# Indian Financial Domain Audit (bank.in and parallels)

Audit of the `*.bank.in` namespace plus parallel financial TLDs.
Conducted: 2026-06-07.

## TL;DR

- **`bank.in` is the only widely-deployed financial TLD in `.in`**. 1025/1349 subdomains resolve to real bank sites (after CT/archival expansion).
- **`.fin.in` and `.insurance.in` exist as DNS zones but have no real subdomain registrations** in the prefix space we tested.
- **`.nbfc.in` is a single catch-all wildcard** (1/376; not meaningful).
- **`.npci.in` is wildcarded with a "Domain For Sale" parking page** (352/376; not real deployment).
- **The global `.bank` gTLD (fTLD)** is verified and used by ~12 Indian-prefix entities, mostly a mix of unrelated US banks and a handful of Indian deployments (`apgb.bank`, `capital.bank`, `csb.bank`, `sbm.bank`, `yes.bank`).

## Results

| TLD | Live | Probed | Verdict |
|---|---|---|---|
| `bank.in` | 1025 | 1349 | Real RBI bank deployments |
| `.bank` (gTLD) | 12 | 268 | Verified fTLD; mix of US/IN banks |
| `fin.in` | 0 | 376 | Zone exists, no subdomains |
| `insurance.in` | 0 | 376 | Zone exists, parked apex |
| `nbfc.in` | 1 | 376 | Zone exists, single catch-all |
| `npci.in` | 352 | 376 | Wildcard "Domain For Sale" — noise |

## Files

| File | Contents |
|---|---|
| `bank_domains_status.csv` | Master 1349-row `.bank.in` scan (after CT/archival expansion) |
| `bank_tld_domains_status.csv` | Global `.bank` gTLD scan (268 rows) |
| `fin_in_domains_status.csv` | `.fin.in` scan (376 rows; all NXDOMAIN) |
| `insurance_in_domains_status.csv` | `.insurance.in` scan (376 rows; all NXDOMAIN) |
| `nbfc_in_domains_status.csv` | `.nbfc.in` scan (376 rows; 1 catch-all) |
| `npci_in_domains_status.csv` | `.npci.in` scan (376 rows; wildcard parked) |
| `bank_domains_ct_expansion.csv` | 1127 newly-discovered subdomains (Wayback + urlscan + HackerTarget) |
| `new_subdomains.txt` | Plain list of the 1127 new subdomains |
| `scan_subdomains.py` | Probe tool for an arbitrary subdomain list |
| `scan_domains.py` | Single-TLD probe tool (prefix-based) |
| `audit_financial_tlds.py` | Multi-TLD audit driver |
| `scan_global_bank.py` | Global `.bank` gTLD scanner |
| `build_subdomain_list.py` | Dedupes CT/archival sources vs existing CSV |
| `institutions.txt` | Curated list of 188 Indian financial institution prefixes |

## CT / Archival Sources used (crt.sh was down)

| Source | New subdomains found | Coverage |
|---|---|---|
| Wayback Machine CDX | **1034** | Largest free, no-auth source. Subdomains seen in any archived URL. |
| urlscan.io (free, 100-most-recent) | 75 | Top 100 urlscan records for `domain:bank.in`. Free plan; full corpus needs paid plan. |
| HackerTarget `hostsearch` | 44 | 50-row DNS-observed host cap. |
| **Combined deduped** | **1127** | |

crt.sh returned HTTP 502 throughout the audit (their nginx upstream is down). Other CT-log sources tried and rejected: CertSpotter (410), Censys (401, needs key), ZoomEye (region-locked), Sonar/Rapid7 (522), Common Crawl (502), OTX (auth required), threatcrowd (DNS NXDOMAIN).

## Notable `.bank` gTLD collisions (same prefix, different bank)

- `sbi.bank` → Sovereign Bank International (US) — NOT SBI India
- `bob.bank` → Bank of Bahrain and Kuwait — NOT Bank of Baroda
- `american.bank` → American National Bank (US)
- `ccb.bank` → Chickasaw Community Bank (US)
- `prime.bank` → PrimeBank of Texas (US)
- `vcnb.bank` → Vinton County National Bank (US)

Genuinely Indian on `.bank`:
- `apgb.bank` → redirects to `apgb.bank.in` (Andhra Pradesh Grameena Bank)
- `capital.bank` → Capital Small Finance Bank
- `csb.bank` → CSB Bank
- `pgb.bank` → parked
- `sbm.bank` → SBM Bank India
- `yes.bank` → timed out

## Reproducing

```bash
# Pull Wayback subdomains (no auth needed, but slow)
curl -sS --max-time 300 "http://web.archive.org/cdx/search/cdx?url=bank.in&matchType=domain&collapse=urlkey&limit=2000000&output=json&fl=original" \
  | python3 -c 'import sys; [print(l.split("://",1)[1].split("/",1)[0].split(":",1)[0].lower()) for l in sys.stdin if "://" in l and ".bank.in" in l]' \
  | sort -u > /tmp/wayback_hosts.txt

# Build deduped list
python3 build_subdomain_list.py

# Probe them
python3 scan_subdomains.py \
  --in-list new_subdomains.txt \
  --out-csv bank_domains_ct_expansion.csv \
  --concurrency 50
```

DNS via 1.1.1.1, HTTP via stdlib urllib with 8s timeout, 50 concurrent.