Slashdot Mirror
Domains May Disappear After Search
Ponca City, We Love You writes "Daily Domainer has a story alleging that there may be a leak that allows domain tasters to intercept, analyze and register your domain ideas in minutes. 'Every time you do a whois search with any service, you run a risk of losing your domain,' says one industry insider. ICANN's Security and Stability Advisory Committee (SSAC ) has not been able to find hard evidence of Domain Name Front Running but they have issued an advisory (pdf) for people to come forward with hard evidence it is happening. Here is how domain name research theft crimes can occur and some tips to avoiding being a victim."
Though, not on the "in minutes" time scale.
My buddy and I even made up names with random letters in a string of 15 or 20, then some porn words stuck on the end ".com".
Sure enough, two days later some squatter had them.
I think the leak is in the registrars themselves. Imagine the money someone could get from the squatters by simply setting up a script to automatically email these queries somewhere.
"Never a more wretched den of scum and villany" describes the whole domain registration process pretty well I think.
perhaps whois should provide Md5 lookup for a domain instead so people cant snoop at the domain being queried.. so instead of for example whois: somedomain.tld its whois: a79f888f1c2dc50c6b354c0d816f5bf5 simple and effective.
Period.
Much of not most of the spam I'm deflecting nowadays seems to come from 'tasted' domains. Or just made up. I almost don't care about the difference.
The last time I read about this, more than a month ago, one snarky idea was to script a tool to randomly taste domains, constantly. If the registrars are forwarding the requests to squatters, they would go crazy with the surge in requests. The squatters would fritter away resources keeping up with these random searches, and eventually the WHOIS functionality of the registrars would have to change. And the script would change, and so on.
I think domain tasting ought to go away, or cost something. $2 for a 14 day taste would wreck the economics, maybe, certainly if random search scripts got going. My server could probably do 100,000 searches a day. I know it can send out 3-4 million spams a weekend, sadly.
Of course, the registrars could block my IP after a while. And blocks of IPs. So we need a Seti@Home-type script that hammers these things out, and let them block every dialup/dsl/cable/sat block. Hehe.
No, it's not devious enough.
deleting the extra space after periods so i can stay relevant, yeah.
Packets are being sniffed as they traverse thru the tubes. Try this, do a google search for something made up. Try to get a page result of 0. Do this a few times and write down each time you get a 0 result. Come back in a few days and do a google search and you will probably find some custom pages. Is this google tasting?
I'm thinking that I'm not liking the direction this is going...
Sniffing, tasting, hmmm, what comes next, digesting? Excreting?
I am positive this happened to me, and I only used the whois command from the OpenBSD command line to look the domain up. It was not a domain name that I can imagine anyone else wanting, but it was fairly short. Two days later (after checking with my client) I went to register it and it had been taken. I became immediately suspicious. Three days after that, I see this story...
Would it help anyone to know who took the domain? I can't seem to get to the article yet.
There have been articles about it before, and I know for a fact that some registrars reserve a domain as soon as someone uses their site to do an availability/whois search for it. Several days later the reservation is released. During this period only that registrar can be used to register the domain. For the customer, this has both an advantage and a disadvantage.
The obvious disadvantage is that they can't use one registrar to determine that a domain is available and then shop around and use a cheaper registrar to actually buy the domain.
The advantage is that no third party squatter will be able to snipe the domain for themselves - unless of course they use the same registrar.
According to one of the articles linked, the command line is actually a worse alternative. NSLookup requests go through your ISP's domain name server, which logs the NXD (Non-eXistent Domain) responses. Many ISPs augment their revenue by selling this information.
Doing a whois request at a reliable registrar's web-site doesn't go through your ISP's DNS. The larger registrars are probably more trustworthy than your run-of-the-mill ISP. For example, I believe GoDaddy and Network Solutions have stated that they would never provide such information to third parties.
What registrar registers a domain for $2?
The domain wasn't registered when he queried it. But since he didn't buy it right then and there, it WAS registered an hour or so later, by the very site he typed it into.
This has been going on for years, but now the scammers don't even have to rely on roommate stupidity.
The trick is to set up a web site that supplies the list of domains to be searched. That way people could set up a small utility to automatically grab the list and search. This would indicate that lots of people are interested in the domain name. By making the lookups randomize over a week or two and randomizing the time that the search is done, the system would make it much more difficult to filter out.
Now, the squatters COULD start developing a list of IP addresses that are doing lookups, and filtering them out of their results. Of course, this would be all right as it would mean you were protected from someone sneaking in and squatting the name you looked up. Even if the squatters filtered on both IP address AND multiple hits, this could be resolved by allowing real name lookups to be submitted into the random name lookup web site. Then if you wanted to lookup ihatedomainnamesquatters.com, not only you but everyone else that has been looking up random names, will look up ihatedomainnamesquatters.com also. It would be virtually impossible to tell the difference between real interest, and fake.
Plus, if you wanted to both fund the site AND be ironic, you could put advertising on the web page.
The stated reason for allowing retraction of registrations is to allow mistakes to be corrected. But with domains costing just a few dollars to register for a year, how much harm is done by making the customer pay for such mistakes? Answer - none at all. Meanwhile unscrupulous domain tasters are registering, and then returning, millions of domains a day for free.
The DNS marketplace has probably the most widespread corruption of any economy in the world today.
Beat the scammers at their own game. Set up an automated script that does whois lookups for random combinations of words. More or less just flood them with requests and they won't be able to tell which ones are legit lookups. Whoever the douchebag is, will either eventually run out of money, or have to expend more time to improve his algorithm, or just blacklist your ip.
When I have a kid, I want to put him in one of those strollers for twins and then run around the mall looking frantic.
Just to present a counterpoint: a couple of years ago, the opposite happened to me. I registered a domain name based on the name of my character in an online game. It was certainly an unusual name that I had never run into.
A few days later, I got a somewhat angry email from someone wanting to know why I had taken that name, because it was their surname, and they had planned on registering it. Once I explained the situation the guy calmed down and all was well.
But the moral is that it is quite possible that someone, completely innocently, took the domain you were researching, within a day or so you doing it, because that's exactly what happened with my domain. In my case, I just got lucky... 2 days later, the domain would have been gone.
Scenario: you go to your fav registrar, regme.com, and test for bluetulipsandmore.com and it's available. regme.com locks it and sits on it for a few days. They see another query for it on their site 2 days later, probably from you as a followup test. This taste moves bluetulipsandmore.com to a second list they are keeping. They sell this second list to some scum they do business with, including bluetulipsandmore.com and about 8,000 other addresses that have been "tasted" in the last few weeks. The scum looks over the list of interesting unregistered (but reserved) domains, and cherry picks 100 of them to actually register, including your beloved bluetulipsandmore.com. Now you go to register it and poof, it's already registered. You go to that site and find it's been parked and has a convenient link to email gimmebackmydomain@gmail.com where you can purchase the domain after they do a background check on you to find out how much they can squeeze out of you. Instead of registering the link for $7 or so, you fork over $200 for it since you don't have any other choice. regme.com sees a $20 cut of that a month later.
THIS is one of the things they are trying to prevent.
I work for the Department of Redundancy Department.