ICANN Investigates Insider Domain Name Snatching 152
Tech.Luver sends us word that, hot on the heels of reports that Verisign may be planning to sell DNS root server lookup data, ICANN has opened an investigation into a suspected practice by registrars it calls "domain name front running." The suspicion is that insiders at some registrars are using information from whois searches to snatch up desirable domain names before interested customers can register them. Here is ICANN's announcement of the investigation (PDF). ICANN asks that anyone who suspects they have been victimized by domain name front running to email them with details.
Some proof (Score:5, Informative)
One of our customers (who allowed me to mention in this post that his domain in question was psysci.net) that had this happen said that he only used the command line whois and networksolutions.com to lookup the domain, so it might not just be small registrars involved in this scam. But that's a pretty serious accusation to bring against Network Solutions so take that with a grain of salt. THe company that tasted psysci.net had a name of Wan-Fu China, Ltd. The company that tasted the other domain had a name of (MAISON TROPICALE S.A.), which you can find a little more information about here [domainstatute.com]
Use DNS to look up domains. (Score:3, Informative)
Re:Use DNS to look up domains. (Score:4, Informative)
host -t NS domain.com
instead? If it says NXDOMAIN (no such domain), the domain does not exist.
Well of course I can do that but now even that is in danger of being snooped [slashdot.org]. But I can't expect a customer to do that every time, but they deserve better treatment than to have their domain snatched before they can even buy it. I think once this whole Verisign thing gets resolved, I'll setup a domain checker on our website so that they have someplace more trustworthy to check.
Re: (Score:2)
"I'll setup a domain checker on our website so that they have someplace more trustworthy to check."
Re: (Score:2)
Re: (Score:2)
That rule should be scrapped. If you want a domain, you pay for it up front. If you make a mistake, tough luck - you're out $10 - big deal.
Re: (Score:2)
I don't think network solutions is doing the snatching, I merely think they're
Re: (Score:2)
Re:Some proof (Score:4, Funny)
- find an available name
- post it on slashdot
- check a month later to see if it's taken.
There are enough ass-tunnels out there (like me) who'd pay $8.95 just to screw up your experiment!Re: (Score:2)
Re: (Score:2)
% whois ass-tunnels.com
Whois Server Version 2.0
Domain names in the
with many different competing registrars. Go to http://www.internic.net/ [internic.net]
for detailed information.
No match for "ASS-TUNNELS.COM".
Whois Server Version 2.0
Domain names in the
with many different competing registrars. Go to http://www.internic.net/ [internic.net]
for detail
Re: (Score:3, Funny)
Thank you for that brilliant word. Ass-tunnel. Now I will forever associate you with Goatse (which I think is a visual representation of such).
Re: (Score:2)
Re: (Score:2)
And even if they consider that and somehow stop it (it's fairly obvious), commonsense tells us that some enterprising cretin will have figured out another sneaky way around it in no time.
Re: (Score:2)
Re: (Score:2)
1) Call the phone number - ask what domains they have registered. If they can't tell you (because the list is way too longer) then F-em.
This won't happen. It assumes that there is (or should be) someone at the end of that phone line who will automatically know which domains are registered. What if it's a small company? What if a clueless secretary answers the phone?
The solution is to force everyone who registers a domain to have someone who knows what's going on always answer that phone number. But if an individual registered the domain, what if (e.g.) their girl/boyfriend answers the mobile phone and doesn't have a clue? If it's a moder
Re: (Score:2)
Re: (Score:2)
Dear icann please increase the domain reg cost and eliminate the free trial period.
Re: (Score:2)
Not the Point (Score:5, Insightful)
If the owner gets their network back, they still have the stigma of the bad activity associated with the domain.
Preventing domain theft is going to only get increasingly more difficult as technology becomes more complicated.
*That's* Not the Point (Score:2)
This isn't about snatching domain names from previous owners. It's about improper use of search records from the whois databases, using this information to automatically grab new, currently unregistered domains when other people check the domain names' registration status.
Re: (Score:2)
I suppose there is a chance that Google might find the junk site, determined it was crap, and send it down to the bottom of the heap during the 5 day trial period.
Re: (Score:2, Interesting)
I used to be a Quake addict, ad my ISP offered "unlimited internet access" and he wasn't kidding. They gave free web hosting with internet service, so I proceeded to start the "Springfield Fragfest" [sj-r.com] (note that the link is NOT to the Springfield Fragfest, it is to an article in Springfield's local paper that succinctly illustrates the fact that the real Springfield, which has an alderman named Gail S
I believe it happened to me.... (Score:3, Interesting)
I only wish I could remember the domain name. I might have it in my notes but I have pages and pages of notes.
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Just in case
Re: (Score:2)
Re: (Score:2)
Okay, I'll retract my big fat turd comment. But, the sausage finger one still holds.
How to buy a domain in this day and age (Score:4, Informative)
1. DO NOT go to xyz.com. If it is being squatted then the squatters now have a hit on it, they have one more reason to keep it if they're just testing out the ICANN 5 day snatch and release policy.
2. Go to a registrar site and do a search on xyz.com
3. If no one owns it, buy it NOW. The first hour after your search could very well be the only time it is ever available ever again. There is a very high probability of this. If you do not buy it right away, by the time you come back it will be gone. A squatter will have bought the site to abuse the ICANN 5 day policy. If it gets enough hits, they will keep it, if not, they will release it and by the act of releasing some other squatter will probably pick it up. This will keep on repeating itself until you pay enough money for some just as evil company to grab it and sell it to you.
There's your guide to buying a domain name in three obnoxious steps.
Re: (Score:2)
Couldn't one start "poisioning" the hit database? (Score:3, Interesting)
--
This space for rent
Re:Couldn't one start "poisioning" the hit databas (Score:2)
Re: (Score:2)
#!/usr/bin/perl
use strict;
use Net::DNS::Packet;
use Net::DNS::RR;
my @silly_list = ('sex','linux','monkey','pants','lucky','duck','cow',
'chicken','clown','w2k3','fart','junk','monk','towel','hyper','viper',
'amp','station','depot','diape
Re: (Score:2)
Replace the static @silly_list with this...
my @silly_list = get_dictionary('/usr/share/dict/linux.words');
Make sure to alter the line "my $dom_length = int(rand($count)/4)+2;" and make it "my $dom_length = 5"; or something suitable, otherwise you'll end up with domain names that are impossibly long.
The get_dictionary function looks like this:
sub get_dictionary
{
my ($dist_file) = @_;
open(FP,"< $dist_file") or die "Unable to open
Re: (Score:2)
Re:Couldn't one start "poisioning" the hit databas (Score:3, Insightful)
Human eyeballs could pull the top 1000, do a quick spot check on the list, remove garbage names, and register the rest. Once setup, it'd take about 10-15 minutes of human intervention a day.
Re: (Score:2)
The results could still be filtered by dictionary/eye but you at least devalue # of hits in their decision making process. Seems like a pretty important variable to take out of their equation.
Re: (Score:2)
Re: (Score:2)
This time, I searched for a new domain, found it available, and bought it outright. If I hadn't read this story, I probably would've delayed my purchase and lost on another domain name.
Re: (Score:2)
TFA mentions that some of the smaller registrars are logging searches put through their sites and engaging in the snatching racket directly through third party shell companies which are owned by or connected to the registrar. The registrar is trying to get a higher fee by having their shill sell the domain back to you for a higher price than the initial registration would otherwise have cost. Depending upon how automated the scam is the domain could be snapped up within minutes or
Re: (Score:2)
An HOUR?
Say people are doing this and note it's the registrats of which there are hundreds from big ones (Network Solutions, godaddy, etc) and small ones. Serious domain name colllectors become registrars just to get domains wholesale. The abuse tends to be in the hands of the smaller registrars, modulo some crooked characters at larger registrars which HAS happened in the pas
Re: (Score:2)
Why would you see if a domain is available unless you want to register it?
If you DON'T want to register it, why do you care if someone else "snatches" it?
That being said, the 5-day free period should be eliminated, immediately.
wow (Score:3, Funny)
I am so very glad that ICANN has quickly come forth at the first signs of such a horrible problem, to think that the registrars would abuse their positions like this.
I think we all can rest since ICANN is going to fix this before it even becomes a problem.
oh wait ...
Re: (Score:2)
Keep in mind you have to send ICANN $70K to become a registrar.
So ICANN has great incentive to keep them on the up and up.
Oh wait...
Dear ICANN: (Score:3, Funny)
Oh, wait, we're talking about a different kind of front running? It means what again?
See what I mean ICANN? I can't even keep track anymore. I thought I was tech savvy, but if I blink, these crazy kids are using words I don't even understand.
Wait... ICANN is the wrong organization to complain to about this?
I give up.
uh, educate yourself, then speak (Score:2)
Re: (Score:2, Interesting)
Actually, its trawling,/i>, but nice try
Wikipedia says you're wrong [wikipedia.org]
On the other hand, [wikipedia.org]
I've never used whois for this exact reason (Score:3, Informative)
Being a little paranoid allways helps.
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:3, Insightful)
Of course it does. Any IP communications which uses a name rather than an IP number is using some type of name resolution. Since the real question posed by this situation is "has this domain name been registered", you can't answer it without consulting with the domain name resolution system. And that is either a WHOIS query at a registrar or a name resolution check through a DNS, either incidental (ping my.foobar.foobaz.org) or intentional (dig my.foobar.foobaz.org).
And I have doubts about using DNS to veri
Re: (Score:2)
Um, you are aware not all registered domains have working websites (or even "should be working but isn't at the moment" websites) right? Some only exist to publish MX records, ie they're used only for mail.
Some probabilistic inference (Score:2, Interesting)
tksmowlapoxnvbwlqanmiutklweh.com
laskjdfghlfkajgneruykvjniour.com
qwieurylkajbaiurylkjasndfgpu.com
If several of those are snatched up after a whois lookup, it's clearly not because anyone else actually bought the domain name because they wanted to use it.
Re:Some probabilistic inference (Score:5, Funny)
The first one is obviously used by The King of Siam's Major Order of Worried Lemurs Acting Perfectly or Xylophone Needing Vampires Being Wheedled Like Queens of Another Nice Monarchy In Utah's Tasteless Kingdom, Looking at Everyone's Hiney
The other two are equally obvious
Re: (Score:2)
Give him the rest of the day off before he goes postal on v or n.
Re: (Score:2)
...but there is not enough space in the margin of the post to include them.
Re: (Score:2)
I'm kind of sensitive to this stuff right now. (Score:4, Informative)
They were even loading images, like I do, from my ISP's webspace. For a while I had changed the image to a big "WARNING!", but they noticed that yesterday and removed all links and images from their copy. A DMCA takedown won't work since they're in the U.K. and from what I've read of the hosting service, ethics aren't exactly their strong suit. So I've got to just learn from experience here. Oy.
I can sympathize (Score:2, Insightful)
ICANN needs to put registrars out of speculation (Score:5, Informative)
One of the provisions of the ICANN Registrar Agreement is this: [icann.org]
So ICANN has the authority to insist that registrars get out of the domain speculation business. They don't have to ask the registrars; they can simply order it.
Currently, most of the "registrars" [icann.org] are fronts for domain speculators. Take a look at the list. There are whole families of phony registrars (Enom1, Inc., Enom2, Inc., Enom3, Inc., ... Enom371, Inc., ... Enom469, Inc.) There are ones who admit they're domain speculators (NameJumper.com, Inc., "!!BBB Bulk Inc"). There are ones that are fronts for "Club Drop".
Most of these "registrars" are so phony they don't even have a business address.
This registrar information is useful for filtering junk sites. If a site is registered with one of the bogus registrars, it's probably desirable to block its e-mail (which is probably spam), and throw it out of search engines.
Re:ICANN needs to put registrars out of speculatio (Score:2)
This is too easy for the registrars to get around. The unscrupulous registrars could develop their own secret network of shell companies, shills, and spammers to register hits from searches on the registrar's site and then split the profits when the registrar buys the domain back from their network of proxies to sell back to the customer. It wou
Re:ICANN needs to put registrars out of speculatio (Score:2)
Re: (Score:2)
You've never been to one, have you?
I'd rather see a crackdown on typos... (Score:4, Interesting)
And from my experiences, it seems like the typo squatters usually bombard you with pop-ups and other annoying crapola on their sites when you accidentally wander into them. The front-runners at least seem kind enough to just tell you "this domain could be yours for only $1M". Bastardly, sure, but less of an annoyance than 4 pop-ups that trigger more pop-ups on being closed.
a good idea (Score:2, Insightful)
Oops, too late, already taken...
direct lookup (Score:2)
Re: (Score:2)
I say SPAM the domain Spammers (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Then trick them into thinking the domains are "real". Expand the dictionary-DNS script to keep track of the fake domains it queried and retry them occasionally - if they get registered, then add them to another list and start actively querying the webpages to generate "hits" for them.
For optimum performance, publish both lists (both queried and subsequently registered domains) somewhere onl
ICANN should forbid registrars from owning domains (Score:2)
dave
Re:ICANN should forbid registrars from owning doma (Score:2)
Re: (Score:2)
The domain name for my-bogus-registry.com would have to be registered first -with someone else-, before you could set up www.my-bogus-registry.com. So the specific bootstrap problem you mention should not occur.
dave
Wouldn't surprise me (Score:2)
Re: (Score:2)
already happens (rumours) (Score:2)
Re: (Score:2)
That was before the free trial period. (Why THE HECK would that be useful to ANYBODY except a scammer of some kind?)
True, it could be an employee of them doing it.
Either way this is NOT NEW.
Now days with all the wild card DNS BS some companies are doing, I
Re: (Score:2)
Oh, sweet irony (Score:2)
I actually need to register a domain at this very moment and right now netsols website just plain flat out doesn't work. It's been this way from about 9:30 - 10:30 est.
Oy.
Re: (Score:2)
I'm sorta impressed there's poeple at NSI fixing this stuff at midnight. I've never seen other registrars fix stuff at night especially without even filing a trouble ticket.
Who needs front running... (Score:2)
http://www.mentallyretired.com/2007/09/17/fraud-in-the-domain-name-market/ [mentallyretired.com]
I wanted a domain name after it expires in half a year and they're ALREADY MAKING ME BID FOR IT. Keep in mind, this is the REGISTRAR, not the current domain owner.
I think this happened to me, but with a twist.. (Score:4, Interesting)
So I checked via godaddy.com, and it was available, but I didn't purchase it because my checking account was overdrawn. A while later(2 weeks to a month), I went to buy it, and it was taken. Whois said it was taken shortly after my availability check, by a company in Maine. It was cash-parked at Network Solutions.
Anyway, a few months later(the dates are vague, I didn't mark my calender) I checked it to see what the people from Maine were doing with the title of my life's work. It was still just cash-parked at Network Solutions. So I checked WHOIS again, to refresh my memory about the name of the company, and it was now owned by an individual in Maryland instead of a company in Maine, but here's the scariest part: the registration date had *magically* moved backwards to 2005!
I had personal reasons to remember very specifically that the location of the owner was in Maine. I didn't remember the company name, but I definitely remembered that the date of registration was just after I had checked it.
And it's still just cash-parked. When it first happened, because of "Maine" and some personal events, I suspected a certain person I knew from certain forums had taken it for basically spiteful reasons. But when the date was altered, I was mystified and paranoid. "Why would the CIA and time-traveling lizard-people from Sirius conspire to keep me from doing my little project under that name?" Now, I'm relieved to find a more plausible explanation. A scammer or scammers with access to official registration data. Makes sense, I also own several other domains, so I might pop up as a high-probability purchaser. But I never contacted the owner, and in the intervening time I've reworked things to release soon under another name that I've owned for years.
I did, however, pop off an email to ICANN detailing the events.
Let me reiterate what's been said by others on this thread: don't check a domain unless you're ready to purchase it immediately.
Re: (Score:2)
I was going to buy "MadScientistsMedia.com"
Ended up going to a Radio Station a few weeks later, now it's some guy doing music.
As research for a company a few years back, I searched through about 500 names. Because I was using two-word combinations, I found a lot that were not taken -- about half.
The company was not interested in the names -- but a couple weeks later I checked and about half of the ones I found free were taken. URLs like www.startpoint.com -- which I thought was very good, bec
GoDaddy's doing it (Score:2)
http://guruevi.com/ [guruevi.com]
http://pcman.com/ [pcman.com]
my last name
Google it first (Score:2)
Yikes (Score:2)
You will gain money by a speculation or lottery
Well, someone is, at least....
Domain Name Front Running (Score:2)
ICANN has opened an investigation into a suspected practice by registrars it calls "domain name front running."
I prefer "squatspecting" myself, as it is the cybersquatting upon others' domain prospecting, possibly to ransom the domain to the person who intended to register it.
.com domain I wanted, but it is currently held by a law firm with named partners sharing the same initials, and they could easily hold onto it indefinitely even if there's a change in partnership to maintain communication with former clients of the old firm. When I finally decided to get the .tv version which had been free, it too
There was a
No news here.. (Score:2)
After that I just go and register domain in 1 transaction - using registration form as whois/dns lookup and then immediately check out.
From 2003 I registered 4 domains and this rule worked pretty well.
Also I have one story when one not so expensive registrar just snatched domain from
Dog Bites Registrant (Score:2)
It definitely happens but it's in small enough quantity that I think it's being done with targeted compromises of servers involved with domain lookups at hosting services and the like. Either that or someone is selling the lookup data.
Took Them Long Enough (Score:2)
whois bomb em. (Score:2)
that would solve the problem
Re: (Score:3, Interesting)
What infuriated me was that some sleazeballs had registered
Well, DNS itself is a dumb 20th century idea (Score:2, Insightful)
That is, why do we have this superelaborate expensive annoying structure, the only purpose of which is to translate one string (the hostname) into another (the IP address)? Sure, a nice 32 bit number (0x4a7d1368) is easier for programs to work with than a variable-length alphanumeric string ("www.l.google.com").
But so what? The only legitimate purpose of technology is to make our lives easier, not to serve as a temple in which we practice the complicated correct forms o
Re: (Score:2)
Slashdot is a site that receives international visitors. How would you propose we label Slashdot in your scheme?
Likewise, if I talk about the Starbucks in Burlington, I know what I mean, but without some context you'll have no way of figuring out what I'm talking about.
A quick Google search comes up with Starbucks in Burlingtons in Vermont, Ontario, North Carolina, Washington, and Massachusetts. Which one do I mean when I say "the Starbucks in Burlington?"
Well, I mean the Starbucks in Burlington, Mass
Borington, Ontario (Score:2)
Well, I mean the Starbucks in Burlington, Massachusetts. But here's the thing: there are two Starbucks in Burlington, Massachusetts. (More if you count Starbucks served inside of other stores.) Which one do I mean? Well, for this example, I mean the one on Mall Road. "
The starbucks in Burlington Ontario is a drive thru
Re: (Score:2)
If you combined Layers 3 and 2 together, then it would be responsible for naming and routing. When you entered a name, the part of the system that takes in the name also has to know how to route it. If you change the routing protocol, you also have to completely redo your naming protocol. Right now, the naming protocol just discovers a place, and lets a specialist figure o
Re: (Score:2)
Until I read through it, I thought that you were going to propose that we just use numerical IP adresses. That's the /. solution. It has the virtue of keeping the riff-raff from clogging the pipes.
Re: (Score:2)
That's not a very good technical objection. Almost any network-aware operating system can assign multiple "virtual" IP addresses to a single physical interface. If you change your network stack over to the "IP Name" scheme, it'd be no real difference.
I'm not saying that direct name->machine mappings would be a good idea, only that it's technically feasible.
I certainly wouldn't want to write the routing algorithms for non-hierarchical variable-length addressing schemes.
Re: (Score:2)
You were defrauded. You should have just waited until the 30-day redemption period was over and you could have just registered it with any other registrar. How do you think I got trolltalk.com?
http://www.cyberindian.com/domain-registration/article.php?article_id=185 [cyberindian.com]
There's no such thing as "a waiting list". Ask for your money back.
Re: (Score:2)
I've seen names that should have been deleted and wern't. These are called "mistakes".
If you have an adequate paper trail you can talk to ICANN's hear lawyer and get them to reverse this. They HAVE to follow the rules.
I got NSI to do this in the pre-icann era. I sent in a template to reg a domain and somebody else got it with a later timestamp. I pointed this out and they told the other guy "sorry, we screwed up" and I got my (clients) domain.
This was before