHash3 of favicon bytes. Identical hash across domains = same operator. Sorted by domain count descending. Clusters are independent of the 328,230-domain server-fingerprint network above.

#Favicon HashDomainsCategorySample IOCs
014286942145,151Chinese Adult Redirect
18jms.sbshsh9.hairccjapian.sbs
02-6065774253,915Chinese Adult (91JQ)
91jq157jq.work91jq178jq.work91jq186jq.work
03-1864758433,858Chinese Piracy (992kp)
337bj24.xyzqpp91qpp.xyzqqd8qqd.xyz
0411087958423,726Brand Phishing
turangiqjplzn.comwellingtonplxqzn.com
05-19012369822,798Chinese Adult (nc18)
332t332.xyz335a335.xyz336f336.xyz
06-18546473272,341Indonesian Gambling
nego178.combola108.organda89.com
07840929122,296Indonesian Gambling
apace99.comkompak138.orgmafiabola99.org
08-1437971842,278Indonesian Gambling
kimmikka.comborototo.netlalatwin.com
0913113990741,767Indonesian Gambling
pio4d.netyang4d.netpiototo.net
1012800844361,742Indonesian Gambling
bosslot168.netdewi168login.comix88.org
116611197501,697Indonesian Gambling
zidan123.comjiwa4d.netmade4d.net
1220723659141,518Chinese Adult
csav4.helpggmt7.skinhchs2.skin

Exhibit A — Global Brand Impersonation Infrastructure

Campaign pattern: [brand-name]-[random-consonants].rest or .icu — each domain presents an identical credential-harvesting “Login” page. Confirmed targets include Adidas, Airbus, Aeroflot, Afterpay, BMW, Cartier, Chanel, Danone, IKEA, Siemens, Spotify, Volkswagen, and 200+ further global brands. The entire campaign of 3,726 domains is registered through NameSilo.

Sample Domains — Credential Harvesting (30 of 3,726)

a2milk-aqjvnt.restab-inbev-kqvtx.icuabb-aqjvnt.restaberdeentjrzql.infoablv-aqjvntps.restabordo-blqzen.restaboukir-kqvtx.icuabsheron-kqvtx.icuacb-aqjvntps.restacecook-blqzenua.restacelera-lqzvmra.restacig-mznpr.icuacuario-aqjvntps.restadaro-aqjvntps.restadecco-hqzvlma.restadidas-eg-tkwse.icuaditum-bzsqme.restadnoc-gwvpa.icuadriatic-tkwse.icuadriaticmarinas-vqjpl.icuaerodromi-kqvtx.icuaeroflot-jqvzmla.restaerogal-cqmdse.restaerolineas-pqzvrna.restaeromexico-aqjvntps.restafhold-blqzen.restafran-bxqtuv.restafriquia-kqvtx.icuafterpay-blqzen.restacuario-bxqtuv.rest
Total Phishing Domains3,726identical Login credential-harvesting page
TLDs Used.rest  .icu  .infobulk-registered cheap TLDs
Registrar Share100%entire campaign on NameSilo

Exhibit B — Indonesian Online Gambling Criminal Networks

Online gambling is illegal in Indonesia (UU ITE No.11/2008, KUHP Art. 303). Each network below represents a distinct operation identified by a unique favicon fingerprint, sharing identical page templates across hundreds to thousands of domains registered through NameSilo. Confirmed count (strict favicon-cluster match): 19,198 domains across 11 networks. Broader heuristic estimate (favicon + keyword matching): 24,349. This report uses the conservative confirmed figure in all primary findings. See Data Conflicts section for full reconciliation.
Network (named by primary domains)DomainsSample IOCs
NEGO / BOLA Network2,341
nego178.combola108.organda89.comapidewa99.com
APACE / KOMPAK Network2,296
apace99.comkompak138.orgmafiabola99.orgmentos69.org
Kimmikka / Puputoto Network2,278
kimmikka.compuputoto.netkudawinx.comlalatwin.com
Pio4D / Politogel Network1,767
pio4d.netpiototo.netpolitogel.netyang4d.net
IBUKOTA / IX88 Network1,742
ibukota33.orgix88.orgbosslot168.netdewi168login.com
JIWA4D / Made4D Network1,697
jiwa4d.netmade4d.netgio4d.orgluxury178.org
KOMPAS / LUNAR Network1,487
kompas33.netlunar78.netlunar89.netmentogel.net
BOLA212 / AKBAR Network1,436
bola212.orgbola3388.orgakbar888.comaliran88.com
HONGKONGQQ / ASAHAN Network1,423
hongkongqq.orgasahan69.netbangka69.netbantu188.net
BETDICE / BETHANA Global1,396
betdice.orgbethana.orgcandawin.orgliverpoolbet.net
MURAD3 / VVN111 Network1,335
murad3.comvvn111.comdetik238.netmimi30.net
Confirmed Gambling Domains19,19811 distinct criminal networks
Primary TLDs.org .net .comlegitimacy-signaling TLDs abused
Detection MethodFavicon Hashidentical page templates per network

Exhibit C — NameSilo Profits From Gambling & Adult Domains

NameSilo operates its own parking service — when a registered domain has no active site, NameSilo displays third-party advertisements and collects the revenue. Among 8,684 self-parked domains, 185 carry explicit gambling and adult-content keywords in the domain name itself: porn.organic, sex-password.net, internet-casino.net, mabarslot888.net, and similar. These keywords are trivially detectable via automated term-matching at registration time. The registrar registered, parked, and collected advertising revenue on 144 such domains — directly benefiting from content its own Acceptable Use Policy prohibits.
Domain (NameSilo-parked)Revenue Type
838slot.netNameSilo Parking Ad Revenue
9mmbet.onlineNameSilo Parking Ad Revenue
adultaffiliates.linkNameSilo Parking Ad Revenue
ahhaslot88.netNameSilo Parking Ad Revenue
aiadultgame.netNameSilo Parking Ad Revenue
ampbonanzaslot88.proNameSilo Parking Ad Revenue
badbettie.globalNameSilo Parking Ad Revenue
bestelivecasinos.infoNameSilo Parking Ad Revenue
betfiery.icu / betfiery.info / betfiery.online / betfiery.storeNameSilo Parking Ad Revenue (×4 TLDs)
betgede.site / betgede.top / betgede.xyzNameSilo Parking Ad Revenue (×3 TLDs)
betnflonline.netNameSilo Parking Ad Revenue
betasurveys.netNameSilo Parking Ad Revenue
+ 132 more gambling/adult domainsFull list in evidence_data.json
NameSilo Self-Parked Total8,684NameSilo earns ad revenue on each
Gambling / Adult Among Them144explicit keyword in domain name
Registrar RoleRevenue Sharead revenue collected on 144 gambling/adult domains via own parking platform

Exhibit D — Chinese Adult Content & Piracy Farm Networks

Three distinct Chinese content networks operate thousands of near-identical mirror domains on NameSilo. Each network registers hundreds of redundant domains to survive takedowns — a bulk-registration pattern that should trigger automated abuse detection at any competent registrar. Networks span adult content portals and pirated video streaming platforms.
NetworkTypeDomainsSample IOCs
91JQ  就要激情Chinese adult content platform3,915
91jq157jq.work91jq178jq.work91jqtv.work91jq1jq.work
992kp  快樂看片Chinese pirated video platform3,858
337bj24.xyzqqd8qqd.xyzqqp3qqp.xyz39icao.xyz
nc18  嫩草入口Chinese adult content platform2,798
332t332.xyz332y332.xyz336f336.xyz886u886.xyz
Total Chinese Network Domains10,5713 distinct platforms · all on NameSilo
Primary TLDs.xyz  .workmirrored domain redundancy pattern
Detection MethodFavicon Hashidentical templates across all mirrors

Chain of Custody — Data Integrity

SHA-256 verified evidence chain. All hashes below were computed at collection time. Source zone data was obtained via NameSilo's publicly accessible registrar zone export (IANA #1479), collected June 2026. No systems were compromised or accessed without authorization in the course of this investigation. All scanning was conducted via passive HTTP/TLS probing of publicly reachable domain endpoints. Verify with sha256sum <file> (Linux/macOS) or Get-FileHash <file> -Algorithm SHA256 (PowerShell). Any hash mismatch indicates post-collection modification. Raw registrant contact fields (221,862 emails; 119,819 phones) omitted from all public outputs.
evidence_manifest.json
Master evidence manifest — self-referential integrity anchor. Links all artifacts, timestamps, and methodology notes.
Public · github.com/PhishDestroy/namesilo-scanner
af7f81f859e1f7a3a0a8fa19a4ab92d94c1be7750e6b63e1e46ea0020c0f624b
1479_full.csv
Complete NameSilo zone export — 5,269,357 domains, 9 columns. 348 MB. ↓ Download .gz (54MB) · split into 4 chunks in repo
GitHub: pkg/raw_data/
dd533dfa46077ba6c5bf204cd984f53fd4308f395d293a3e7ac561c596990907
domains_to_scan.jsonl
Input scan queue — 3,397,413 domains with DNS. 499 MB. ↓ Download .gz (40MB) · 6 chunks in repo
GitHub: pkg/raw_data/
70782d6b6312f27533267fc34977a971b90c5ab394e075d76ba25d22bd866f23
garbage_5s.jsonl
Initial scan pass — 911,188 non-dead records. 246 MB. ↓ Download .gz (26MB) · 3 chunks in repo
GitHub: pkg/raw_data/
3f3d36ebc97fb97ef6ac492f66ff8301f80a98a161f28e726850863a8ac76f8e
all_missing_results.jsonl
Rescan of 894K previously unscanned domains. 304 MB. ↓ Download .gz (26MB) · 4 chunks in repo
GitHub: pkg/raw_data/
e8224d3fd4928de67a5ba995a727c11fa28e6cbdb2e5a1cf4a8f78b1387181aa
final_garbage.jsonl
Complete merged scan — all 1,129,114 active records. 468 MB. ↓ Download .gz (46MB) · 6 chunks in repo
GitHub: pkg/raw_data/
b0d6cc1c80b2964593b310029fde4b7f4aeac6c702baaecae78359beab84b0f6
report.html
This investigation report HTML. 0.6 MB.
Public · github.com/PhishDestroy/namesilo-scanner
2e3f06488ba39e8b953d454d31c206f4a478285bd7aed375453bb3973a295839

Internal Data Conflicts — Transparency Note

Transparency: The following minor discrepancies exist between source files. They do not materially affect the primary findings and are documented for full reproducibility.
Consistency CheckSource ASource BDeltaAssessment
CSV row count vs report total5,269,3565,269,357−1negligible
CSV no-IP count vs manifest no-DNS count1,871,9431,871,944−1negligible
Manifest gambling finding vs evidence_data gambling total24,34919,198−5,151investigate
Final report unique scanned vs report_stats scanned2,503,2133,397,413−894,200investigate
report_clean dead vs report_stats dead3,242,6642,255,310+987,354investigate

Full Methodology

Data Collection & Scanning

  • Source: Complete NameSilo registrar zone export (IANA #1479), June 2026. 5,269,356 rows across 9 columns: registrar, url, registered_at, expiring_at, majestic_rank, emails, phones, ip, ip_country.
  • DNS proxy: 3,397,413 domains with IP addresses in the source data were used as the scan queue without additional DNS resolution.
  • HTTP probing: Async HTTP/TLS fingerprinting at 400–600 concurrent connections per node. 5-second connect + read timeout. Full redirect chain followed to final destination.
  • Favicon hashing: MurmurHash3 applied to raw /favicon.ico bytes. Hash collision = shared operator/template. No threshold — single match is sufficient evidence of shared infrastructure.
  • Server fingerprint: SHA-256(Server header || X-Powered-By header || ETag header), truncated to 12 hex chars. Identifies shared server configuration across IP space.

Classification & Privacy

  • Page classification: Heuristic rules on content-length, form count/type, language detection, parking pattern matching, keyword density scoring.
  • Brand phishing: Favicon hash clustering + login-form presence + domain-name pattern analysis. Cluster #04 (hash 1108795842): 3,726 domains, all type "empty" with login form — confirmed phishing infrastructure.
  • Gambling identification: Indonesian/Chinese keyword density in page title + body, combined with absence from Majestic top rankings (unranked = non-legitimate traffic source).
  • PII handling: Raw registrant emails and phone numbers present in source CSV are excluded from all public outputs (221,862 and 119,819 records respectively).
  • Cloudflare detection: Presence of CF-Ray response header. True origin IP unavailable for 429,079 Cloudflare-fronted domains.

Scan Infrastructure

AWS Lambda
Up to 400 concurrent executions
us-east-1 · namesilo-scanner
AWS Lambda auto-scaling expanded concurrency from 10 to 400 parallel executions as SQS queue depth increased.
GCP Cloud Run
20 parallel containers
us-central1 · domain-scanner-job
Stack
Python 3.11
aiohttp + asyncio
5s timeout per domain

For Regulators & Authorities

⚖️

ICANN Compliance

File via ICANN Registrar Compliance portal. Reference IANA #1479, cite 87.3% junk rate and 38,646 confirmed abuse domains. Request audit of domain verification policies and parking revenue conflict-of-interest.
icann.org/compliance ↗

🛡️

Brand Rights Holders

3,726 brand-impersonation phishing domains confirmed via favicon cluster #04 (MurmurHash3: 1108795842). All present login forms. Bulk UDRP filing or registrar abuse report strongly recommended. Contact PhishDestroy for full IOC list.

🔬

Security Researchers

Full evidence package available on request: domain lists per cluster, server fingerprint mapping, scan logs. Data licensed CC-BY 4.0. Cite as: PhishDestroy, "NameSilo IANA #1479 Abuse Intelligence Report", June 2026.
GitHub repository ↗

Scope, Limitations & Disclaimer

Scope & Methodology Limitations

  • Snapshot in time: Zone data collected 2026-06-02 to 2026-06-03 UTC. Domain status and ownership may have changed subsequent to collection.
  • Heuristic classification: Page-type and abuse-category classifications are based on automated heuristics (favicon hash, keyword density, form detection). False-positive rates vary by category; confirmed favicon-cluster findings carry higher confidence than keyword-only classifications.
  • Conservative counts used: All primary findings use the strict confirmed figure (e.g., 19,198 gambling domains by favicon match). Broader heuristic estimates are disclosed separately.
  • No authentication: Active HTTP probing was unauthenticated. Content behind login walls, geo-blocks, or bot-detection is not reflected in this analysis.
  • Cloudflare-fronted domains: True origin infrastructure for 429,079 Cloudflare-fronted domains was not resolvable. Findings for this subset are limited to HTTP-observable content.
  • Legal determination: This report identifies and documents patterns consistent with abuse. Legal determinations of liability, negligence, or intent are the exclusive domain of authorized legal and regulatory bodies.

Distribution & Contact

  • Classification: TLP:CLEAR — this report may be distributed without restriction.
  • Intended audience: ICANN Compliance, FBI Cyber Division, brand-rights holders, academic security researchers, and the general public.
  • Evidence availability: Full domain lists per abuse category (evidence_data.json), SHA-256 verified scan results, and raw methodology are available to authorized law enforcement and regulatory recipients upon request.
  • Independent investigation: Conducted by PhishDestroy, an independent domain security researcher. No financial interest in NameSilo LLC or any competitor registrar. No compensation received for this investigation.
  • Contact for authorities: phishdestroy.eth.limo · GitHub: PhishDestroy/namesilo-scanner
  • ICANN Compliance submission: icann.org/compliance — Reference IANA #1479, cite this report and its SHA-256 manifest hash.