ShortDot Zone Abuse Evidence

What it is

The PhishDestroy investigation repo for ShortDot SA (Luxembourg gTLD registry for .icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon). Beyond the daily IOC/blocklist feeds the summary describes, the page's substance is a specific conflict-of-interest and wash-registration thesis with named individuals, dollar figures, and a documentary trail — detail the summary flattens into "alleged but unverified."

How it works (the alleged scheme)

Two structural claims, each with cited evidence rather than bare assertion:

• Shared control across registry and infrastructure. Michael Riedl is named as Chairman of ShortDot SA and CEO of Team Internet Group plc (LSE: TIG, formerly CentralNic), which provides ShortDot's DNS/EPP/zone infrastructure across ~6.2M domains. The page's sharpest point: Team Internet's 2022–2024 annual reports do disclose ShortDot as a related party (USD 1.3M / 3.2M, restated to 308K / 573K), but describe Riedl's role as "Director and Shareholder," never "Chairman" — which the page argues breaches UK AIM Rule 13's requirement to describe the nature of the relationship.
• Bulk self-registration. NameSilo, ShortDot's largest registrar, charges $1.88/yr for .cfd/.sbs at its 1–49 tier and only reaches Namecheap's $1.39/$1.54 retail price at 5,000+ simultaneous domains. The page argues no retail registrant buys at that scale, so the volume implies the registry/registrar (same ownership network) generating registration events as the product — supported by 70.4% of domains carrying zero DNS records ("meant to be counted, not used").

What to do

• Consume the daily zone files and IOC/blocklists (linked, updated 06:00 UTC) for the seven TLDs; the page reports 51,985 brand-impersonation domains targeting Chase, Binance, MetaMask, Ledger.
• If assessing the governance claim independently, the checkable primary source is Team Internet's 2022–2024 annual reports — verify the related-party title and restated figures directly rather than relying on the repo.
• Cross-reference the companion repo github.com/phishdestroy/namesilo-evidence.

Caveats

• The related-party transactions are genuinely disclosed; what the page alleges is a mischaracterization of Riedl's title, not a hidden relationship — a narrower, more falsifiable claim than "undisclosed conflict."
• The pricing/DNS-record argument is circumstantial inference of intent, not proof of a wash scheme; the page states the pattern, not a confession or filing that names it as such.
• The NameSilo section is written in heavy sarcasm ("massive fans"); tone aside, it makes factual allegations (suppressing researchers, falsely claiming VirusTotal removals) that the page does not substantiate on its own.