.com registration details leaked

I recently registered a .com domain name though a well known registrar. I made the mistake of adding my phone number to the domain.

The domain name is fairly obscure, and I registered it for an extended period (5 years). There is no publicly accessible website associated with the domain name, and I control the DNS servers (and mail servers).

In the 24 hours after registering the domain name I've received 2 unsolicited calls from third parties trying to sell me web design services. They lie/speak garbage when asked how they discovered this information.

My question is this - How are they discovering the domain name registration? Is there a public/semi-public database they are using, is my registrar selling this information or something else? Do the .com root nameservers create a record and sell data of requests made against them?

davidgo

Posted 2017-10-13T04:42:39.860

Reputation: 49 152

9I have 3 *.com domains and 5 *.de domains... all with my full address, mail and phone number... never got a letter, mail or call... – Mischa – 2017-10-13T08:57:35.740

@MischaBehrend you're very lucky. As for davidgo: sign up for a separate/new Google account, and set up Google Voice on it -- do NOT forward the number to your actual phone, but just have it forward text/voice messages to the new email. Then use the new Google email and Voice # in your WHOIS data and you can still receive legit messages but now YOU get to choose when you have to sift through the crap. Also be prepared for the inevitable snail-mail spam: http://www.dcsny.com/technology-blog/idns-domain-registrar-scam/

– Doktor J – 2017-10-13T14:21:25.710

I've had a solid handful of domains registered for decades with a number I've kept for that same length of time, and have yet to receive and unsolicited call regarding domain/web services. Then again, I don't know what magic Google Voice does to protect me from spam callers. – music2myear – 2017-10-13T23:49:18.163

1In my experience it's ramped up in recent years. Nowadays a new domain gets me maybe 25 phone calls and 50 emails in the following weeks. Web design, logo design, business advertising. – Matt Nordhoff – 2017-10-14T05:18:48.133

“How are they discovering the domain name registration?” whois yourdomain.com in any terminal, I guess. – Andrea Lazzarotto – 2017-10-14T10:31:15.990

1@AndreaLazzarotto But any idea how they know to look up a domain that was just registered? – I say Reinstate Monica – 2017-10-14T17:27:18.967

Downloading and diffing the .com zone file on a daily basis, maybe? (Excludes domains with no nameservers, but good enough.)

– Matt Nordhoff – 2017-10-14T19:54:46.687

Answers

Every domain is required by ICANN to have a WHOIS entry, which among other things, includes the name, address, email, and phone number information of the domain's registrant, administrative, and technical contacts. While it's against the rules (section 3.3.5) to use this for marketing purposes, it's done all the time. It's partly for this reason that many domain registrars offer a "privacy" service whereby they act as a communication proxy for the domain's actual contacts.

There is no central WHOIS database, so I'll be honest I don't know how they find newly created domains*. While WHOIS records do contain information about when the domain was created, last updated, etc., I'm not aware of a way to query a WHOIS database based on these fields. But then I'm not a spammer either...

According to ICANN's website handling complaints about abuse of WHOIS data is outside their authority and they suggest you seek other methods to deal with the problem:

Spam complaints are outside of ICANN's scope and authority; for these types of complaints, please refer to one of the options listed below:

You may want to contact a law enforcement agency in your jurisdiction

You may want to file a complaint with a consumer protection entity such as the International Consumer Protection and Enforcement Network or the US Federal Trade Commission

You may want to contact the spammer's Internet Service Provider

You may want to contact the registrar of the spammer's email

If it's any consolation I've registered my fair share of domains and my experience has been the phone calls and spam email come to an end rather quickly.

*I did a quick Google search and discovered a number of services offering bulk access to WHOIS data.

I say Reinstate Monica

Posted 2017-10-13T04:42:39.860

Reputation: 21 477

Thank you for your email. I was aware of the who's database and it's contents but was unaware that ICANN let's it be abused (after reading https://whois.icann.org/en/primer I'm pretty sure that this is how the data is being acquired. )

– davidgo – 2017-10-13T05:39:19.137

It's a public entry for third parties to contact you meant to give them an option to contact your if something with your site is off or for business. So it's not really ICANN that lets it being abused but rather those that contact you. The primer is pretty good on that. – Seth – 2017-10-13T08:28:18.753

3@Seth, except for their statement "Under the ICANN contracts, WHOIS can be used for any legal purpose except to enable mass unsolicited, commercial advertising or solicitations, or to enable high volume, automated, electronic processes that send queries or data to a registry or registrar's systems, except as necessary to manage domain names." – davidgo – 2017-10-13T08:39:51.760

Yes but its not a legal reason and your local registry can actually have other requirements for the usage of that data. If I take my local ccTLD it expressively reads: It is not permitted to use it for any purpose other than technical or administrative requirements associated with the operation of the Internet or in order to contact the domain holder over legal problems. ... It is prohibited, in particular, to use it for advertising or any similar purpose. Another question would be how its handled if you access that data through a third party that first had to agree to those terms. – Seth – 2017-10-13T08:56:02.283

1My first thought on how they discover new addresses would be bruteforce - automatically run whois queries on random strings, random words (from a dictionary API, say), or a combination of both, and logging the responses. Though I have no idea if that's how its actually done. Could be a bunch of people in a room manually typing in random whois queries for all I know. – CGriffin – 2017-10-13T13:55:03.530

1You can also do a whois com -L or similar query to get lists of data from a whois server – PlasmaHH – 2017-10-13T14:20:46.610

2@davidgo it's worth noting that "can be used", here, likely means "you are allowed to do this without getting in trouble". It does not mean "it is physically impossible to spam, but other things are possible". That might be why the spammers were hesitant to tell you exactly how they acquired your contact details. – Ethan Kaminski – 2017-10-13T17:20:39.223

"'ll be honest I don't know how they find newly created domains" this is trivial, see my answer for details. And you are right that you can not query (domain name) whois servers on anything else than a domain name (or a contact id or a nameserver name or IP but all of these cases are irrelevant here) – Patrick Mevzek – 2018-04-06T05:50:49.667

Each gTLD registry is mandated through its ICANN contract to provide its zonefiles.

The zonefiles list all published domain names, which is almost all domain names in the TLD, but not all: this excludes domain names without nameservers (a totally legit case, you can sometimes wish to protect a name without associating it with any online service), or domain names being "on hold" (the EPP statuses clientHold or serverHold that remove the domain names from publication).

You can do a search on CZDA to find the online platform that will enable anyone, for free, upon accepting a contract, to be able to grab any gTLD zonefile, that are updated each day.

So, it is very easy that way to get a list of domain names, if you do it 2 days in a row you can compute the difference and find the newly added domain names (which would basically be the newly registered domain names, with some exceptions for the reasons outlined on top), and then do whois queries to grab the contact data associated to these domains and then contact people.

Note that when you access the CZDA you are signing a contract that enforce some rules on what you can or can not do with the data. I am not sure that the activity described here falls into the acceptable case of the contract, but I am not a lawyer and this is extremely difficult to respect. Anyway, it is trivial technically.

ccTLDs most often do not provide access to their zonefiles. Some of them (like .FR) just provide each day the list of newly registered domain names. Which puts you back exactly at the previous step when you computed the difference of two zonefiles, and then enables you to contact people in the same way.

Also, and completely unrelated, if you read carefully the ICANN registrars contract (so again only for gTLDs) you will find inside a clause showing that the registrars have to sell their full database of names + contact data in some specific cases. This is costly ($10 000 per registrar!) but can also be a way to get the data.

A way to protect yourself against all of these solicitations is to register your domain names with privacy/proxy services so that your personal data never appears in whois output. This is offered by many registrars, and will become more and more the norm, due to new regulations about data privacy for individuals, like the GDPR in European Union.

Patrick Mevzek

Posted 2017-10-13T04:42:39.860

Reputation: 1 334

You have received many good answers already but I think my experience indicates this information is being sold on a grand scale at a very fundamental level of access. I registered 3 domains 6mo ago and received about 50 telemarketing calls. 3mo later I moved and updated my ICANN information - it immediately triggered another volley of marketing calls. So, it seems the information is immediately available and triggered with any changes :(

This is so blatant and consistent as to make me believe the information is immediately available directly from ICANN and/or the name registration entities, either deliberately or through negligence. It's quite probable the name registrars are actively black marketing the information or at least negligent in protecting it.

Even after the last update 3mo ago I continue to receive 1-2 calls a day. In the future, I will use expired or message only phone numbers. (I have a magic jack number I no-longer use, or I could use a google voice number that is no-longer in use.)

jwzumwalt

Posted 2017-10-13T04:42:39.860

Reputation: 268