Redirect and throwaway domains: what ties them together

What the names are

In NSS-RH-01, 319 throwaway names under 191 registered domains answered from two address blocks on two different networks. On 11 November 2026, 318 of them still resolved.

They open Chinese-language lottery and betting pages. NSS captured 21 sample names: 20 loaded and 15 opened a lottery or betting page. Six of the 15 did not show a page of their own. They forwarded through four steps to one of three landing names that differ by three letters.

NSS saw no sign-in copy of another brand and no file download on these samples. NSS records what the pages are and does not rule on their lawfulness in any country.

Why the addresses are not the answer

When the same names keep resolving to the same addresses, it is tempting to call the addresses one operator's servers. NSS's register did that on 4 November, and RH-01 corrects it. Three records show the blocks are part of a shared delivery network:

• One default certificate. All 16 hosts NSS probed present the same self-signed certificate, valid from 2021 to 2031. A certificate shipped with a product is on every installation of it.
• A moving pool. On 11 November the names also answered from five further blocks: 194 names from two blocks and 109 from three or more.
• Separate sets. The names fall into sets that share no purchase batch, no registered domain and no forwarding label.

So the addresses are not indicators. Blocking them would block whatever else the delivery network carries. The host type decides this: a dedicated host can be a block rule, a shared one cannot.

What does tie them together

Inside each set the links are strong, and they are public records.

• The forwarding label. A delivery service gives a customer set-up one label, and every name placed behind it points at that label. 151 names forward through one label and 33 through a second. 25 new .vip names forward through four labels of another service.
• The registration batch. 13 batches of five or more names from one registrar hold 140 of the 191 registered domains. The tightest put 32 names through one registrar in 6 seconds.
• The name pattern. Within a batch the names differ by a letter or a digit, for example a six-digit number followed by one or two letters.
• The landing. Six sample names, two of them from batches registered in July, forward to the same family of three landing names.

The two labels that carry 184 of the names are 061a016-h002[.]cdncname[.]com and zy7wph[.]cdncname[.]com. Any other name that forwards to either is worth a look.

Recording new names as they appear

219 of the 319 names reached NSS from public lists in October. The other 100 NSS recorded itself between 3 and 11 November, from certificate logs and from the daily lists of newly registered names. None of the 100 is on any list NSS holds.

For the 73 names found in certificate logs, the median time from the log entry to the NSS record was 21 minutes: the shortest 9, the longest 32. That is the time from a public log entry to NSS's record, not a lead over anyone else. And on no list NSS holds means on none of the lists NSS takes in, not on no list anywhere.

The activity was current when the paper went out. Five batches of five .vip names were registered on 7 and 10 November 2026, each through one registrar inside 4 seconds. NSS recorded all 25.

The same idea in other sets

Forwarding labels turn up elsewhere. In the WhatsApp lookalike kit, 41 names forwarded through one relay service, and 33 of their labels pointed on to a single label behind them. The relay's own domain was not an indicator, but the label was useful. See lookalike domains.

What a defender can look for

• Names that forward to the two labels above, or to one of the three landing names in the paper.
• Batches of five random eight-letter .vip names from one registrar inside a few seconds.
• Numeric names that differ only in a trailing letter or two, registered together.
• The paper's indicator list, for policy that restricts gambling sites and for looking back through logs. Nearly every name was live on 11 November 2026.
• Do not block the addresses. They belong to a shared delivery network.