fingerprints: +5 aggressive operators (Key-Systems, Hexonet, GMO, Crazy Domains, Internet.bs)

9109f5738595fd08f85b774c365c7b3d31760f8d · 2026-05-12 16:56:53 -0700 · steve

Coverage now spans US/FR/DE/JP/AU/BS. 19 operators total, 12 flagged
aggressive. Picks up Japanese (Onamae.com), German wholesale (RRPproxy,
Hexonet/1API), Australian (Crazy Domains), and BS anonymity-front
(Internet.bs) snipe destinations that were blind spots in the prior
US/FR/AU-only set.

Files touched

M registrar-fingerprints.json

Diff

commit 9109f5738595fd08f85b774c365c7b3d31760f8d
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 16:56:53 2026 -0700

    fingerprints: +5 aggressive operators (Key-Systems, Hexonet, GMO, Crazy Domains, Internet.bs)
    
    Coverage now spans US/FR/DE/JP/AU/BS. 19 operators total, 12 flagged
    aggressive. Picks up Japanese (Onamae.com), German wholesale (RRPproxy,
    Hexonet/1API), Australian (Crazy Domains), and BS anonymity-front
    (Internet.bs) snipe destinations that were blind spots in the prior
    US/FR/AU-only set.
---
 registrar-fingerprints.json | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/registrar-fingerprints.json b/registrar-fingerprints.json
index 928358d..5e5e76e 100644
--- a/registrar-fingerprints.json
+++ b/registrar-fingerprints.json
@@ -1,6 +1,6 @@
 {
   "_about": "Public-registrar fingerprint database used by honeypot.js check phase to cross-reference WHOIS evidence against known drop-catch / aggregator operators. 'aggressive' flags operators with documented snipe / drop-catch infrastructure. Not exhaustive; expand as new actors surface.",
-  "_updated": "2026-05-12",
+  "_updated": "2026-05-12 (19 operators, 12 aggressive)",
   "_schema": {
     "ianaId": "registrar IANA ID (from WHOIS 'Registrar IANA ID' field)",
     "name": "canonical registrar name",
@@ -107,6 +107,41 @@
       "country": "FR",
       "aggressive": false,
       "notes": "Retail-focused European registrar. Not an aggregator."
+    },
+    "269": {
+      "name": "Key-Systems / RRPproxy",
+      "nsPatterns": ["^ns\\d+\\.rrpproxy\\.net$", "^ns\\d+\\.key-systems\\.net$"],
+      "country": "DE",
+      "aggressive": true,
+      "notes": "Wholesale + drop-catch via RRPproxy. Frequently fronts for European aftermarket buyers; volume drop-catch credentials at .com/.net registries."
+    },
+    "1390": {
+      "name": "Hexonet / 1API",
+      "nsPatterns": ["^ns\\d+\\.hexonet\\.net$", "^ns\\d+\\.ispapi\\.net$"],
+      "country": "DE",
+      "aggressive": true,
+      "notes": "Drop-catch + reseller platform. Volume credentials; common back-end for resellers running automated drop sniping."
+    },
+    "49": {
+      "name": "GMO Internet",
+      "nsPatterns": ["^[a-z]+\\.dnsv\\.jp$", "^ns\\d+\\.gmointernet\\.com$", "^ns\\d+\\.onamae\\.com$"],
+      "country": "JP",
+      "aggressive": true,
+      "notes": "Onamae.com — dominant .JP registrar with aggressive aftermarket. Snipes short stems likely to resell to Japanese market."
+    },
+    "1659": {
+      "name": "Crazy Domains / Dreamscape Networks",
+      "nsPatterns": ["^ns\\d+\\.crazydomains\\.com$", "^ns\\d+\\.syrahost\\.com$"],
+      "country": "AU",
+      "aggressive": true,
+      "notes": "AU-region drop-catch + aftermarket. Aggressive on .com.au and short generic .com."
+    },
+    "2487": {
+      "name": "Internet.bs / Internet Domain Service BS",
+      "nsPatterns": ["^[a-z]+\\.internet\\.bs$", "^dns\\d+\\.internetbs\\.net$"],
+      "country": "BS",
+      "aggressive": true,
+      "notes": "Bahamas-domiciled, anonymity-friendly. Used as a snipe destination when actor wants to obscure attribution; WHOIS often privacy-protected."
     }
   }
 }

← ded6c22 watch-drops: scaffold Step 6 — env-gated, czds-only adapter, · back to Domain Sniper · brand-typo-watcher: per-log breakdown in minute summary f8c440d →