2

Let's say there's a domain name that is currently unregistered, that I want to purchase with the intention of re-selling for a profit, and I want to determine which variations of the name are also available.

Is it "safe" for me to check availability of several domain names through tools like https://www.whois.com/, or do I risk others seeing my queries and "stealing my ideas", potentially snatching up my potential golden eggs before I have a chance to register them? (...especially if others have recently queried the same domains?)

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data), but as I understand it, I can use sites like:

http://www.whois . {pick a top-level-domain}
such as .com, .net, .ru, .uk, .info etc.

...as a neutral, trustworthy authority for that TLD, even government-sanctioned in the case of country-code TLD's) and therefore can be trusted to not do shady stuff like that?

Is this true?

| improve this question | | | | |
  • 1
    See this related question which focuses on how do I check that a domain is available without triggering a grabber versus if it's true... (I'm pointing out the difference to avoid having it marked as a duplicate) – dan Oct 17 '18 at 8:08
  • 1
    Yes, set it in tcp/ip properties. You still not safe if use some online tools, cause they don't use your dns setting, so avoid using them at all. Use any local software. Mocrosoft whois is fine. Also if you point your browser or similar software to some domain, its safe now. – LeonidMew Oct 20 '18 at 13:27
  • 1
    @LeonidMew - I got it setup.. And I can just use 8.8.8.8 from now on, with various benefits and no ill effects; how have I never heard of this before?! Thanks very much, your comments were the missing puzzle pieces I needed. – ashleedawg Oct 20 '18 at 13:31
  • 1
    I'm not sure, something more verbose. I'm using whois on Linux, which is different. – LeonidMew Oct 20 '18 at 13:40
  • 1
    "Anyway, do use Google DNS 8.8.8.8 with whois command or browser or any other software, its safe way for sure. " this is wrong and false on many points. First whois and DNS have nothing to do together (except that the source for both of them at some point is a domain name registry), second what means "safe" in that sentence? Do you know Google policies about the date you send it? Do you trust them? And why favoriting Google Public DNS when they are many others (for which you can ask the same question of trust of course): 1.1.1.1, 9.9.9.9, 80.80.80.80 just to name the easy ones.... – Patrick Mevzek Apr 8 '19 at 6:44
2

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data),

This is widely shared as an hypothesis/assumption/observation but yet it was never really formally proved. It does not mean it is not true, just that it is difficult to prove with 100% certainty.

If I remember correctly the only real study of it kind of proved the opposite but this is hard to do properly and it goes against so many people impressions, that they can not believe it: they persuade themselves that they put the domain name in one form online only and it got registered after then making the conclusion that the website with this form stole their domain, forgetting that in fact their idea may have been already shared elsewhere, that they are using various tools that leak data (from browser extensions, to cloud tools, to network sniffers, etc...), and at the end that, like in science, it does happen for two unrelated persons to get the same idea approximately at the same time.

But there is not need to prove it or the opposite because there is no need for one to put itself under this problem.

To solve your query about checking if a domain is available or not there is only one foolproof way to do it (besides trusting a specific registrar and ask him to check for you because he will be able to use its specific connections to the registry, which are not public, but give real time availability answers):

  1. Go to https://www.iana.org/domains/root/db: this is the authoritative source of all currently existing (published) TLDs.
  2. Select the one you are concerned with, and in its page on IANA website you will see details about which is its registry, with a link to its website, as well to its whois servers
  3. (note in passing that there are other ways, more empiric, to find the whois servers of a given TLDs, I detailed most of them in my answer here: https://unix.stackexchange.com/a/407030/211833)
  4. Now you can either try to do a whois on the registry website, or do a whois on port 43 but with option -h (typically, check your client) to contact directly the registry whois server and no other (of course this latter case is still vulnerable to anyone being able to sniff the network path between you and the whois server as this communication is not secured in anyway, every piece of data goes in the clear)

If you do the above, you reduce the number of intermediaries and third parties that are unneeded. Hence, you lessen your risk.

Everything else for me is "unsafe", as you are given your data to a third party. It may or may not behave like you want it to behave. Since there are never 100% guarantees, why take the chance?

Also, for names you deem highly valuable the usual advice of course is not to wait: instead of checking for them and then decide to register them days or weeks later, check for them and register immediately. This also lessen your risk quite a lot.

As for

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data),

There is some kind of ambiguities because it is not clear what you put behind "reselling companies".

In the classical (but not without exceptions) model you have, per TLD:

  • one registry
  • a certain number (in the hundreds or couple of thousands at most) of registrars under contract with the registry and the only one having a connection to it for all domain name operations
  • a very much larger number of resellers, that is any third party that is either under contract with a registrar, or just uses its website/API. They can be webhosting companies, trademark protection agencies, integrated services providers, etc.

In the gTLD world, on top of the above, the registry and the registrars are under contract with ICANN. In that model, registrars are forbidden to register domain names for themselves they can operate only on behalf of their client. Which has normally the corollary that, even if they monitor the checks done, they can not register the domains in place of their clients. Of course there were historical counter examples of that.

But the main point is that there are no such contracts and rules at the resellers level. Those companies can do pretty much what they want: if you give them your data through your use of their website it is already potentially too late. There may be even some silly footprints on the website that exonerates them of any wrongdoings if they use your data because you are deemed to have accepted them to do whatever they please with it as soon as you used their tools/website.

So, again, do not use unneeded third parties. Either you have one registrar you fully trust and you do everything through it. Or purely for check availability you use only the registry whois server or website.

| improve this answer | | | | |
2

Your best bet is to always register the domain right after checking it (if it's available). With a few billion people connected to the Internet, it's not uncommon that a few people come up with the same domain idea at the same time. In fact, on my recent search for the domain for a new project, I came across two interesting names that were just registered - one a few days prior, and the other one just a few hours before I checked. Now, if the current owner of the domain checked it but didn't register it, I would have most likely snatched it.

That said, it's usually safer to check domains directly via command line, without using any kind of web or app interfaces. The problem is that many registries limit the number of queries and then block your IP for a day or longer. One way to avoid it is to check the domain(s) first with host and only if it returns NXDOMAIN, check it with whois (command line whois always queries the registry directly, so if nobody is sniffing your traffic, you should be safe) to verify if it's actually free, or just misconfigured, or maybe deleted.

Back to web interfaces - it should be safe to use whois.ccTLD but first make sure it is actually run by the relevant registry. You can check each registry's home page on this list, and find the whois form there. However this method has no advantages (in terms of "privacy") over using the command-line whois, so it's just a matter of convenience (more convenient if you're on mobile, less covenient on laptop/desktop). I definitely don't recommend using whois.com as it's run by a random company, not by the registry. Other whois.TLD websites can be similar.

| improve this answer | | | | |
  • Can't they snatch the domain before you can react? I just searched a nice name, then it was gone and the whois record reads: Updated Date: 2020-01-03T23:13:48Z, only a few hours ago. what are the odds that namecheap and I both clicked at around the same instant? and it expired in October 2019 and I now see the name on Godaddy for 95K. It appears to me the system is rigged for their benefit. sucks. – Logic1 Jan 4 at 2:33
  • If it expired in October, odds are it has been on the radar of many people. Expiring domain lists are publicly available and thoroughly parsed. By the way, check the registration date, not updated date - maybe it was just renewed or transferred at that time? – pb_ Jan 4 at 2:41
  • You are probably right, I feel a little better. I am not very knowledgeable in this subject apparently, And I do not know the true meaning of Updated Date, I did not see a Registered Date listed so I figured the two were synonymous. – Logic1 Jan 4 at 2:57
  • It should be shown, for example whois for stackexchange.com looks like that: Updated Date: 2019-05-14T17:31:46Z Creation Date: 2009-06-12T13:55:30Z Registry Expiry Date: 2020-06-12T13:55:30Z - so "Creation date" is the most important one, it shows when the domain was registered. – pb_ Jan 4 at 2:58
  • 1
    The expiration process is quite lengthy and lots of things can happen in the meanwhile, including renewal, transfer, ownership change, auction etc. If the creation date shows 2014, then the domain has not expired. It was either renewed or auctioned off by the registrar (a common practice in .com zone). Take a look at this chart for reference: icann.org/resources/pages/gtld-lifecycle-2012-02-25-en - as you can see, the expiration period can take up to 80 days from the expiry date until the domain actually returns to the pool, and until the last few days it can be renewed any time. – pb_ Jan 4 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.