Great investigation, especially linking anti-bot.icu and antibot.casa through the shared code comment. That's manual pivoting, and it's exactly how infrastructure-based feeds work at scale: start from a confirmed domain, then match shared registrant, nameserver and MX records to find the siblings. The WhoisFreaks feed docs (whoisfreaks.com/documentation/threat-intelligence…) explain that approach if you want to automate the next one.