require "http"
require "json"
require "zlib"

ENDPOINT = "https://dnpedia.com/tlds/ajax.php"

DEFAULT_HEADERS = {
  "Accept-Encoding" => "gzip",
  "Referer" => "https://dnpedia.com/tlds/monitor.php",
  "X-Requested-With" => "XMLHttpRequest",
}.freeze

def find_possible_phishing_domains(keyword)
  params = {
    cmd: "search",
    m: "mon",
    columns: "id,name,zoneid,length,idn,thedate,ipv4,ipasname,ipasnumber,ipchecked,",
    ecf: "name",
    ecv: "~%#{keyword}%",
    days: "1",
    mode: "added",
    _search: "false",
    rows: "500",
    page: "1",
    sidx: "length",
    sord: "asc"
  }
  res = HTTP.headers(DEFAULT_HEADERS).get(ENDPOINT, params: params)
  return {} unless res.code == 200

  sio = StringIO.new(res.body)
  gz = Zlib::GzipReader.new(sio)
  page = gz.read

  JSON.parse page
end

p find_possible_phishing_domains("sagawa")