Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). This is because when I have done so in the past and did not immediately purchase the domain name, I attempt to purchase the domain name a day or two later only to find out that someone else just bought the very obscure sounding domain name (perhaps GoDaddy and these other domain registrars sell this information to professional squatters?).

As a remedy to this problem, I began using a new strategy to search for available domain names. This was by simply typing in the domain name in the browser address bar as if to navigate to a website. If I get the default ISP/browser page for a non-existent website (e.g. http://www.some-example-asdfldsafidfdssfdoisfd.com ), it is quite likely (but not 100% certain) that the domain name is available for me to register.

I have been using this strategy for some time. However, strangely, a few days ago I used this strategy to see if a domain name was available, and happily saw that it was available for registration. Just now when I attempted to purchase the domain name at a registrar, I was told the domain name was unavailable, and upon performing a whois on the domain name, I see that it was purchased only three days ago!

What is the explanation for this?

My computer is clean from any type of malware.

The only 2 possibilities I can think of are:

  1. Glitch in the way DNS works for non-existent domain names (or maybe not a glitch?)
  2. ISP selling information about non-existent websites their customers try to visit to potential buyers


  • 1
    Could you share who you are using for nameserver? Opening cmd.exe and running "nslookup test.com" should tell which nameserver you are using. I hear that there registrars who offer "try out domain names" for a period of time, free of charge. Sounds like someone is fishing for popular domain names. – Dog eat cat world Jul 20 '14 at 20:54
  • 1
    @Dogeatcatworld, the name servers of the domain name in question (registered by the squatter) are: UNS01.LOLIPOP.JP and UNS02.LOLIPOP.JP – Pamela Jul 20 '14 at 21:08
  • Thanks, but I was more interested in what nameservers you are using - someone must be able to see what domains you are trying out. – Dog eat cat world Jul 20 '14 at 21:20
  • @Dogeatcatworld, sorry, but I'm a bit confused. I was trying to access this URL directly from my own Windows computer. Does my computer have a name server? If so, how can I check what it is? – Pamela Jul 20 '14 at 21:23
  • @Dogeatcatworld, are you referring to the Connection-specific DNS Suffix (found by typing "ipconfig /all" via CMD)? If so, it is: zte.com.cn – Pamela Jul 20 '14 at 21:44

When you type a URL into your address bar and press Enter, your computer sends a DNS query to find out the IP address associated with the name you typed, which most likely will be answered by your ISP's DNS servers.

The reason this happened to you is because many ISPs sell NXD data. From a relevant TechRepublic article from 2007:

The worst thing you could do? Try typing the URL in your Internet browser! Non-eXistent Domain (NXD) is the response received from a DNS server when a queried domain name doesn't exist. The NXD data can be extracted from logs by an ISP and sold on. Many ISP's sell NXD data to domain name research companies for analysis.

Except read "research companies" as "filthy scumbag squatters" and "analysis" as "sweet, effortless profit."

  • Thanks, this is both reassuring and not reassuring at the same time. I sadly do not have any solid evidence regarding this that I can bring forth to the ICANN SSAC; however, I will definitely be extra vigilant from now on and continue to warn others. – Pamela Jan 31 '15 at 22:28
  • 1
    The whole system is quite rigged in favor of the megasquatters, unfortunately, and ICANN and the registrars don't care. In fact, they're motivated not to, as squatters help maximize registration fees. The safest, best advice I've found is the advice Philipp gave: only do .com whois searches at Verisign, or via the TLD operator of whatever TLD you're searching. Unfortunately, nobody learns better until they've been stung, as they have no way of knowing what they don't know. At that point they're very likely stuck waiting out the squatter who took what they wanted. I'm in the same boat. – Joshua Hanley Feb 3 '15 at 15:45

To avoid a whois service from using your input for domain squatting, you should always use the whois service of the official operating entity of that top level domain.

For .com, this is VeriSign.

  • @Phillipp, thanks. However, should I also be worried about my ISP? I was typing in the domain name directly in the browser bar to find a squatter had shortly thereafter bought the domain name in question. – Pamela Jul 20 '14 at 20:13
  • 1
    @Pamela It's unlikely that your ISP is spying on you at all, and they are certainly incapable to do that if you are browsing https:// with a trusted certificate. – Havenard Jul 20 '14 at 21:02
  • @Havenard, then do you have any idea how the squatter got the idea to purchase this particular domain name? All I did was to enter the domain name in the browser URL bar. I didn't even do a whois lookup (until after the domain name was purchased by the squatter). – Pamela Jul 20 '14 at 21:09
  • @Pamela Are you sure it was registered after you tried it? If so its more likely someone who knew about it registered the thing to ruin your plans. Registering domains is costly, its not like someone can go reserving all names they come by and profit from it. – Havenard Jul 20 '14 at 21:12
  • 1
    Oh yeah, and some ISPs can point you to some site when you try to access an invalid domain. Change your DNS server to Google's to make sure that don't happen so you won't be confused. – Havenard Jul 20 '14 at 21:14

It's not because someone has registered a domain name, he's running a webserver or even has pointed an IP to the domain. Your system is flawed. Just run a Whois instead.

  • Thanks, but I think I wasn't clear enough. According to whois.godaddy.com, the domain was just registered 3 days ago. – Pamela Jun 20 '14 at 9:33
  • @Pamela It doesn't mean the domain is registered. Since you searched for the domain for registration in GoDaddy, they can automatically update their system to make whois.godaddy.com tell everyone it's registered just so nobody else can conflict with your purchase. If you use whois from some other registration entity it will probably tell you differently. – Havenard Jul 20 '14 at 21:08
  • @Havenard, I verified with other registrars (from beforehand and again now) that it is indeed taken. – Pamela Jul 20 '14 at 21:25
  • 1
    @Pamela The whois tells you what registrar was used? Was it some you tried? Whats the registrar name? – Havenard Jul 20 '14 at 21:28
  • @Havenard, the registrar the squatter used was GMO INTERNET, INC. (Registrar URL: onamae.com , Registrar WHOIS Server: whois.discount-domain.com , Registrar IANA ID: 49), a registrar I had never even heard of until now. – Pamela Jul 20 '14 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.