Hacker News Reader

Comment by jandrese | Hacker News Reader

Domain registrars giving away domains to squatters when people search for them is a time honored practice. The advice I've seen is to not search for the domain first, just register it outright from the start. The domain registration business is run with all of the integrity and customer focus of TicketMaster.

View on HN

Really? I may have just found myself a new hobby. Search for incredibly unique (and worthless to me) domains to see if I can get people to squat on them. Heck, it could be a game ... I could get all my friends to make bingo boards ... or maybe see if I can think of some scrabble like rules.

I suspect a human gets a dump of them and decides which to pay the $10 for.

For example, asdasdahbdajsdbajdbhsbdahsdd.com... not worth the $10

ireallylikechicken.com... maybe worth the $10?

(ireallylikechicken.com is available, go squat it and get rich)

Someone did buy it it!

> Creation Date: 2020-01-09T19:37:01Z

Registered with Gandi, ironically enough...

And the domain is meta! Response from HTTP GET

> Location: https://news.ycombinator.com/item?id=22001822

er.... was it you?

It was not

Hilarious

ireallylikechicken.com owner.

I'll give you 20 for it?

Only a 100% markup? I am sure it will be worth more than that in the future ;)

That’s what they said about Bitcoin last year

>That’s what they said about Bitcoin last year

Bitcoin price in USD on January 8 2019: $4004.12

Bitcoin price in USD on January 8 2020: $8045.51

But Bitcoin has increased by 100% over the past year.

I’ll give $1 for a 0.01% share.

I'll buy an option to take a 0.01% share in 12 months for $0.50

I am sure, in the past, one of the domain registrars took the liberty of actually registering your searched domain, deliberately, so that you had to go through them to get the domain later on? - I can't remember who it was, but it was an automated process.

I know it was very shortly stopped once people complained, but it goes to show that it has been done before.

Getting rich off domain's - sounds like a solid business plan!

I've got no evidence except anecdptes, but I've heard claims that GoDaddy used to do this a lot. For this reason I've only searched a domain I was going to immediately buy, otherwise I'll do a whois lookup to see if it's registered.

Just looked about and found these:

"Does GoDaddy register domains you search?" (2011) https://news.ycombinator.com/item?id=2326790

Within this, was the comment that reminded me which company it was I was talking about (https://news.ycombinator.com/item?id=2327152) - Network Solutions used to do this - and there is a Wiki link in there which gives the process a name! TIL! :)

https://en.wikipedia.org/wiki/Domain_name_front_running

I remember something about registrars doing this so the domain you wanted wouldn't get snatched by someone else while you were in the process of buying it. Made more sense back in the time when far more basic names were available and such collisions were probably common for high-value domain names. Now it's two people finding the same needle in a haystack.

I knew a guy named pachell that did this from 1997-2001 until registrars changed the rule. pachell wherever you are, i miss you

hahahaha, the webpage redirects to this discussion!! WELL PLAYED!!! (sorry for the caps.. but wow!)

YW ;)

The squatters do a thing called "Domain tasting".

They buy domain X and then they put generic advertising, maybe keyword based, on a cheap bulk hosted site. They measure for a few days - is this bringing in lots of revenue? If not, they cancel the purchase, using a "grace period" available to users of the registry in case of mistakes - the purchase is unwound and they are refunded the fees. Domain X is now available again.

In principle this is forbidden for major TLDs but it's still possible and unscrupulous vendors help them do it, albeit it may now attract a fee if you do it enough that the TLD registry detects you tasting.

https://en.wikipedia.org/wiki/Domain_tasting explains about this and related practices.

There are slight transaction costs of $0.18 - $0.20 that is not refundable. Miniscule, but it prevents some domain tasting at scale.

>The advice I've seen is to not search for the domain first, just register it outright from the start. The domain registration business is run with all of the integrity and customer focus of TicketMaster.

What if you don't want to cough up $10-$20 on a whim? Would doing a whois (using the NIC's whois site) suffice?

I use the whois command line tool when searching and have yet to get squatted. My experience is only about 500 domains over 20 years.

If I understand the domain name infrastructure correctly, that would imply that it's the registrar who is collaborating with the squatters. A command-line whois query would still have to query the servers of the registry for a particular domain (others on this thread speculate that it may be the domain registry that shares data with the squatters).

Curious about this as well. When you query the servers of the registry [gandi, namecheap, godaddy] for a particular domain example.com, doesn't it update the one of the datetime fields for last queried?

Then again, the squatter would have to know what to search. Isn't it against rules for domain registrars to publish their recent query history [private or public]?

Any more light on this subject would be greatly appreciated!

i use host -t NS cooldomain.example as a pre-filter. If a domain has NS records, it's definitely registered, although there are some registered domains without NS records (makes them pretty much nonfunctional, but if that's what the registrant wants, it's their business)

This is a neat trick, thanks. Adding to my toolbox

I've had this same scenario happen before, and since then I just issue a `whois` from the command line to bypass any potential frontend interception. Not sure if that is 100% full proof either though.

I have used whois cli since the early 2000s because I did not trust the registrars as domains I just searched ended up being registered. Never had that issue again since then.

Isn't the WHOIS query sent unencrypted? Can't it be intercepted in that case?

Doing an OOB whois search is almost certainly fine. It's when you search on godaddy.com or whatnot that you get burned.

What is an "OOB whois search"?

Out of Band. Registrars cannot intercept whois searches?

On Namecheap they have a "save for later" button per domain in your cart, so you can just pile them up for later.

Never had even 1 of my "saved for later" being squatted, for several years now, so I really have to trust and commend namecheap in that regard.

Reply on news.ycombinator.com