Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

ICANN Investigates Insider Domain Name Snatching

Posted by kdawson on Thu Oct 25, 2007 10:12 AM
from the suspected-not-proven dept.
The Internet
Tech.Luver sends us word that, hot on the heels of reports that Verisign may be planning to sell DNS root server lookup data, ICANN has opened an investigation into a suspected practice by registrars it calls "domain name front running." The suspicion is that insiders at some registrars are using information from whois searches to snatch up desirable domain names before interested customers can register them. Here is ICANN's announcement of the investigation (PDF). ICANN asks that anyone who suspects they have been victimized by domain name front running to email them with details.
+ -
story

Related Stories

[+] Technology: Verisign To Sell DNS Root Server Lookup Data? 115 comments
An anonymous reader writes "According to an editorial at Domain Name News, Verisign is considering selling partial access to DNS root server lookup data. The data would be made available to registrars, who in turn could use it for 'traffic-tasting' non-existent domains entered by any internet user. This would give them a better idea about what bogus domains to put up sites on to capture eyeballs." Haven't seen this story elsewhere and it's based on an anonymous source; YMMV.
Submission: ICANN Investigates Insider Domain Name Snatching by Tech.Luver (1130091)
[+] Your Rights Online: ICANN Punts on WHOIS Privacy Proposal 90 comments
An anonymous reader writes "The Internet Corporation for Assigned Names and Numbers (ICANN) has essentially put off consideration of a proposal that would have dissolved a requirement that domain name registrars collect and display personal information about people who register Web site names. Privacy activists said the WHOIS database has become a data-mining dream for marketers and spammers, to say nothing of stalkers and harassers. Companies representing some of the world's biggest brand names appear to have prevailed, arguing that any change to the current system would interfere with law enforcement investigations and trademark disputes. In the end, ICANN voted 7-17 to table the issue in favor of further studies on the privacy impact of the WHOIS database."
[+] Technology: ICANN Finds No Wrong Doing in Domain Front Running 132 comments
eldavojohn writes "Remember the investigation ICANN did in domain name front running? Well, it turns out that there was no wrong doing going on at all. What went wrong? Domain name 'tasting', which involves a free five day trial of a domain name, was the big culprit. From the article: 'In some cases ... the committee found that a separate practice of domain name tasting may be causing problems. That refers to someone testing the financial viability of a name for up to five days and then returning it for a full refund, using a loophole in registration policies. Domain tasting can tie up millions of Internet addresses, including ones someone checks but does not buy.' If you check for availability of a website and someone sees you do it and they reserve it before you, it's fair play."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

ICANN Investigates Insider Domain Name Snatching 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Some proof (Score:5, Informative)

    by suso (153703) * on Thursday October 25 2007, @10:13AM (#21114021) Homepage Journal
    I have proof of this happening and I'm sure others do too. We have two different customers that looked up domains to see if they were available, asked us to register them and before we could register them, they were already registered by places in China and the Carribian. Both domains where somewhat obscure and I didn't see any reason why they should have normally been bought. In both cases, the domain was released after the 5 day period that ICANN allows (which I think was a mistake on ICANN's part to have that policy). But in some cases it might not be released if it turns out to be popular. As I said about the Verisign thing, this is an invasion of privacy.

    One of our customers (who allowed me to mention in this post that his domain in question was psysci.net) that had this happen said that he only used the command line whois and networksolutions.com to lookup the domain, so it might not just be small registrars involved in this scam. But that's a pretty serious accusation to bring against Network Solutions so take that with a grain of salt. THe company that tasted psysci.net had a name of Wan-Fu China, Ltd. The company that tasted the other domain had a name of (MAISON TROPICALE S.A.), which you can find a little more information about here [domainstatute.com]
    • Have you tried:

      host -t NS domain.com
      instead? If it says NXDOMAIN (no such domain), the domain does not exist.

      • Re:Use DNS to look up domains. (Score:4, Informative)

        by suso (153703) * on Thursday October 25 2007, @11:05AM (#21114875) Homepage Journal
        Have you tried:

                host -t NS domain.com

        instead? If it says NXDOMAIN (no such domain), the domain does not exist.

        Well of course I can do that but now even that is in danger of being snooped [slashdot.org]. But I can't expect a customer to do that every time, but they deserve better treatment than to have their domain snatched before they can even buy it. I think once this whole Verisign thing gets resolved, I'll setup a domain checker on our website so that they have someplace more trustworthy to check.
    • I'm not so sure that network solutions is completely innocent in all this. They're in it to make money, and if they can make money by selling records of whois requests, they'll do it. I've had similar experiences checking their whois service to see if a domain is registered, only to come back a couple of days later and find its now registered. First time I chalked it up to bad luck, second domain was too obscure to be bad luck.

      I don't think network solutions is doing the snatching, I merely think they're
    • hmmmm....I just tried checking a random domain on the networksolutions whois. ( 21laforest.com ) It's available so I'll check it a month from now to see if its snatched.

      • Re:Some proof (Score:4, Funny)

        by Chapter80 (926879) on Thursday October 25 2007, @11:22AM (#21115169)

        I just tried checking a random domain on the networksolutions whois. ( 21laforest.com ) It's available so I'll check it a month from now to see if its snatched.
        ha ha! Not a very controlled experiment.
        • find an available name
        • post it on slashdot
        • check a month later to see if it's taken.
        There are enough ass-tunnels out there (like me) who'd pay $8.95 just to screw up your experiment!
        • Good point, now I will check a second secret domain to prove or disprove the "ass-tunnel" hypothesis.
        • "There are enough ass-tunnels out there (like me)"

          Thank you for that brilliant word. Ass-tunnel. Now I will forever associate you with Goatse (which I think is a visual representation of such).
    • Everyone is having these issues...
      but I think we are all focusing on the symptoms and not the cause.

      Domain names need to be priced geometrically - so every one you buy costs more and more. No one needs more than 25 domain names. If they need more than that, make a NS and have subdomains dammit. It's much harder to get your squatting site to recoup $1000 than $8.

  • Not the Point (Score:5, Insightful)

    by mfh (56) on Thursday October 25 2007, @10:19AM (#21114117) Journal
    When a domain is snatched, usually it doesn't matter if the original owner gets it back or not. That's not the point, in most cases. Thieves will use the domain to drive traffic to their astroturfing/spam network and drive their PR up in the process. That stays in memory indefinitely and has a beneficial impact on any site like that.

    If the owner gets their network back, they still have the stigma of the bad activity associated with the domain.

    Preventing domain theft is going to only get increasingly more difficult as technology becomes more complicated.

    • This isn't about snatching domain names from previous owners. It's about improper use of search records from the whois databases, using this information to automatically grab new, currently unregistered domains when other people check the domain names' registration status.

    • Re: (Score:2, Interesting)

      by sm62704 (957197)
      This is only slightly on-topic but I have karma to burn so wtf, someone might think it interesting or amusing.

      I used to be a Quake addict, ad my ISP offered "unlimited internet access" and he wasn't kidding. They gave free web hosting with internet service, so I proceeded to start the "Springfield Fragfest" [sj-r.com] (note that the link is NOT to the Springfield Fragfest, it is to an article in Springfield's local paper that succinctly illustrates the fact that the real Springfield, which has an alderman named Gail S

  • I believe it happened to me.... (Score:3, Interesting)

    by lena_10326 (1100441) on Thursday October 25 2007, @10:23AM (#21114193) Homepage
    A year ago I searched on a domain I had spent 2 weeks thinking up. It was available but I waited 3 days. When I went to purchase, it was registered 1 or 2 days before. At the time I chalked it up to bad luck.

    I only wish I could remember the domain name. I might have it in my notes but I have pages and pages of notes.

      • You spent two weeks thinking up a domain name and now can't remember it?

        Man, you must have a terrible memory. Did you spend the entire two weeks going "I need a good domain name... how about awesome.net? Nah, that's no good. How about awesome.net? Yes, that's it!" :)

        1. I think up a lot of domain names. I have lots of ideas.
        2. It was 5-15 minutes a day.
        3. My ad hoc method gets me very good domains.
        4. I want you to try to think up a domain name with only dictionary words and see how well you do. Big talk from an a
        • I believe you're a big fat turd with sausage fingers

          No match for "BIGFATTURD.COM".
          >>> Last update of whois database: Thu, 25 Oct 2007 15:54:43 UTC <<<


          Just in case ...

          • No match for "BIGFATTURD.COM".
            >>> Last update of whois database: Thu, 25 Oct 2007 15:54:43 UTC <<<
            You forgot sausage fingers. That was the clincher. Heh.
  • Say you want domain xyz.com and you have no idea whether anyone else owns xyz.com or if it's in use.

    1. DO NOT go to xyz.com. If it is being squatted then the squatters now have a hit on it, they have one more reason to keep it if they're just testing out the ICANN 5 day snatch and release policy.

    2. Go to a registrar site and do a search on xyz.com

    3. If no one owns it, buy it NOW. The first hour after your search could very well be the only time it is ever available ever again. There is a very high probability of this. If you do not buy it right away, by the time you come back it will be gone. A squatter will have bought the site to abuse the ICANN 5 day policy. If it gets enough hits, they will keep it, if not, they will release it and by the act of releasing some other squatter will probably pick it up. This will keep on repeating itself until you pay enough money for some just as evil company to grab it and sell it to you.

    There's your guide to buying a domain name in three obnoxious steps.
    • Now you tell us. :D
    • Why not just start a bot that makes random DNS queries? This would eventually make it unprofitable for the squatters to squat.

      --
      This space for rent
      • This is undoubtedly going on. People like us are doing it to screw with all squatters, and squatters are probably doing it to other squatters to get them to buy and keep crap domains. Doesn't seem to be helping much though.
      • I don't think it'd work. It'd be very easy to load them into a table, filter them against dictionary words, and sort them by # of hits.

        Human eyeballs could pull the top 1000, do a quick spot check on the list, remove garbage names, and register the rest. Once setup, it'd take about 10-15 minutes of human intervention a day.

        • Good point. So if you're a whitehat and have access to the list of domains, some poisoning could still be applied by simply looking up each domain a (large enough) number of random times.

          The results could still be filtered by dictionary/eye but you at least devalue # of hits in their decision making process. Seems like a pretty important variable to take out of their equation.

  • wow (Score:3, Funny)

    by zehaeva (1136559) <zehaeva+slashdot.gmail@com> on Thursday October 25 2007, @10:28AM (#21114255)

    I am so very glad that ICANN has quickly come forth at the first signs of such a horrible problem, to think that the registrars would abuse their positions like this.

    I think we all can rest since ICANN is going to fix this before it even becomes a problem.

    oh wait ...

  • I have been the victim of Internet-related Terminology Front Running (tm). It began innocently enough with "trolling" borrowed from fishing terminology. But when "phishing" itself became a term, as well as "blog", "AJAX", "spidering", etc., I realized I was in a strange world where tech writers invent terms for phenomena most people aren't even aware exists yet. Usually the phenomena is out there for awhile first, and as it gradually trickles into common knowledge, terminology gradually evolves. But here we have terminology existing even before awareness of the phenomenon. Which brings us to "front running"...

    Oh, wait, we're talking about a different kind of front running? It means what again?

    See what I mean ICANN? I can't even keep track anymore. I thought I was tech savvy, but if I blink, these crazy kids are using words I don't even understand.

    Wait... ICANN is the wrong organization to complain to about this?

    I give up.

  • I've never used whois for this exact reason (Score:3, Informative)

    by Qbertino (265505) on Thursday October 25 2007, @10:37AM (#21114421)
    I've *never* used whois for probing novel domain-names for this exact reason. I just use the URL and see if it hits. If it and it's adjacent ones on other tlds of interest don't hit and I want it, I order it.

    Being a little paranoid allways helps.

    • Re: (Score:2, Interesting)

      by Marvin01 (909379)
      You don't trust 'whois', but you trust your ISP not to sell DNS records? You are far more trustworthy than I. Not to mention the significant chance that the domain might be registered, but not exposing a web host.
      • You could try 'traceroute' - but maybe that goes through the name servers anyway.

        • Re: (Score:3, Insightful)

          by idontgno (624372)

          Of course it does. Any IP communications which uses a name rather than an IP number is using some type of name resolution. Since the real question posed by this situation is "has this domain name been registered", you can't answer it without consulting with the domain name resolution system. And that is either a WHOIS query at a registrar or a name resolution check through a DNS, either incidental (ping my.foobar.foobaz.org) or intentional (dig my.foobar.foobaz.org).

          And I have doubts about using DNS to veri

  • To greatly reduce any doubt that this is happening, people should determine the availability of extremely unlikely domain names, like a random string of 24 characters.

    tksmowlapoxnvbwlqanmiutklweh.com
    laskjdfghlfkajgneruykvjniour.com
    qwieurylkajbaiurylkjasndfgpu.com

    If several of those are snatched up after a whois lookup, it's clearly not because anyone else actually bought the domain name because they wanted to use it.

    • Re:Some probabilistic inference (Score:5, Funny)

      by blueZ3 (744446) on Thursday October 25 2007, @10:53AM (#21114669) Homepage
      What do you mean, extremely unlikely?

      The first one is obviously used by The King of Siam's Major Order of Worried Lemurs Acting Perfectly or Xylophone Needing Vampires Being Wheedled Like Queens of Another Nice Monarchy In Utah's Tasteless Kingdom, Looking at Everyone's Hiney

      The other two are equally obvious
      • Wow, your 'b' key must be having a nervous breakdown after that post.

        Give him the rest of the day off before he goes postal on v or n.
    • Crap! How did you guess my super-secret domain?
  • I failed to renew my free dyndns.com domain on time and on Saturday someone using the U.K. host "Real International Business Corp." (which Google shows to be a host for all kinds of scam websites) stole the domain. It wasn't just someone grabbing an unused domain - they put up a copy of my front page (though the links led nowhere).

    They were even loading images, like I do, from my ISP's webspace. For a while I had changed the image to a big "WARNING!", but they noticed that yesterday and removed all links and images from their copy. A DMCA takedown won't work since they're in the U.K. and from what I've read of the hosting service, ethics aren't exactly their strong suit. So I've got to just learn from experience here. Oy.

  • ICANN needs to put registrars out of speculation (Score:5, Informative)

    by Animats (122034) on Thursday October 25 2007, @10:45AM (#21114551) Homepage

    One of the provisions of the ICANN Registrar Agreement is this: [icann.org]

    • 3.7.9 Registrar shall abide by any ICANN adopted specifications or policies prohibiting or restricting warehousing of or speculation in domain names by registrars.

    So ICANN has the authority to insist that registrars get out of the domain speculation business. They don't have to ask the registrars; they can simply order it.

    Currently, most of the "registrars" [icann.org] are fronts for domain speculators. Take a look at the list. There are whole families of phony registrars (Enom1, Inc., Enom2, Inc., Enom3, Inc., ... Enom371, Inc., ... Enom469, Inc.) There are ones who admit they're domain speculators (NameJumper.com, Inc., "!!BBB Bulk Inc"). There are ones that are fronts for "Club Drop".

    Most of these "registrars" are so phony they don't even have a business address.

    This registrar information is useful for filtering junk sites. If a site is registered with one of the bogus registrars, it's probably desirable to block its e-mail (which is probably spam), and throw it out of search engines.

  • I'd rather see a crackdown on typos... (Score:4, Interesting)

    by damn_registrars (1103043) on Thursday October 25 2007, @10:47AM (#21114571) Journal
    As much as front-running is annoying (at the very least), I think registering typo'd domains is actually worse. Considering how many domains are registered simply for the purpose of catching people who misspell the domain they want to visit, it may be a larger problem.

    And from my experiences, it seems like the typo squatters usually bombard you with pop-ups and other annoying crapola on their sites when you accidentally wander into them. The front-runners at least seem kind enough to just tell you "this domain could be yours for only $1M". Bastardly, sure, but less of an annoyance than 4 pop-ups that trigger more pop-ups on being closed.

  • why not make a domain named www.ICANNOT.org and just make it a listing/cache of domain names already taken so users looking for a domain can see if a name is already taken...

    Oops, too late, already taken...
  • You can directly lookup whois information at the internic's lookup page [internic.net], or use the unix whois command or a Windows utility like Cyberkit [pcworld.com] to discover whether or not a domain has been registered without leaking your interest to someone who might try to grab it first.
  • I say we setup a dictionary based query that (slowly as to not DNS) .. generates a mountian of plausible but not needed DNS queries. The domain squatters would then spend $$$ grabbing what amounts to useless domains .. Use the old scale of economy attack on them. It they have to sit on 10,000 useless names to hit one "real" one .. it becomes a LOT less profitable .. and they will move on.
    • under the rules there's no penalty for the 5 day waiting period. The squatters drop them before they pay any money. Icann needs a $15 non-refundable restocking fee or something.
  • That would clean up this problem, right? Sure, it's an impact on other lines of business, but domain registries have a 'special role' to play in the internet. One question, though, is whether ICANN could legally enforce this rule in various jurisdictions. Probably so, since ICANN could revoke the registry for not playing by the rules, but IANAL...

            dave
      • A registry would itself have to register with the root registry, which I guess is Network Solutions, right? Doesn't ICANN have to bless anyone who wants to be a registry?

        The domain name for my-bogus-registry.com would have to be registered first -with someone else-, before you could set up www.my-bogus-registry.com. So the specific bootstrap problem you mention should not occur.

              dave

  • If you do a whois on a domain name, then somebody, somewhere gets to see that you might be interested in buying it. It was really only a matter of time before someone started doing this.
  • I think this already happens. When you do a whois, which is usually the first thing in registering a domain, a variety of authorities are queried. Now - I don't know which one - but one of them is naughty and camping starts. There have been 3 occassions where I have run whois through netsol where within 24 hours the domain went from avail to camped (by studiomobile - a net 'research' company.) I think it is more than a coincidence.
  • .. when you have stuff like this going on...

    http://www.mentallyretired.com/2007/09/17/fraud-in-the-domain-name-market/ [mentallyretired.com]

    I wanted a domain name after it expires in half a year and they're ALREADY MAKING ME BID FOR IT. Keep in mind, this is the REGISTRAR, not the current domain owner.

  • I think this happened to me, but with a twist.. (Score:4, Interesting)

    by Unmanifest (948811) on Thursday October 25 2007, @11:26AM (#21115239)
    I was going to buy Squandered.org, .com, .net to release some original music and essays. Squandered.org was to be the band name, with the .org in the name to emphasize the "new media" thing.

    So I checked via godaddy.com, and it was available, but I didn't purchase it because my checking account was overdrawn. A while later(2 weeks to a month), I went to buy it, and it was taken. Whois said it was taken shortly after my availability check, by a company in Maine. It was cash-parked at Network Solutions.

    Anyway, a few months later(the dates are vague, I didn't mark my calender) I checked it to see what the people from Maine were doing with the title of my life's work. It was still just cash-parked at Network Solutions. So I checked WHOIS again, to refresh my memory about the name of the company, and it was now owned by an individual in Maryland instead of a company in Maine, but here's the scariest part: the registration date had *magically* moved backwards to 2005!

    I had personal reasons to remember very specifically that the location of the owner was in Maine. I didn't remember the company name, but I definitely remembered that the date of registration was just after I had checked it.

    And it's still just cash-parked. When it first happened, because of "Maine" and some personal events, I suspected a certain person I knew from certain forums had taken it for basically spiteful reasons. But when the date was altered, I was mystified and paranoid. "Why would the CIA and time-traveling lizard-people from Sirius conspire to keep me from doing my little project under that name?" Now, I'm relieved to find a more plausible explanation. A scammer or scammers with access to official registration data. Makes sense, I also own several other domains, so I might pop up as a high-probability purchaser. But I never contacted the owner, and in the intervening time I've reworked things to release soon under another name that I've owned for years.

    I did, however, pop off an email to ICANN detailing the events.

    Let me reiterate what's been said by others on this thread: don't check a domain unless you're ready to purchase it immediately.

    • Re: (Score:3, Interesting)

      by sm62704 (957197)
      OK, I know yours was a joke post, but something pissed me off for YEARS that I don't think should be allowed. I wanted to register mcgrew.org or alternately mcgrew.com back when com, org, and net (and ones you can't get like gov and edu) were the only roots.

      What infuriated me was that some sleazeballs had registered .com and .org for every name in the phone book, and was selling "your name can be your email!" mcgrew.com, smith.com, jones.com, even johnson.com (which one would expect to be a porn site) led t
    • Why have domain name service at all?

      That is, why do we have this superelaborate expensive annoying structure, the only purpose of which is to translate one string (the hostname) into another (the IP address)? Sure, a nice 32 bit number (0x4a7d1368) is easier for programs to work with than a variable-length alphanumeric string ("www.l.google.com").

      But so what? The only legitimate purpose of technology is to make our lives easier, not to serve as a temple in which we practice the complicated correct forms o

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.