6

A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The domain is dormant in the sense that it is not used in any way at the moment i.e. it has no valid NS, it doesn't host any website and most importantly I haven't publically disclosed registration. The only five people who are aware of this domain are three people whom I know in person and two GoDaddy technical assistance reps (I needed help updating WHOIS contact information).

I have two questions:

  1. How did spammers learn about my domain registration so fast?
  2. Does it make any sense at this point to pay retrospectively for WHOIS privacy?

PS. The reason that I haven't bought WHOIS privacy in the first place is that I haven't encountered this bizarre issue previously (I have registered a few domains with GoDaddy previously).

Improve this question

3 Answers 3

Reset to default
4

Anybody can see new domain registrations, at least in mainstream extensions like .com/.net/.org. This is public information and you could even compile this data for yourself using zone files. You can even apply for zone access straight from the registries. Example: Verisign TLD Zone File Access Program. Note that the rules vary from one extension to another. For instance most country code extensions (eg. .ca .fr etc) will not release their zone files or severely restrict access, but some however do publish lists of new or deleted domains on their websites.

The modus operandis of spammers is this:

  • they obtain the list of new domains on a daily basis (from zone files, public lists, or otherwise)
  • they scrape the whois record for each new domain
  • they start spamming

There are plenty of legitimate reasons why people (including myself) use zone files, for example for research purposes, trademark enforcement or if you are running a search engine and need to discover new contents etc. Of course the downside is that registrants are left open to spamming and unwanted exposure of their acquisitions (many people probably do not realize data mining is going on and the data is going to be archived somewhere). You can now expect to receive dozens of spam in the next few days for SEO services or web development services from India or USA (allegedly).

TL;DR: The registrar is not to blame here. Your experience is very typical and unfortunately normal. It is a good idea to use a dedicated E-mail address for the whois record and possibly list a virtual phone number and a P.O. box in case somebody needs to contact you. As per Icann rules, you must maintain accurate and truthful whois data but you can avoid exposing yourself whilst remaining reachable. I would not recommend using third party whois privacy service for reasons that are too many to explain and beyond the scope of your question.

Improve this answer
3
  • How do they scrape whois database? Using zone files? Or you are referring to another method?
    – Alexander K.
    Sep 10, 2017 at 19:34
  • The whois record for a given domain can be checked at pretty much any registrar but of course spammers will not check each domain manually. This can be automated with the whois tool using the command line, or even with telnet on port 43. To sum up there are two steps: 1. obtaining the list of domain names 2. fetching the whois record for each of those domains. Of course a 'smart' spammer will filter out duplicates and avoid sending more than once to the same recipient (but they are still dumb).
    – Kate
    Sep 10, 2017 at 23:53
  • Thank you for explaining. I didn't know about DNS zone files. Now it all makes sense.
    – Alexander K.
    Sep 13, 2017 at 21:49
1

There are various options for downloading the entire WHOIS database as well as daily updates to the WHOIS database. So they could have seen your new record in this manner from the WHOIS record (without knowing your domain) and obtained your email address from that.

As for enabling a privacy guard, it possibly could slightly hinder new spammers from finding your information, but existing spammers will still have your information and can sell it. If you ever change your email address to reduce spam then enabling a privacy guard would make more sense.

Improve this answer
0

Some domains do attract more attention than others for some reason. They will have got your information from WHOIS, simple as that.

I've had some domains get spam within hours, some never do. It does seem to be a bit random. I always use an email address specifically for each domain only for domain registration information so I can basically send it to spam - this approach might be useful to update your record with to thwart new spam agents. But...

The problem with adding privacy now, is some WHOIS sites allow historical lookups. That said it may stop some spam agents looking up basic current WHOIS data going forward.

Improve this answer
1
  • 2
    How would spammers become aware of the new domain though? Do registrars disclose information unofficially? Is there some kinda exploit / leak that allows scanning of DNS servers for new domain names?
    – Alexander K.
    Jul 16, 2017 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .