8

I registered a .COM 3 days ago, and since have received over 30 emails and 5 direct phone calls to the contact details I used when registering (via Fasthosts), which is now of course showing in WHOIS. I'm a developer myself so have no interest in their services.

I have not set up ANY emails on the new domain yet, these are being sent to the owner's email in whois (me) offering web services and directly referencing the new domain - so however this is being done it is not a coincidence: it is a direct result of the new registration.

My question is HOW are these companies/individuals (mostly India based) latching on to newly registered domains within hours in order to collect WHOIS info?

Are they scanning for DNS changes?

I don't want to do it, I am just intrigued! Additional: this is not the first time i have experienced this.

| improve this question | |
  • I wonder how typical this is? (I think Simon's initial answer implied this was a bit unusual.) Admittedly I've not registered a .com for a while, but I've registered a fair few and I only get the odd spam/phishing email now and again, not the deluge you've experienced?! – DocRoot Nov 16 '16 at 17:53
  • 1
    Having spoken to some other people in the industry and on forums, it seems VERY common at the moment - I've only noticed this happen the last year or so, I've registered tens of .coms over the years and its never been an issue. This is why I asked - as it seems almost the moment its registered some sort of whois bot is harvesting details. – Digital Lightcraft Nov 16 '16 at 17:57
  • Did you set-up private registration? – John Nov 16 '16 at 20:49
  • Your question about "how" is answered below but if you are ready to think about the next question "how do I avoid this?" then you should avoid crappy Registrars who serve spammers and marketers' interests above yours. I use Gandi who work to protect your data by default but there are others who do the same. No affiliation, just a customer of theirs. They never advertise which is why you probably haven't heard of them, even though they are a fairly large company. TL;DR shop around! – Tom Brossman Nov 17 '16 at 7:19
  • Fasthosts are a respected registrar who do not sell on details. – Digital Lightcraft Nov 17 '16 at 23:00
7

Each top level domain registry makes a dump of all whois data available. You can either download it yourself periodically, or subscribe to a service that does so and alerts you to changes.

Marketers subscribe to be notified of all newly registered domain names so they can send you spam.

See: Possible to download entire whois database / list of registered domains?

| improve this answer | |
  • I though it was something like that, hmm... yet another way my email ends up on spaming lits... – Digital Lightcraft Nov 16 '16 at 12:53
2

Spammers will go to great lengths to obtain contact information from website owners, these are just some of the most common methods:

  • Whois lookup
    • Using a online database of newly registered domains they can then perform a scripted WHOIS lookup using windows whois, linux whois or similar and output those entries for later harvesting. Often spammers will look at common name servers to find newly registered domains, for example the top 50 name servers.
    • Despite belief most spammers do not harvest whois information from online websites that cache WHOIS information. This is because most will throttle and use some kind of captcha service, which can be easily cracked using a online service as little as 0.07 USD per a de-captcha but the process takes resources and money making it more practical to do locally.
    • As mentioned by Stephen registrars do have a list of domain whois information but generally these lists are well guard and its far easily and more cost effective just to scan newly registered domains that it is to obtain one of those lists.
  • Common email aliases
    • A lot of spam actually comes from spammers purely sending out millions of emails and they care little about failed deliver rates. They will attempt aliases such as:
      1. info@example.com
      2. admin@example.com
      3. webmaster@example.com
      4. support@example.com.
  • Direct page harvesting
    • Other harvesting methods including scanning the website for emails, these can be text form, javascript form or raw text... bots are rather clever these days and can detect things like alias at example.com, alias(a)example.com and alias at example dot com, I even read somewhere that spammers prefer alias that are not so common as they have better lead rates.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.