Lottery redirect names on a shared delivery network: technical analysis

Key findings

1. 319 names under 191 registered domains answered from two address blocks on two different networks. On 11 November 2026, 318 of them still resolved.
2. The pages are lottery and betting sites. Of 21 sample names NSS captured, 15 opened a Chinese-language lottery or betting page; six of those forwarded on to one family of three landing names.
3. NSS recorded 100 of the names itself between 3 and 11 November, from certificate logs and new registrations. None of the 100 is on any list NSS holds. For the 73 found in certificate logs, the median time from the log entry to the NSS record was 21 minutes.
4. The names were bought in batches. 13 batches of five or more hold 140 of the 191 registered domains; the tightest put 32 names through one registrar in 6 seconds.
5. The two blocks are not one operator's servers. Every probed host presents the same default certificate of a delivery product, the names now answer from five further blocks as well, and the names fall into separate sets that share no batch, no registered domain and no forwarding label.
6. What ties names together is the label in front of them. 151 names forward through one delivery label and 33 through a second; 25 new .vip names forward through four labels of another service.
7. The activity is current. Five batches of five .vip names were registered on 7 and 10 November 2026, and NSS recorded all 25.

Timeline

1. 31 Jan 2026, 03:08 UTC
   Earliest batch in the set: 15 names of sixteen random characters registered in 2 seconds.
2. 11 Jul 2026
   Two batches of numeric names through one registrar, 6 and 29 names, under an hour apart. NSS later finds a name from each forwarding to the landing family.
3. 27 Jul 2026, 05:22 UTC
   The tightest batch: 32 names in 6 seconds.
4. 19 and 31 Oct 2026
   219 of the names reach NSS from public lists.
5. 3 Nov, 09:26 UTC
   NSS records the first name that is on no list, from a certificate log.
6. 4 Nov
   NSS probes the hosts and files the two blocks in its register as operator clusters. This paper corrects that reading.
7. 3 to 7 Nov
   73 names recorded from certificate logs, each within 9 to 32 minutes of its log entry.
8. 7 and 10 Nov
   Five batches of five .vip names are registered. NSS records all 25.
9. 11 Nov, 12:04 UTC
   Fresh check: 318 of 319 names resolve. NSS captures 21 sample sites.

The NSS tools used

• > Discovery

  Recorded 100 names from certificate logs and new registrations between 3 and 11 November, 73 of them within 9 to 32 minutes of the certificate log entry.

• > Register

  Flagged the two blocks on 4 November because the same names resolved to both. Its first reading, operator clusters on dedicated hosts, is corrected by this paper.

• > Probe

  Read the open services and the certificate on 16 hosts in the two blocks. Every one presented the same default certificate.

• > Investigate

  Read the public registration record of all 191 registered domains and found the purchase batches.

• > Capture

  Loaded 21 sample sites as a phone and as a desktop and recorded each forwarding step and the page at the end.

• > Watch

  Re-checked where all 319 names resolve on 11 November, which showed the forwarding labels and the five further blocks.

Indicators

The first 25 of 319 indicators. Each is written defanged so it cannot be opened by accident. TLP:CLEAR. Use them in your own tools; no account needed.

How we know

What this rests on

• Where each name resolves and what it forwards to is from one check of every name on 11 November 2026 between 12:04 and 12:06 UTC.
• Registration times and registrars are public registration records, read on 11 November 2026. A batch is five or more names from one registrar, each within 30 seconds of the one before.
• The time from certificate log to NSS record compares the log's own timestamp with the time NSS stored the name, for the 73 names found that way.
• Page descriptions are from NSS captures of 21 sample names on 11 November 2026. The other 298 names were not captured for this paper.

What we cannot say

• NSS did not see who runs the sites, how visitors are sent to them, or whether anyone lost money.
• "On no list NSS holds" is not "on no list anywhere". NSS checked the lists it takes in, not every list that exists.
• The sets of names may or may not be the same people. They share a delivery network and a kind of page, and nothing else NSS could measure.
• Addresses are not in the indicator list. They are shared delivery-network addresses that serve other, unrelated sites.
• This paper is not attributed to any named group, and it does not rule on whether the sites are lawful where they are used.

Use and citation

This paper is marked TLP:CLEAR: it may be shared without restriction. Cite as:

Nexus Sentinel Station (NSS), "Lottery redirect names on a shared delivery network: technical analysis", NSS-RH-01, 11 Nov 2026. https://nsshq.com/research/redirect-host-clusters