@1aboveio/skills 0.0.0-stage → 1.0.1

package/skills/risk-compliance/report-writing/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/risk-compliance/similar-domain/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -0,0 +1,203 @@
+---
+name: similar-domain
+description: >
+  Explicit-only. The domains, mirrors, and operating entities related to one
+  or more seed domains: platform-tenancy test, operator-level fingerprints
+  (analytics, tenant and payment account IDs, support-email domains,
+  templates, DNS, mail, certificates, registration), reverse pivots, scored
+  links, an entity chain, and a watchlist for the operator's next domains.
+  Not transaction data (tld-detection) or fraud rules (fraud-analysis).
+disable-model-invocation: true
+release-version: 0.38.0
+---
+**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
+# Similar Domain
+
+Start from a seed domain and find every other domain that the same people run.
+A cluster is defined by **shared operator-level fingerprints**: accounts,
+code, and registrations that one operator controls. Shared branding,
+shared industry, and infrastructure that a CDN or hosted platform hands to
+all its customers do not define one. Corporate records (operator, licence,
+affiliate program) confirm and name the cluster; they do not create it on
+their own.
+
+The method is a loop: read fingerprints off a domain, ask "who else has this?"
+for each fingerprint, score what comes back, and feed every new domain back
+into the loop.
+
+**Produce:** a scored cluster with an evidence matrix, the entity chain behind
+it, and a ≤3-sentence verdict, under `reports/similar-domain/`.
+**Do not produce:** an ownership claim with no corporate evidence, a cluster
+built from one weak signal, or a list of every site on the same CDN or
+hosted platform.
+
+Paths under `references/` are relative to this skill.
+
+## Workflow
+
+Follow these steps in order. Detail:
+[references/workflow.md](references/workflow.md).
+
+| Step | Do | Gate |
+|---|---|---|
+| 0 Pre-flight | Seeds, question, jurisdiction, access limits | Stop if there is no resolvable domain; note geo-blocks and challenge pages |
+| 1 Fingerprint | Decide platform tenancy; record every non-brand identifier on each domain; check split delivery when the site is reached through ads | Every fingerprint has a source and a timestamp; local resolver artefacts are flagged; each fingerprint is tagged operator-level or platform-level |
+| 2 Pivot | Reverse-search each fingerprint for other domains | Each pivot is logged with source class and hit count; high-noise pivots are filtered by a second fingerprint |
+| 3 Expand names | Enumerate mirror and numbering variants of every brand found | Candidates are only kept if they share a fingerprint from step 1 |
+| 4 Entity | Operator, company record and officers, licence, address, affiliate program, terms page | Each entity fact cites a page; conflicting operator names are kept, not resolved by guess; registered-agent addresses are noise |
+| 5 Score | Weight every link; label each domain | Labels follow the rules in scoring.md; platform-level signals never lift a label above Possible, however many there are |
+| 6 Loop | Send every new Confirmed or Probable domain back to step 1 | Every pass has rows in the pivot log; stop when a full pass adds no new domain, or report the cluster open |
+| 7 Report | Verdict, cluster table, evidence matrix, entity chain, outliers, watchlist, pivot log | ≤3-sentence verdict; no ownership wording without an entity citation; watchlist names the fingerprints that will catch the next domain |
+
+### 0 — Pre-flight
+
+Record the seed domains, what the user actually wants to know (same
+operator? mirrors? merchant background?), and any jurisdiction or time limits.
+Note what you cannot see: geo-blocks, bot challenges, private WHOIS. A blocked
+site still yields a block page, DNS, certificates, and history, so blocking is
+a finding, not a dead end. Grain and limits:
+[workflow.md](references/workflow.md).
+
+### 1 — Fingerprint
+
+[references/fingerprints.md](references/fingerprints.md). First decide
+whether the domain is a tenant on a hosted platform (storefront builder,
+website builder, white-label casino or broker platform). On a tenant, the
+hosting address, template, asset hosts, certificate, and bundled registrar
+come from the platform and link every customer it has; only the
+operator's own accounts inside the platform identify the operator.
+
+Then collect everything about the domain that is not the brand name:
+registration facts, DNS and mail records, certificate history, analytics
+and pixel IDs, tenant and payment account IDs, the block-page or
+error-page template, support-address domain, hard-coded partner hosts,
+and naming scheme. Record each with where it came from and tag it
+operator-level or platform-level. When the site is reached through ads or
+short links, request it as several visitors and compare; a hidden page is
+a new seed. Fingerprint the seed fully before pivoting; a half-collected
+profile makes later pivots look independent when they are not.
+
+### 2 — Pivot
+
+[references/pivots.md](references/pivots.md). For each fingerprint, query the
+source class that can answer "who else has this": page-source indexes for
+analytics IDs and templates, passive DNS for nameservers and mail records,
+certificate transparency for subdomains and naming schemes, reverse WHOIS for
+registration batches. Ordinary web search does not index page source; do not
+treat an empty web-search result as a negative. Filter noisy pivots
+(shared CDN nameservers, common mail includes) by requiring a second
+fingerprint before a hit becomes a candidate.
+
+### 3 — Expand names
+
+Brands that rotate mirrors follow a scheme: numbered suffixes, hyphenated
+digits, double-dash prefixes, country TLDs. Enumerate the scheme for every
+brand found and keep only the variants that share a step-1 fingerprint.
+A name match alone is a candidate, never a member.
+
+### 4 — Entity
+
+[references/entities.md](references/entities.md). Once a brand name exists,
+collect the legal entity, its company-register record and officers, any
+licence number, address, and affiliate program from the site's own terms
+page, the company register, regulator enforcement notices, and review
+aggregators, then reverse each of
+those: officers appear on other companies, licence registers list every
+domain under one licence, affiliate programs list every brand they pay
+for, entity names appear in other sites' terms pages. Registered-agent and
+company-secretary addresses are shared by hundreds of companies; they link
+nothing. Keep conflicting operator names side by side with dates; operators
+migrate and the conflict is often the history.
+
+### 5 — Score
+
+[references/scoring.md](references/scoring.md). Weight each link by how hard
+it is to share by accident. One analytics account or one custom template is
+very strong; one registrar or one CDN nameserver pair is medium. Two signals
+from the same vendor account count once. On platform tenants, a shared IP,
+theme, and bundled registrar are one platform-level signal, not three.
+Label each domain Confirmed, Probable, Possible, or Unrelated, and keep the
+reasoning visible in the evidence matrix.
+
+### 6 — Loop
+
+Every Confirmed or Probable domain becomes a new seed and goes through steps 1
+to 5. Possible domains are parked with the fingerprint that would promote them.
+New fingerprints found on new members (a new support-email domain, a new
+company, a new account ID) get pivoted in the same pass. Stop when a
+complete pass finds nothing new, or when the user's question is answered
+and further expansion would only add mirrors; otherwise the cluster is
+open and the report lists the unrun pivots.
+
+### 7 — Report
+
+[references/report-template.md](references/report-template.md). Terms:
+[references/terminology.md](references/terminology.md).
+
+```text
+reports/similar-domain/<seed>_cluster.md
+```
+
+Lead with the verdict, then the cluster table sorted Confirmed → Probable →
+Possible, the evidence matrix (domain × fingerprint), the entity chain with
+dates, outliers that were checked and rejected, the watchlist of
+fingerprints that will catch the operator's next domain, coverage caveats,
+and the pivot log. Grep banned strings after writing.
+
+## Progress
+
+Track a task plan. One item is `in_progress` at a time.
+
+1. Pass pre-flight
+2. Decide platform tenancy and fingerprint every seed
+3. Run and log pivots
+4. Expand naming schemes
+5. Collect entity chain
+6. Score and label
+7. Loop until no new domain
+8. Write report with watchlist and proofread
+
+## Boundary
+
+| Need | Skill |
+|---|---|
+| Related domains, mirrors, sister sites, who runs a website, merchant-site background | `similar-domain` |
+| Anything inside a transaction file: upstream streams behind a descriptor, wallet currency, preset menus, frozen-rate batches, retail constants, currency-amount ladders | `tld-detection` (`scripts/detect_streams.py`, then the ladder run) |
+| Supervised fraud labels, holdout precision/recall, rule packages | `fraud-analysis` |
+| Volume, journey, auth rate, decline mix | `payment-analysis` |
+
+A domain cluster from this skill can feed a merchant-risk decision; it is not
+itself a fraud finding. When the user also has authorization data for the
+merchant, hand that part to `tld-detection`: this skill stops at the websites,
+mirrors and operators.
+
+## Reference index
+
+| Need | Read |
+|---|---|
+| Inputs, limits, order that must not move | [workflow.md](references/workflow.md) |
+| Platform tenancy test, what to collect per domain and why it identifies an operator, split-delivery check | [fingerprints.md](references/fingerprints.md) |
+| Which source class answers each "who else" question, and the traps | [pivots.md](references/pivots.md) |
+| Operator, company register and officers, licence, affiliate, terms-page pivots | [entities.md](references/entities.md) |
+| Link weights, independence, labels, registration batches, shared IDs on many brands, indirect links, worked example | [scoring.md](references/scoring.md) |
+| Report chapters | [report-template.md](references/report-template.md) |
+| Language and banned strings | [terminology.md](references/terminology.md) |
+
+## Sanity check
+
+- [ ] Seeds, question, and access limits are stated; blocked sites are still fingerprinted
+- [ ] Platform tenancy is decided for every hosting address, and the test is in the pivot log
+- [ ] Every fingerprint has a source and a timestamp; local resolver artefacts are excluded
+- [ ] No label above Possible rests on platform-level signals (shared platform IP, theme, asset host, bundled registrar)
+- [ ] Ad-reached sites were requested as several visitors; the identities tried are listed
+- [ ] Every pivot is logged with source class, query, and hit count, including empty ones
+- [ ] Noisy pivots (CDN nameservers, common mail includes) never add a domain on their own
+- [ ] Name-scheme candidates are kept only when they share a fingerprint
+- [ ] Entity facts cite the page they came from; conflicting operator names are dated, not merged
+- [ ] Every shared address counted as a link was searched first and is not a secretary or registered-agent address
+- [ ] Two signals from one vendor account are counted once
+- [ ] Every cluster member has a label and the matrix shows why
+- [ ] Loop ran until a full pass added nothing, or the stop reason is stated; every pass has pivot-log rows
+- [ ] Watchlist lists each durable operator-level fingerprint and where to watch it
+- [ ] Verdict is ≤3 sentences; no "owned by" without an entity citation
+- [ ] Outliers checked and rejected are listed with the reason

package/skills/risk-compliance/similar-domain/references/entities.md

@@ -0,0 +1,67 @@
+# Entities
+
+Step 4 names and dates the cluster. It runs after at least one brand name
+is known and after the technical links exist; it explains the cluster, it
+does not replace the evidence.
+
+## What to collect per brand
+
+| Fact | Where it usually is |
+|---|---|
+| Legal operator name and company number | Site footer, terms and conditions, "about" page, review aggregators |
+| Company record: incorporation date, officers, secretary or registered agent | Company register of the stated jurisdiction |
+| Licence authority and number (regulated sites only) | Footer seal, validator link, regulator register |
+| Regulator enforcement notices and blocked-site lists | Regulators of the markets the site serves; they often name the operator for the exact domain, including mirrors |
+| Registered address | Terms page, company register, regulator register |
+| Launch year and relaunches | Review aggregators, archives, certificate history |
+| Affiliate program | Footer "Affiliates" link, affiliate directories |
+| Platform vendor | Footer, script hosts, review sites |
+| Previous operators | Older reviews, forum threads, archive snapshots |
+| Complaint patterns | Review aggregators, complaint forums |
+
+Record each fact with its page and the date the page was written or
+captured. Review aggregators disagree with each other because operators
+migrate; keep every version with its date rather than picking one.
+
+## Entity pivots
+
+| Have | Reverse into | Yields |
+|---|---|---|
+| Operator name | Aggregator "owner" pages, licence register, web search of terms-page text | Brand list under that operator |
+| Licence number | Regulator register | Every licensed domain, including ones with no technical link yet |
+| Affiliate program | Affiliate directories and forums | Brands marketed together |
+| Address | Web search, company register | Other entities at the address. Before counting a shared address, search it and log how many unrelated companies use it; a secretary or registered-agent address links nothing |
+| Domain or brand name | Regulator enforcement notices and blocked-site lists | The operator named for that exact domain, dated |
+| Officers | Company register | Other companies the same people run; nominee directors are noise |
+| Platform vendor | Vendor's client list, review sites | Vendor-level neighbours; filter, do not add |
+| Previous operator | Same as operator name | The migration path (for example Curaçao entity → transitional entity → Anjouan entity) |
+
+## Migration patterns worth expecting
+
+Offshore operators reorganise often. Common shapes:
+
+- **Entity swap, same platform** — the brand keeps its template and
+  tokens; only the footer entity and licence change. Technical evidence
+  stays continuous; corporate evidence shows a break.
+- **Brand acquisition** — an old, once-reputable domain is bought and
+  relaunched on a new operator's platform. Registration date is old;
+  everything else matches the new cluster. Weight the technical evidence.
+- **Mirror farms** — numbered or hyphenated domains registered in batches,
+  each redirecting or serving the parent brand. They inherit every
+  fingerprint and are usually Confirmed on the first pass.
+- **Platform tenants** — several unrelated operators on one hosted
+  platform (white-label casino, storefront builder, website builder)
+  share its address, theme, and often its registrar, but not
+  operator-level fingerprints. This is the main source of false clusters;
+  the tenancy test is in [fingerprints.md](fingerprints.md).
+- **Shell rotation** — one operator puts each batch of sites under a new
+  company, often formed through the same secretary. The company names
+  differ; the operator-level fingerprints and the officers do not.
+
+## Adding a domain from entity evidence alone
+
+Allowed only when the source is authoritative for domain membership: a
+regulator's licence register, or the operator's own terms page listing its
+domains. Label such domains Probable until a technical fingerprint
+confirms them. Aggregator sister-site lists are hypotheses to test, not
+grounds for membership.

package/skills/risk-compliance/similar-domain/references/fingerprints.md

@@ -0,0 +1,134 @@
+# Fingerprints
+
+What to record for each domain, and why each item identifies the people
+behind it rather than the industry it sits in. Record the value, the source
+you read it from, and the time. Categories are ordered by how much they
+usually pay off. The examples cover several kinds of site (online shops,
+casinos, brokers, content sites); use the rows that fit the seed.
+
+## Platform tenancy (decide first)
+
+Many sites are tenants on a hosted platform: a storefront or website
+builder, a white-label casino or broker platform, a blog host, or a
+vendor that builds and hosts sites for many clients behind a CDN. The
+platform serves every customer from the same addresses, with the same
+theme skeleton, asset hosts, cookies, and often a bundled registrar. Those
+values link the platform's customers, not one operator.
+
+Test every hosting address before scoring anything on it:
+
+| Test | Tenant if |
+|---|---|
+| Request the address with a made-up host name | It answers with a branded "store not found" or platform page instead of a connection error or a bare default page |
+| Reverse-IP or passive-DNS neighbour count | Many names in unrelated niches or unrelated brands share it |
+| Page source and cookies | Platform asset hosts, platform session cookies, and URL routes that recur unchanged on the platform's other stores |
+| CNAME or nameserver target | Points at the platform's own hostname |
+| Registrar | The platform's domain-reseller registrar, the same for most of its customers; judge this from stores outside the suspect set, not from the suspect's IP neighbours |
+| Account IDs on sites outside the suspect set | Other sites of the same vendor or hosting carry the same analytics or tag ID, so the vendor inserts it |
+
+If the domain is a tenant, tag these as **platform-level**: hosting
+address and ASN, theme and template skeleton, platform asset hosts and
+cookies, the platform's certificates, and the bundled registrar. Then
+look for **operator-level** values inside the platform: the tenant or
+store ID, payment account IDs, analytics and pixel IDs, a support-email
+domain the operator registered, custom code, and uploaded asset hashes.
+Record the tenancy test and its result in the pivot log.
+
+## Page and tag fingerprints (strongest)
+
+These live inside the served HTML. They are set once by whoever configures
+the site and copied across every site that person manages.
+
+| Fingerprint | Why it identifies an operator |
+|---|---|
+| Analytics tokens (Cloudflare Web Analytics, Google Analytics / GTM container, Matomo, Yandex) | One account per operator; sharing it across brands is deliberate |
+| Ad and tracking pixels (Meta, TikTok, Snap, affiliate-network pixels) | Tied to a paying advertiser account |
+| Error-monitoring and session-replay keys (Sentry, Hotjar, Clarity, Smartlook) | Per-project keys from one engineering team |
+| Tenant, store, or seller ID inside a hosted platform (in page config, API calls, upload paths) | One platform account; operator-level even when everything around it is platform-level |
+| Payment account IDs: payment-processor publishable keys, wallet or PayPal merchant and client IDs, a checkout endpoint carrying an account | The account that receives the money; operators change domains far more often than payment accounts |
+| Support-email domain the operator registered (`service@<company-domain>`, not `support@<brand>`) | A domain bought for the business; several brands pointing at it are one operator |
+| Block-page or error-page template: HTML skeleton, CSS reset, odd literal values (a specific outline colour, a min-width), font stack | A shared codebase; brands change the logo and palette, not the skeleton |
+| Support-address pattern (`support@<brand>`) and the domain it points at | A mirror's support address names the parent brand |
+| Hard-coded partner hosts: CDN paths, API hosts, game or payment providers, chat widgets | Platform vendor and integration account |
+| Favicon and logo asset hashes | Reused assets across mirrors |
+| JavaScript bundle names and hashes | Same build pipeline |
+| Cookie names and consent-banner vendor IDs | Same front-end stack |
+
+Distinguish **operator-level** identifiers (analytics account, custom
+template, tenant ID, payment account) from **vendor-level** ones (a game
+provider, a chat widget, a hosted platform's theme). Vendor-level
+identifiers narrow the field but are shared across many unrelated
+operators. On a platform tenant, the template row is vendor-level unless
+it carries custom literals the platform's other customers lack.
+
+## Mail fingerprints (strong)
+
+| Fingerprint | Why |
+|---|---|
+| Exact SPF string, including the order of includes | The combination of mail vendors is chosen per operator; a byte-identical string across brands is rarely coincidence |
+| DKIM selectors | Per-sending-account |
+| MX target (Google, Microsoft 365, Zoho, self-hosted) | Splits clusters: an operator rarely runs two mail platforms |
+| Verification TXT records (Microsoft tenant ID, vendor verifications) | Tenant IDs identify one organisation; Google site-verification tokens are per-domain and do not pivot |
+| Mail-related subdomains from certificates (`mailer.`, `click.`, `email.updates.`) | Marketing-mail vendor and its account |
+
+## Registration fingerprints (medium to strong)
+
+| Fingerprint | Why |
+|---|---|
+| Registrar plus privacy-proxy service | Operators keep one registrar account per portfolio |
+| Creation and last-updated timestamps | Same-hour timestamps across domains mean one batch action |
+| Status-lock set (the exact combination of prohibited flags) | Set by registrar account defaults |
+| Registrant fields when not private (organisation, country, state) | Direct |
+| Expiry alignment | Renewed together |
+
+## DNS and hosting fingerprints (medium)
+
+| Fingerprint | Why |
+|---|---|
+| Nameserver pair | CDN providers assign pairs per account, but reuse pairs across many accounts; strong only combined with something else |
+| Hosting address and ASN when not behind a CDN | Direct only for a dedicated origin; shared hosting is common and a platform ingress links every tenant |
+| CNAME targets for `www`, `api`, `cdn`, `m` | Names the platform vendor and sometimes the tenant |
+| Subdomain naming from certificate transparency | Platform-specific patterns (`api.`, `cl.`, `evolutiongaming.`) and mirror schemes (`dd20--brand`) |
+| Wildcard certificate issuer and issuance cadence | Same automation |
+
+## Brand and naming fingerprints (candidate generators, not evidence)
+
+| Fingerprint | Use |
+|---|---|
+| Name stem and numbering scheme (`brand3`, `brand-9884`, `xx00--brand`) | Enumerate variants in step 3 |
+| Licence seal number and validator link (regulated sites: gambling, brokers, payments) | Pivot into the licence register in step 4 |
+| Legal entity, company number, address, and licence text on the terms page | Entity pivot in step 4 |
+| Affiliate program name | Brand-list pivot in step 4 |
+| Platform named in the footer or source (sportsbook platform, storefront builder) | Vendor-level filter |
+
+## Behaviour fingerprints (supporting)
+
+| Fingerprint | Use |
+|---|---|
+| Geo-block behaviour: which countries, what status code, challenge or branded page | Same edge configuration |
+| Redirect chain (`www` to apex, mirror to parent, country path) | Reveals the parent brand |
+| Response headers beyond the CDN defaults | Same origin stack |
+
+## Split-delivery check (sites reached through ads or short links)
+
+Cloaking shows reviewers and crawlers one page and real visitors another.
+The hidden page is often on another domain, and that domain is a new
+seed. Request the landing URL and one deeper page (product or checkout)
+as several visitors, strip session tokens and timestamps, and compare:
+
+| Vary | Values to try |
+|---|---|
+| Device | Desktop browser, mobile browser |
+| Crawler | Search crawler, ad-platform or social crawler, empty user agent |
+| Arrival | No referrer, search referrer, social referrer, an ad-click parameter (`gclid`, `fbclid`, `ttclid`) on the URL |
+| Location | The analyst's location and the target market, when an exit there is available |
+
+Record the identities tried. "No split observed" covers only those
+identities; untried ones go in coverage caveats.
+
+## Recording rule
+
+Every fingerprint row carries: domain, category, value, level
+(operator or platform), source (page, DNS, certificate log, WHOIS,
+archive, company register, review site), and observed-at time.
+A fingerprint without a source cannot be re-checked and cannot be scored.

package/skills/risk-compliance/similar-domain/references/pivots.md

@@ -0,0 +1,82 @@
+# Pivots
+
+A pivot turns a fingerprint into the question "which other domains have
+this value?" and sends it to a source class that can answer. This file
+says which source class fits which fingerprint, what a hit means, and where
+the false positives come from. It does not prescribe tools or commands.
+
+## Source classes
+
+| Source class | Answers | Examples of the class |
+|---|---|---|
+| Page-source index | Which pages contain this string (token, CSS literal, hostname) | Code-search engines for HTML, URL scanners with body search, internet-scan datasets with HTTP bodies |
+| Passive DNS | Which domains have or had this nameserver, MX, TXT, CNAME, or address | Commercial passive-DNS services, historical DNS archives |
+| Certificate transparency | Which names appear on certificates, and when | Public CT log search |
+| Reverse WHOIS | Which domains share registrant fields, registrar, or timestamps | Reverse-WHOIS services, registrar-side history |
+| Web archive | What the site served before it was blocked or rebranded | Public web archives, cached copies |
+| Review aggregators | Operator, licence, launch year, affiliate program, complaints | Casino / merchant review directories, complaint forums |
+| Licence register | Every domain licensed under one number or entity | Regulator's public register |
+| Regulator enforcement record | The operator named for a domain the regulator acted on | Warnings, blocked-site lists, enforcement notices |
+| Company register | Incorporation date, officers, secretary or registered agent, other companies of the same officers | National or state company registries and their mirrors |
+| Affiliate directory | Every brand an affiliate program pays for | Affiliate-program brand lists, affiliate forums |
+| Ordinary web search | Brand reviews, news, forum threads | General search — note it does not index page source |
+
+## Fingerprint to pivot map
+
+| Fingerprint | Pivot to | Hit means | Trap |
+|---|---|---|---|
+| Analytics or pixel token | Page-source index | Same account configured both sites | A token can be scraped and pasted by an affiliate site; check the hit is the brand's own domain, not a review page |
+| Block-page template literal | Page-source index | Same codebase | Framework defaults produce the same reset; pick a literal that is not in any public template |
+| Support-address pattern | Page-source index, web search | Mirror names its parent | None significant |
+| Support-email domain the operator registered | Page-source index, web search; then fingerprint that domain itself (registration, MX, site) | Brands run from one mailbox domain | A webmail or platform-issued domain links nothing |
+| Tenant, store, or seller ID | Page-source index | Same platform account | Confirm the value is per-tenant: it must differ across the platform's unrelated stores |
+| Payment account ID | Page-source index, archives | Same receiving account | Platform-wide keys (one key for every tenant) are vendor-level; confirm a different tenant shows a different value |
+| Exact SPF string | Passive DNS | Same mail-vendor set | Single common includes (a lone Google or Microsoft include) match millions of domains; pivot on the full string |
+| Microsoft tenant or vendor verification TXT | Passive DNS | Same organisation tenant | Google site-verification tokens are per domain; they do not pivot |
+| Nameserver pair | Passive DNS | Same CDN account, probably | CDN pairs are reused across accounts; always require a second fingerprint |
+| Hosting address / ASN | Passive DNS, internet-scan dataset | Same origin, only if the address is dedicated | Shared hosting; CDN fronting hides the origin; a platform ingress returns every tenant of the platform, so run the tenancy test first |
+| CNAME target | Passive DNS | Same platform tenant | Vendor-level unless the target embeds a tenant name |
+| Subdomain naming scheme | Certificate transparency | Same platform or mirror generator | Scheme may belong to the platform vendor, shared by its unrelated tenants |
+| Registrar + proxy + timestamp | Reverse WHOIS | Same registration batch | Popular registrar-proxy combinations are common; timestamps within minutes are the real signal |
+| Brand name stem | Certificate transparency, web search | Candidate mirror | A name match is a candidate only; confirm with a fingerprint |
+| Licence number | Licence register | Every domain under the licence | Registers lag; a delisted domain is history, not a false link |
+| Legal entity or address | Web search, page-source index (terms pages), company register | Same operator on paper | Corporate-service and registered-agent addresses are shared by hundreds of unrelated companies |
+| Company officers (directors, shareholders when public) | Company register | Other companies the same people run, then their sites | Nominee directors serve many unrelated companies |
+| Affiliate program | Affiliate directory | Same marketing arm | Some programs serve several operators |
+
+## Running a pivot
+
+1. State the fingerprint, the source class, and the exact query.
+2. Record the hit count, even if zero. Zero from a source that cannot see
+   the fingerprint (web search for a token) is "not observable", not
+   "absent".
+3. For each hit, note which fingerprint produced it. A domain reached by
+   two independent pivots is already close to Confirmed.
+4. Filter high-noise pivots (nameserver pair, registrar, single mail
+   include) by intersecting with the set of hits from a strong pivot before
+   any of them becomes a candidate.
+5. Prefer pivots whose hit count is small. A pivot returning thousands of
+   domains is not evidence until narrowed.
+6. Tag each log row with its loop pass. A pass that added members but has
+   no rows pivoting their new fingerprints is not finished.
+7. When a source is blocked (bot challenge, login, timeout), try another
+   source of the same class before logging the pivot "not observable",
+   and log each source tried.
+8. When an authoritative page (regulator notice, register entry) can be
+   read only through a search snippet, an archive copy, or a third-party
+   quote, cite it as such. It can name the entity in the entity chain,
+   but it does not count as an authoritative listing for scoring until
+   the page itself is read.
+
+## Blocked-site pivots
+
+When the live site is unreachable:
+
+- Pivot on the block page itself (template, token, support address).
+- Use certificate history for subdomains and mirror schemes.
+- Use web archives for the pre-block or pre-rebrand HTML, which usually
+  still carries the same tokens.
+- Use mirrors that are reachable from the analyst's location; they share
+  the parent's fingerprints by design.
+- Use review aggregators for the entity chain; they visited the site from
+  an allowed location.