ShortDot SA operates seven generic top-level domains from Luxembourg via CentralNic/Team Internet infrastructure. Seven zones with near-zero legitimate adoption — populated instead by phishing pages, crypto drain panels, carding infrastructure, and 4.4 million phantom domains that serve no purpose except generating registration fee income. ShortDot collects wholesale from all of it. Malicious or not.

The economics expose the intent. ShortDot paid $227,000 per zone application — non-refundable, paid to ICANN. Total entry cost: $1,589,000. That investment recovers only through volume: at $0.65/domain you need 2.4 million domains registered just to break even on application fees. The zones were not designed for legitimate use. They were designed for registration volume. Legitimacy was never a design criterion — it was a liability to be minimized. The zone names confirm this: .bond signals financial trust to phishing victims; .cfd is named after a leveraged financial derivative; .icu targets personal credentials. These names were not chosen for developers. They were chosen because they are credible to fraud targets.

ICANN is not a passive bystander. ICANN collects $0.25 per domain per year from every ShortDot zone — from every .icu phishing page, every .bond credential harvester, every .cfd fake investment platform, and every one of the 4,397,717 phantom domains that serves no function except generating fee income. ICANN also received $1,589,000 in application fees and collects $180,600/year in fixed zone fees. The regulator earns $1.74M annually from zones it is contractually obligated to police. Terminating ShortDot for abuse would cost ICANN $1.74M/year in recurring revenue. This is structural capture, not negligence. ICANN cannot enforce without forfeiting its own revenue stream.

NameBlock is not surprising. NameBlock — a ShortDot venture — sells brand protection services: blocking brand names from being registered in the zones ShortDot controls. JPMorgan Chase pays NameBlock to protect chase.* from being registered as a phishing domain. This is the second profit leg on the same asset. ShortDot collects wholesale when phishers register brand domains. ShortDot collects wholesale again when brands pay to defensively block them. NameBlock collects the service margin on top. The entity that manufactured the threat is paid twice to manage it. The fact that NameBlock was established before these zones reached abuse scale at all indicates this was the plan — not a response to abuse, but preparation for it.

This investigation asks three questions ICANN should have asked before delegating these zones: Who is the natural legitimate user of .icu, .sbs, .cfd, and .cyou? What purpose requires a dedicated TLD that .com or .net cannot serve? And if the answer is "no one with a legitimate business," why is ICANN collecting $1.74M per year from zones that exist to harvest registration revenue from phishing infrastructure — and why has enforcement not followed?