Forum Moderators: buckworks & webwork

Message Too Old, No Replies

The "Are They Really Monitoring Your Domain Queries" Challenge

Can It Be Proven Beyond a Reasonable Doubt That Domain Sniffing Happens?

         

subgenius

7:28 pm on Nov 2, 2006 (gmt 0)

10+ Year Member



One of my clients e-mailed me earlier this week about registering a domain name. I checked on the domain and it was available, so I e-mailed the client back. Today, my client finally sent me the approval to register the domain, but when I checked today, it had been registered by a domain name reseller. The domain name is too obscure for this to be a coincidence, so I want to know:

1. Do domain registrars release search information to domain resellers?

1B. If so, are there any registrars that don't do this?

2. Is it possible for domain resellers to track requests made by a certain company? How do they do this?

3. Is this legal? I know the answer is probably yes, but that's not what I want to hear.

Any answers to the above, or recommendations on the best way to relieve stress in this situation would be much appreciated. Thanks.

trader

3:30 pm on Nov 6, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



As I said before, some domainers and even a forum moderator Woz are convinced this is happening but I am 98% positive it's not an issue.

In all likelihood people think this way as a result of merely a coincidence, or even more likely heavy domain tasting going on every day.

Another example is so many registering Hurricane Katrina names at the same time is an example of how some may think the registrar was responsible for someone else getting the name they wanted.

For those who refer to very odd or brandable (non popular keyword) names the answer may be someone else knew about the plan to get the name (possibly the webmasters clients or friends) and they mentioned the domain to someone else who grabbed it (even an owner related inside job). Domain tasting could also be responsible for nonsensical names too using randomly generated character computer lists.

IMO, experienced domainers with good size portfolios who also frequent domain forums would be included in those who do not think it happens, whereas webmaster, marketing and programmer people would tend to be on the side of believing it's an issue.

unperturbed

5:39 pm on Nov 6, 2006 (gmt 0)

10+ Year Member



Thoes who talk about doing the whois on domains that they think could only mean something to them or a domain which is made up and then find a few days latter it's taken. Has it happened that you've thought of a simular domain, one which is made up or you think only means something to you, check the whois and found it's take already? It's likely it has. With 6billion people on the planet there is bound to be an overlap of ideas. The timing is just a coincidence

subgenius

2:29 pm on Nov 8, 2006 (gmt 0)

10+ Year Member



The domain I was originally trying to register was released a few days after it had been grabbed, so thanks to davezan and others for your advice on how to handle the situation.

moltar

3:46 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Exactly! subgenius has a point! The names get dropped a few days later. This is impossible to do for an Average Joe. As far as I know you must be a big registar to allow refunds/drops like that. I've never seen this happen in my entire Internet career. Names pop-up and dissapear.

Btw, here is my thread about the same thing: [webmasterworld.com...]

jtara

3:46 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



The domain I was originally trying to register was released a few days after it had been grabbed,

That just gives credence to the theory.

You can look at it two ways:

1. Evil registrar reg's domains that are whois'd, so as to resell to prospective registrant at a higher price.

2. Evil registrar tastes domains that are whois'd, and keeps them if they taste good.

The latter is more subtle, and therefore more evil. ;)

In either case, I would expect some pre-screening process. So, I don't think that using nonsense domains for the test proves anything one way or the other.

moltar

3:50 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It's def the 2nd one. They see if there is any type-in or link traffic and if there is, they keep it and put ads on it. Sort of like Sedo.

Webwork

4:04 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



What sticks out like a sore thumb to me in all the chatter is that I threw down the challenge:

Make up a test list, send it to me in advance, query the availability of the list,
and report back on the activity of the domain query sniffing thieves.

Notice the lack of reports confirming the allegations? To paraphrase "The reports of WhoIs sniffing are greatly exaggerated".

Feel free to dope-slap me by sending me a domain test list and then run the list through any registrar to "bait the sniffers". I'd be more than happy to witness this in action so we can get down to a discussion of where, how and how often it is happening and exactly what the proof is.

And to make things perfectly clear I am NOT saying this has never happened. I'm just saying that it now appears that the rumors far exceed the practice . . but I'd love to be proven wrong . . because that would make for a helluva dialogue, wouldn't it? ;)

[edited by: Webwork at 4:07 pm (utc) on Nov. 8, 2006]

kwngian

4:54 pm on Nov 8, 2006 (gmt 0)

10+ Year Member



Well the 'evil registrar' do register the domain with the intention of selling it higher price too besides just tasting.

I recall reading somewhere that they were asking for US$250 for selling the name to one interested party whom they manage to snatch the name from.

textex

6:08 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It definately does go on.
We were checking domains for a client and decided that we were going to use their personal name. Mind you, the name is very unique with the liklihood of anyone having the same name slim let alone registering the domain the same time we are.

Two days later, the domain was registered by a reseller. They wanted $500 for it.

TomWaits

6:09 pm on Nov 8, 2006 (gmt 0)

10+ Year Member



This absolutely happens. Queries are sold. I've been hit before on quite obscure queries.

Now, if it's available, I buy it right then and there.

[edited by: TomWaits at 6:09 pm (utc) on Nov. 8, 2006]

Webwork

6:13 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Psssst . . . "Take the challenge".

If this is as widespread as the rumors then lets get down to testing it, proving it and follow with discussion what to do about it . . beyond just saying "register it now". "Register it" is good advice but if there is compelling proof that "sniffing your queries" is an ongoing issue then let's make the case and take on the culprits.

Take the challenge. Help prove the rumor is more than prevalent coincidence, the outcome of hundreds of thousands of domains being tasted every day, millions of domains being tasted every week.

[edited by: Webwork at 6:23 pm (utc) on Nov. 8, 2006]

Chris_R

6:18 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



>Take the challenge

Uhh seems to me like this should be easy to do.
I will take the challenge.
Sending webwork the info.

Webwork

6:28 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



If any of you are going to take the challenge then I suggest a) made up lists (nonsense or near nonsense or pattern domains); b) different lists for different registrars; c) as many registrars as you care to test.

Ultimately, I don't need any established member's lists. Newcomers who might be axe grinders or game players might be viewed dimly IF it's only a/a-few noobs who manage to "prove" the issue is true, whilst all the established members confirm ". . it ain't so, Joe".

Still, the proof is in the pudding. The more players the better. This isn't about proving anyone right, wrong or the fool. This is about actually generating proof - one way or the other - and then IF the proof is positive - taking the conversation to the next level: What to do about it? Engage ICANN? Reach out to the FTC? Contact the attorney general or equivalent? ALL IF and ONLY IFF there is proof of something is seriously amiss, like active mass targeting - not random overlap - of domain registration queries.

Line up the ducks and smoke the so-and-sos out.

Prove a) it's currently happening; and, b) who might be implicated.

[edited by: Webwork at 6:33 pm (utc) on Nov. 8, 2006]

swa66

6:32 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I've seen something like it happen to me. I registered a .org domain where I had the .com for long time already. I saw the .net .tv. .cc .info etc. being unregistered as well, but didn't want to bother with them all. The next day I decided I wanted the .net of it anyway and went to register it. Surprise: all the other previously unregistered domain were not available. Whois had no data who had registered it. One week later they all were available again (and I then registered the .net). AFAIK only registrars can register a domain for a few days.

This was at netsol.

Webwork

6:37 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Seeing a follow-on registration, such as a .net or .org registration following a .com registration, does not surprise me. It's been age old advice to consider registering all versions of one's domain name. There are many explanations for follow-on registrations.

C'mon folks. Before you post another "me too" TAKE THE TEST TODAY or tomorrow OR the next day.

And then report back and let's talk about it.

Please.

Thank-you.

Webwork / Domain Forum Moderator and Town Crier Take the challenge! Take the challenge!

httpwebwitch

6:39 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



here's a suggestion:
post all the domains you want to buy at WebmasterWorld, with a note: "hey - leave these ones alone, ok guys?"
Most of the people who want to taste your domains are here watching and they will leave yours alone if you ask really nice

stormy

7:11 pm on Nov 8, 2006 (gmt 0)

10+ Year Member



I have had this happen to quite a few customers. You don't need shady registrars logging queries - apparently all registrars are capable of sniffing queries to the global Whois, no matter which site is doing them.

Domains get usually snatched by registrars that don't even offer a public interface for registering domains. Traffic (and possibly Whois queries) are measured - if the domain is a lemon, they drop it before 5 days and ICANN refunds their money.

ronburk

7:14 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I would expect a daily and deafening roar of complaints coming from all quarters

Agreed -- if the mechanism were automated. If it's a coterie of people doing it manually, then it would presumably look more erratic and infrequent; one might need domain names that another human agrees could be profitable.

jimbeetle

7:21 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I'm in for a 100. I'll get back to you in a couple of days with the results.

wackybrit

7:34 pm on Nov 8, 2006 (gmt 0)

10+ Year Member



The safest way to do these domain searches is by using your linux shell whois command (there are probably similar tools on other os platforms).

Not entirely. WHOIS does two checks usually, one with Internic, and then one with the registrar itself. The registrar can still monitor these queries.

The safest way I know of to check if a domain is registered, but not get all its information, is to use [internic.net...]

Webwork

7:36 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Alrighty, the stickies are starting to dribble in.

The challenge is being met! The conspiracy will be outed!

Or not. ;)

jomaxx

8:54 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I am NOT saying this has never happened. I'm just saying that it now appears that the rumors far exceed the practice

I'd throw the challenge at you and ask you to document those rumors that claim that every domain, even nonsense strings of letters, will be scooped up from under your nose. I'm not convinced they exist.

All I've ever heard is that it can technically happen and that it has happened (both of which you acknowledge), and that there's a possibility that a cool domain name you uncover could get snapped up if you don't grab it promptly.

It would be interesting if someone documented it happening, but no string of negatives will be able to prove it can't happen with some registrars, or under some circumstances.

tigertom

9:02 pm on Nov 8, 2006 (gmt 0)

10+ Year Member



I shan't take the challenge. I imagine domain registrars have software in place to filter 'rubbish', like 200 automated queries from the same IP.

Now,

- A query from a common HTTP_USER agent,
- With a unique IP,
- That accepts a cookie,
- Made _more than once_ over the same 24 hour period,
- Of, say, > 20 seconds user session

-> Looks like a sucker! Grab that domain!

- Then drop it if there's no traffic,or no payout from the sucker within 5 days.

Easy money.

That _nonsense_ domains are reg'ed and then dropped again in the same short period of time is proof enough for me.

Easy_Coder

9:47 pm on Nov 8, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I've had this exact same thing happen to me with melbourneit once and that was the last time I used them.

Woz

12:17 am on Nov 9, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



>Notice the lack of reports confirming the allegations?
Um, these tests take time WW, patience.

And of course, one of the main challenges will be that "Absence of Evidence doesn't imply Evidence of Absence." IE., even if we don't find any hard proof that it is going on, that lack of proof does not mean it isn't going on, just that we weren't able to find the proof.

The other challenge is that perhaps the purps have gotten wind of our clever little outing scheme, and have backed off for a while. OK, not probable, perhaps even straw-clutching, but certainly possible.

I've been testing a baited list for a few days, no bites as yet, but we will see.

Reegardless, with the number of domain speculators/parkers out there, I am of the opinion that there must be some underhand operations going on simply because the number of "coincidences" is far too high.

Plugging the "tasting" leak by removing the 5 (3?) day grage period, or at least limiting the number of "graces" a particular registrar is allowed per day/week/month would certainly cut down the incidence somewhat, but not remove it completely. I had a case a few years back (pre grace periods) where a domain I queried but didn't register was snatched overnight and offered to me at greatly inflated prices. I declined, patiently waited a full twelve months and finally grabbed the domain when it was dropped for lack of traffic/interest.

It is going on, of that I am convinced. Proving it however is another matter.

BTW, this is not the opinion of "Woz the Mod", rather, just the opinion of plain ol' Woz - nothing more, nothing less. ;)

Onya
Woz

adamnichols45

12:19 am on Nov 9, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



today I did a search for a .com domain was not taken - this evening I went back to register the domain and
BAM it was taken!

I have never had this before and was quite angry!

stu2

1:16 am on Nov 9, 2006 (gmt 0)

10+ Year Member



Exactly! subgenius has a point! The names get dropped a few days later. This is impossible to do for an Average Joe.

I think this is proof positive that whois lookups are being monitored. Of course the doubters will say it's just a coincidence. I'm not buying the coincidence theory.

vincevincevince

1:18 am on Nov 9, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I've tested just two domain names... doing more would almost certainly be ignored.

stu2

1:21 am on Nov 9, 2006 (gmt 0)

10+ Year Member



today I did a search for a .com domain was not taken - this evening I went back to register the domain and BAM it was taken!

Where did you do the search and what was the domain name?

caran1

1:24 am on Nov 9, 2006 (gmt 0)

10+ Year Member



I think they are monitoring the domain queries, from personal experience, the domain I searched for was taken soon. Now I do whois searches only from my own reseller a/c.
This 132 message thread spans 5 pages: 132