4

Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). This is because when I have done so in the past and did not immediately purchase the domain name, I attempt to purchase the domain name a day or two later only to find out that someone else just bought the very obscure sounding domain name (perhaps GoDaddy and these other domain registrars sell this information to professional squatters?).

As a remedy to this problem, I began using a new strategy to search for available domain names. This was by simply typing in the domain name in the browser address bar as if to navigate to a website. If I get the default ISP/browser page for a non-existent website (e.g. http://www.some-example-asdfldsafidfdssfdoisfd.com ), it is quite likely (but not 100% certain) that the domain name is available for me to register.

I have been using this strategy for some time. However, strangely, a few days ago I used this strategy to see if a domain name was available, and happily saw that it was available for registration. Just now when I attempted to purchase the domain name at a registrar, I was told the domain name was unavailable, and upon performing a whois on the domain name, I see that it was purchased only three days ago!

What is the explanation for this?

My computer is clean from any type of malware.

The only 2 possibilities I can think of are:

  1. Glitch in the way DNS works for non-existent domain names (or maybe not a glitch?)
  2. ISP selling information about non-existent websites their customers try to visit to potential buyers

Thanks.

Improve this question
7
  • 1
    Could you share who you are using for nameserver? Opening cmd.exe and running "nslookup test.com" should tell which nameserver you are using. I hear that there registrars who offer "try out domain names" for a period of time, free of charge. Sounds like someone is fishing for popular domain names.
    – Dog eat cat world
    Commented Jul 20, 2014 at 20:54
  • 1
    @Dogeatcatworld, the name servers of the domain name in question (registered by the squatter) are: UNS01.LOLIPOP.JP and UNS02.LOLIPOP.JP
    – Pamela
    Commented Jul 20, 2014 at 21:08
  • Thanks, but I was more interested in what nameservers you are using - someone must be able to see what domains you are trying out.
    – Dog eat cat world
    Commented Jul 20, 2014 at 21:20
  • @Dogeatcatworld, sorry, but I'm a bit confused. I was trying to access this URL directly from my own Windows computer. Does my computer have a name server? If so, how can I check what it is?
    – Pamela
    Commented Jul 20, 2014 at 21:23
  • @Dogeatcatworld, are you referring to the Connection-specific DNS Suffix (found by typing "ipconfig /all" via CMD)? If so, it is: zte.com.cn
    – Pamela
    Commented Jul 20, 2014 at 21:44

3 Answers 3

Reset to default
1

When you type a URL into your address bar and press Enter, your computer sends a DNS query to find out the IP address associated with the name you typed, which most likely will be answered by your ISP's DNS servers.

The reason this happened to you is because many ISPs sell NXD data. From a relevant TechRepublic article from 2007:

The worst thing you could do? Try typing the URL in your Internet browser! Non-eXistent Domain (NXD) is the response received from a DNS server when a queried domain name doesn't exist. The NXD data can be extracted from logs by an ISP and sold on. Many ISP's sell NXD data to domain name research companies for analysis.

Except read "research companies" as "filthy scumbag squatters" and "analysis" as "sweet, effortless profit."

Improve this answer
2
  • Thanks, this is both reassuring and not reassuring at the same time. I sadly do not have any solid evidence regarding this that I can bring forth to the ICANN SSAC; however, I will definitely be extra vigilant from now on and continue to warn others.
    – Pamela
    Commented Jan 31, 2015 at 22:28
  • 1
    The whole system is quite rigged in favor of the megasquatters, unfortunately, and ICANN and the registrars don't care. In fact, they're motivated not to, as squatters help maximize registration fees. The safest, best advice I've found is the advice Philipp gave: only do .com whois searches at Verisign, or via the TLD operator of whatever TLD you're searching. Unfortunately, nobody learns better until they've been stung, as they have no way of knowing what they don't know. At that point they're very likely stuck waiting out the squatter who took what they wanted. I'm in the same boat.
    – Joshua Hanley
    Commented Feb 3, 2015 at 15:45
3

To avoid a whois service from using your input for domain squatting, you should always use the whois service of the official operating entity of that top level domain.

For .com, this is VeriSign.

Improve this answer
8
  • @Phillipp, thanks. However, should I also be worried about my ISP? I was typing in the domain name directly in the browser bar to find a squatter had shortly thereafter bought the domain name in question.
    – Pamela
    Commented Jul 20, 2014 at 20:13
  • 1
    @Pamela It's unlikely that your ISP is spying on you at all, and they are certainly incapable to do that if you are browsing https:// with a trusted certificate.
    – Havenard
    Commented Jul 20, 2014 at 21:02
  • @Havenard, then do you have any idea how the squatter got the idea to purchase this particular domain name? All I did was to enter the domain name in the browser URL bar. I didn't even do a whois lookup (until after the domain name was purchased by the squatter).
    – Pamela
    Commented Jul 20, 2014 at 21:09
  • @Pamela Are you sure it was registered after you tried it? If so its more likely someone who knew about it registered the thing to ruin your plans. Registering domains is costly, its not like someone can go reserving all names they come by and profit from it.
    – Havenard
    Commented Jul 20, 2014 at 21:12
  • 1
    Oh yeah, and some ISPs can point you to some site when you try to access an invalid domain. Change your DNS server to Google's 8.8.8.8 to make sure that don't happen so you won't be confused.
    – Havenard
    Commented Jul 20, 2014 at 21:14
2

It's not because someone has registered a domain name, he's running a webserver or even has pointed an IP to the domain. Your system is flawed. Just run a Whois instead.

Improve this answer
5
  • Thanks, but I think I wasn't clear enough. According to whois.godaddy.com, the domain was just registered 3 days ago.
    – Pamela
    Commented Jun 20, 2014 at 9:33
  • @Pamela It doesn't mean the domain is registered. Since you searched for the domain for registration in GoDaddy, they can automatically update their system to make whois.godaddy.com tell everyone it's registered just so nobody else can conflict with your purchase. If you use whois from some other registration entity it will probably tell you differently.
    – Havenard
    Commented Jul 20, 2014 at 21:08
  • @Havenard, I verified with other registrars (from beforehand and again now) that it is indeed taken.
    – Pamela
    Commented Jul 20, 2014 at 21:25
  • 1
    @Pamela The whois tells you what registrar was used? Was it some you tried? Whats the registrar name?
    – Havenard
    Commented Jul 20, 2014 at 21:28
  • @Havenard, the registrar the squatter used was GMO INTERNET, INC. (Registrar URL: onamae.com , Registrar WHOIS Server: whois.discount-domain.com , Registrar IANA ID: 49), a registrar I had never even heard of until now.
    – Pamela
    Commented Jul 20, 2014 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .