require "http"

require "json"

require "zlib"

​

ENDPOINT = "https://dnpedia.com/tlds/ajax.php"

​

DEFAULT_HEADERS = {

  "Accept-Encoding" => "gzip",

  "Referer" => "https://dnpedia.com/tlds/monitor.php",

  "X-Requested-With" => "XMLHttpRequest",

}.freeze

​

def find_possible_phishing_domains(keyword)

  params = {

    cmd: "search",

    m: "mon",

    columns: "id,name,zoneid,length,idn,thedate,ipv4,ipasname,ipasnumber,ipchecked,",

    ecf: "name",

    ecv: "~%#{keyword}%",

    days: "1",

    mode: "added",

    _search: "false",

    rows: "500",

    page: "1",

    sidx: "length",

    sord: "asc"

  }

  res = HTTP.headers(DEFAULT_HEADERS).get(ENDPOINT, params: params)

  return {} unless res.code == 200

​

  sio = StringIO.new(res.body)

  gz = Zlib::GzipReader.new(sio)

  page = gz.read

​

  JSON.parse page

end

​

p find_possible_phishing_domains("sagawa")