34

I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (hardcoded) for further info.

What I am afraid of is that if someone buys the domain after it has expired, he/she might take advantage and repackage my application to spread malware impersonating my application. On the other hand that means that I should forever keep and pay for the domain although there's no use for it anymore, just in case the dreadful scenario happens?

How should I proceed ?

Improve this question
6
  • 23
    Could you not publish one last new version of your freeware that no longer has that link/reference? Then renew the domain for one more year just to get that out there? Domain registration isn't expensive.
    – Doktor J
    Commented May 3, 2023 at 3:04
  • 1
    that could work,but many such sites do not update their listings or they do not respond
    – microwth
    Commented May 3, 2023 at 6:29
  • 16
    Please tell the Internet Archive to archive your website at every stage for historical preservation: web.archive.org/save
    – Solomon Ucko
    Commented May 3, 2023 at 14:46
  • 2
    When I worked at an e-publisher that tracked software companies, it was not unusual for domains of gone-companies to be hosting porn. Disgusting beyond belief photos. I don't know why these URLs were chosen or if the sites were just hacked. I had to take over sometimes to help employees close down the page quickly.
    – danak
    Commented May 3, 2023 at 16:58
  • @danak It's most likely hacked or squatted. The bad stuff are basically illegal but there's always $ to be made, so they use shadow-hosting options.
    – Nelson
    Commented May 4, 2023 at 4:53

4 Answers 4

Reset to default
52

Unless your freeware is somewhat popular or used by high-value targets, its usefulness for conducting supply chain attacks is probably limited. If the domain name enjoys good SEO, I would rather expect that a speculator registers the name upon expiry and turns it into a parked page with sponsored links. More something like that.

If you don't renew the domain it will eventually be deleted and available to register by anyone (unless the registrar decides to keep it for themselves. This sometimes happens with valuable names).

My advice would be a) renew for one more (and last) year and b) update your website to state that the software is no longer supported after a certain release, and that the website will ultimately be retired. And even check that archive.org picks up the change. The idea is to signal your intent well in advance, and leave a record online.

And c) try to send notice to at least a few shareware directories possible, so that your application is flagged as abandoned/discontinued.

And perhaps make it a habit of signing code and commits with a PGP key too. Sign your code if you haven't already (and sign the retirement notice as well), publish your public key prominently on your website and upload it to a few key servers like https://pgp.mit.edu/ or https://keys.openpgp.org/

The idea here is to "plant your tent", and if anybody does anything bad with your former domain name, at least they cannot sign their misdeeds under your name (PGP key).

Improve this answer
2
  • 5
    "(unless the registrar decides to keep it for themselves. This sometimes happens with valuable names)" It is a usual old urban legend. At least in gTLDs, this is explicitly forbidden by ICANN contracts. Auctions can happen though.
    – Patrick Mevzek
    Commented May 3, 2023 at 15:51
  • 15
    During that last year, keep track of how many page visits you get. That should indicate how significant the potential problem is.
    – bta
    Commented May 3, 2023 at 18:28
20

Cost makes a big difference. Some people think keeping a domain means spending hundreds of dollars a year because "that's what we've always paid", but that really is not the case.

If the domain is currently hosted somewhere (i.e., more than just basic domain registration), consider moving the domain to an inexpensive registrar and with no actual hosting. Even without anything fancy, basic registration can range from around $10 (maybe even a little less) per year to $40 or more. And with hosting could be anywhere from $20 per year to hundreds of $. If you drop everything but basic registration (maybe redirect it to another domain if you have one, that usually is no charge beyond the basic registration) then the cost is minimal. But not zero - if $10 a year is too much to spend on the domain then I recommend the other answer: Keep it for one year, track it during that time, and then decide what to do next year.

Improve this answer
2
  • 5
    Good advice. I have a domain with DNS hosting on Cloudflare and static content hosting on Github. Total cost is only the domain fee itself, the rest is 100% free and even includes HTTPS certificates through Cloudflare. This is as cheap as it gets. With a solution like this, @op could probably afford to keep the domain running indefinitely, showing an "end of life" message to visitors.
    – Gertsen
    Commented May 4, 2023 at 10:04
  • 1
    Cloudflare registrar is a good option and very cheap
    – Akam
    Commented May 31, 2023 at 0:57
3

I wouldn't worry too much about them spreading malware on your domain unless it was fairly prominent, it just wouldn't be worth the effort.

What you do need to make sure of though is that any accounts registered with an email in that domain are closed down. It's quite common for expired domains to be picked up, cloud hosting passwords reset, and then huge bills wracked up in the name of the old domain owner whilst the fraudster mines crypto.

Improve this answer
2
  • 3
    E-mail is a valid concern. If there are any E-mail accounts under that domain name, that can still be used to gain access at other "sensitive" places (by resetting the password), then you should "unregister" those E-mail addresses first, before you even consider letting the domain name expire.
    – Kate
    Commented May 4, 2023 at 13:20
  • 1
    It happened to a friend of mine just last year, and he's having to take Amazon to court to get out of a £50k AWS fee that isn't his fault
    – ScottishTapWater
    Commented May 4, 2023 at 13:24
2

Is the domain popular? If it gets reasonable amount of tracking you can look for a cheap registrar and put information that software is no longer supported and place Google ADs on it. It might be enough for you to be able to pay to maintain the domain

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .