Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 16 down vote favorite
1

Let's take lulzsec as an example; they registered lulzsecurity.com. There are two problems that I don't understand how they solved:

  • They had to pay for it. Tracking down money is generally much easier than tracking down IP addresses. I assume they didn't use stolen credit cards (with all the attention they received, people would have quickly found out and taken away their domain).. And even with prepaid credit cards it's relatively easy to find out who bought it, with security cameras/etc.
  • They had to have played by ICANN's rules - again, because of the attention they received, if they hadn't people would have found out and they would have lost the domain. This means giving valid contact information.
share|improve this question
1  
Somebody had to spell it out for me, because I wouldn't have guessed on my own: criminals purchase domain names using stolen credit card information. – Marc Abel Mar 12 at 15:45
These guys view themselves as black hat activists, not theives. Using a stolen credit card would be stealing from a random innocent invidividual, which is not their thing. Bitcoins or prepaid cards are far more likely. – mgjk Mar 12 at 18:41

3 Answers

up vote 17 down vote accepted

Here is one method of purchasing a domain name pretty close to anonymously.

  1. Use Tor. Understand its weaknesses
  2. Buy a prepaid credit card in cash, specifically one not requiring activation or signature.
  3. Randomly generate a full alias to use during online registration.
  4. Register an account at a domain registrar.
  5. Use the prepaid credit card to buy a domain.
  6. Repeat for other needed services.

Note that #1 requires non-anonymous interaction and is therefor the riskiest. Let's try another path.

  1. Use Tor. Understand its weaknesses
  2. Randomly generate a full alias to use during online registration.
  3. Earn some Bitcoins anonymously online, thus seeding without human contact.
  4. Chose a domain registrar and DNS host that supports Bitcoins
  5. Repeat for other needed services.
share|improve this answer
Step 3. in your second variant isn't trivial either. – CodesInChaos Mar 12 at 16:48
up vote 8 down vote

I don't know for certain how Lulzsec bought their domain but some domain suppliers will accept bitcoins as payment. Bitcoins are an anonymous payment method used by many websites.

I know it is also possible to purchase domains anonymously even through well known hosting providers such as Go-Daddy. The way it works is that the registrar will put their contact details as the registered contact information for a fee.

share|improve this answer
In the latter case, I'm sure the registrars would have by now received some sort of subpoena for the information - and I doubt that would have escaped media attention, whether it went answered or not. – Iszi Jun 25 '12 at 15:56
3  
The latter case is called domain privacy and there are a number of inexpesive options for this now. For example, namecheap is currently offering it for free with new registrations under the moniker "WhoisGuard Protection". – dodgy_coder Jun 29 '12 at 0:47
@Iszi - While the service GoDaddy uses for private domain registrations will share your information with a subpoena they will also register you. As other people pointed out, you can give fake information, good luck with that :$ – Ramhound Jun 29 '12 at 12:20
up vote 1 down vote

Domain registration requires payment and for this by far the most common payment method used is credit card, which will pass through the name and address of the owner of the card. But there are a number of other payment options available which enable an anonymous payment, including the humble money order. There are registrars which specialise in taking money orders like western union, moneygram etc. One such registrar is here: Money order domains.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.