Do my domain name ideas risk getting stolen by checking their availability?

Question

Let's say there's a domain name that is currently unregistered, that I want to purchase with the intention of re-selling for a profit, and I want to determine which variations of the name are also available.

Is it "safe" for me to check availability of several domain names through tools like https://www.whois.com/, or do I risk others seeing my queries and "stealing my ideas", potentially snatching up my potential golden eggs before I have a chance to register them? (...especially if others have recently queried the same domains?)

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data), but as I understand it, I can use sites like:

http://www.whois . {pick a top-level-domain}
such as .com, .net, .ru, .uk, .info etc.

...as a neutral, trustworthy authority for that TLD, even government-sanctioned in the case of country-code TLD's) and therefore can be trusted to not do shady stuff like that?

Is this true?

Answer 1

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data),

This is widely shared as an hypothesis/assumption/observation but yet it was never really formally proved. It does not mean it is not true, just that it is difficult to prove with 100% certainty.

If I remember correctly the only real study of it kind of proved the opposite but this is hard to do properly and it goes against so many people impressions, that they can not believe it: they persuade themselves that they put the domain name in one form online only and it got registered after then making the conclusion that the website with this form stole their domain, forgetting that in fact their idea may have been already shared elsewhere, that they are using various tools that leak data (from browser extensions, to cloud tools, to network sniffers, etc...), and at the end that, like in science, it does happen for two unrelated persons to get the same idea approximately at the same time.

But there is not need to prove it or the opposite because there is no need for one to put itself under this problem.

To solve your query about checking if a domain is available or not there is only one foolproof way to do it (besides trusting a specific registrar and ask him to check for you because he will be able to use its specific connections to the registry, which are not public, but give real time availability answers):

1. Go to https://www.iana.org/domains/root/db: this is the authoritative source of all currently existing (published) TLDs.
2. Select the one you are concerned with, and in its page on IANA website you will see details about which is its registry, with a link to its website, as well to its whois servers
3. (note in passing that there are other ways, more empiric, to find the whois servers of a given TLDs, I detailed most of them in my answer here: https://unix.stackexchange.com/a/407030/211833)
4. Now you can either try to do a whois on the registry website, or do a whois on port 43 but with option -h (typically, check your client) to contact directly the registry whois server and no other (of course this latter case is still vulnerable to anyone being able to sniff the network path between you and the whois server as this communication is not secured in anyway, every piece of data goes in the clear)

If you do the above, you reduce the number of intermediaries and third parties that are unneeded. Hence, you lessen your risk.

Everything else for me is "unsafe", as you are given your data to a third party. It may or may not behave like you want it to behave. Since there are never 100% guarantees, why take the chance?

Also, for names you deem highly valuable the usual advice of course is not to wait: instead of checking for them and then decide to register them days or weeks later, check for them and register immediately. This also lessen your risk quite a lot.

As for

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data),

There is some kind of ambiguities because it is not clear what you put behind "reselling companies".

In the classical (but not without exceptions) model you have, per TLD:

• one registry
• a certain number (in the hundreds or couple of thousands at most) of registrars under contract with the registry and the only one having a connection to it for all domain name operations
• a very much larger number of resellers, that is any third party that is either under contract with a registrar, or just uses its website/API. They can be webhosting companies, trademark protection agencies, integrated services providers, etc.

In the gTLD world, on top of the above, the registry and the registrars are under contract with ICANN. In that model, registrars are forbidden to register domain names for themselves they can operate only on behalf of their client. Which has normally the corollary that, even if they monitor the checks done, they can not register the domains in place of their clients. Of course there were historical counter examples of that.

But the main point is that there are no such contracts and rules at the resellers level. Those companies can do pretty much what they want: if you give them your data through your use of their website it is already potentially too late. There may be even some silly footprints on the website that exonerates them of any wrongdoings if they use your data because you are deemed to have accepted them to do whatever they please with it as soon as you used their tools/website.

So, again, do not use unneeded third parties. Either you have one registrar you fully trust and you do everything through it. Or purely for check availability you use only the registry whois server or website.

Answer 2

Your best bet is to always register the domain right after checking it (if it's available). With a few billion people connected to the Internet, it's not uncommon that a few people come up with the same domain idea at the same time. In fact, on my recent search for the domain for a new project, I came across two interesting names that were just registered - one a few days prior, and the other one just a few hours before I checked. Now, if the current owner of the domain checked it but didn't register it, I would have most likely snatched it.

That said, it's usually safer to check domains directly via command line, without using any kind of web or app interfaces. The problem is that many registries limit the number of queries and then block your IP for a day or longer. One way to avoid it is to check the domain(s) first with host and only if it returns NXDOMAIN, check it with whois (command line whois always queries the registry directly, so if nobody is sniffing your traffic, you should be safe) to verify if it's actually free, or just misconfigured, or maybe deleted.

Back to web interfaces - it should be safe to use whois.ccTLD but first make sure it is actually run by the relevant registry. You can check each registry's home page on this list, and find the whois form there. However this method has no advantages (in terms of "privacy") over using the command-line whois, so it's just a matter of convenience (more convenient if you're on mobile, less covenient on laptop/desktop). I definitely don't recommend using whois.com as it's run by a random company, not by the registry. Other whois.TLD websites can be similar.