Transparency up front: this was done pair-style with an AI agent (Claude). It drove the gateway captures, wrote the script and drafted this write-up. Flagged prominently because you should be suspicious of AI-generated domain lists: that is exactly why every number here comes from an actual packet capture (not from the model's training data), why the sinkhole was verified with
digagainst a real controller, and why this README documents how to reproduce the capture instead of trusting the list.
