What they did
Prof. Šarūnas Grigaliūnas, who heads the Cyber Security Centre of Excellence at Kaunas University of Technology, describes Nelegalus, a public register of illegal websites run with Lithuania's Ministry of Culture. Its first full-time worker is a Grok Bot named NEdirbantis1. Around 10:00 and 18:00 Vilnius time it opens a fresh sample of Lithuanian sites, looking for pirate film and sport streams, illegal IPTV, pirated books and games, counterfeit shops, fake investment offers and casinos, plus sites on the Bank of Lithuania's list of illegal financial providers that are still up. It uses an ordinary volunteer account, checks the register and its own log first so it never files a domain twice, submits only findings with evidence and a short description, and mails its supervisor a run report. That supervisor is a second agent, the admin bot NElegalus, which reviews the queue daily, flags duplicates, prepares cases for human reviewers and sends the worker feedback.
How it went
A typical run covers 25 to 45 sites, and most turn out to be licensed or already listed. At the time of writing the register held 3,079 confirmed domains, though the post does not say how many came from the agent. In one run the worker reported several real news portals because they carried paid crypto mining adverts. The admin agent advised rejecting those, since the register lists whole domains, and gave a new rule: report the scam platform and use the article as evidence. The worker added that rule, and stricter ones, the same day. No domain is confirmed by either agent; every report goes to people.
Worth knowing
The account comes from the project's own lead, promoting the project. Admin and reviewer logins use multi-factor auth, so when the admin agent's session expires it stops, says it is blocked and waits for a person to sign in. The author says judgement, not detection, is the hard part, which is why the final call stays human.