For Sale Suspicious Activity

[clemzonguy]

I have been looking through deleteddomains to see new registrations. I had not looked for a while so I was looking at some older dates during this past month. On a few occasions I have seen misspelled names showing up as having been registered however when looking at the whois the name no longer exists. I suspect there is a company who is registering mispellings to see if they have traffic since the DNS features are now immediate (!) and getting a refund if there is no traffic within a small window of time. I have not yet figure out what company is doing this but I know that it now has been going on due to these odd registrations. Think how much money they would save doing this.

Anyone else following this and know the identity of the company or individuals who are taking part in this activity?

 

[HLK]

Pretty interesting...

 

[Steen]

I have been looking through deleteddomains to see new registrations. I had not looked for a while so I was looking at some older dates during this past month. On a few occasions I have seen misspelled names showing up as having been registered however when looking at the whois the name no longer exists. I suspect there is a company who is registering mispellings to see if they have traffic since the DNS features are now immediate (!) and getting a refund if there is no traffic within a small window of time. I have not yet figure out what company is doing this but I know that it now has been going on due to these odd registrations. Think how much money they would save doing this.

Anyone else following this and know the identity of the company or individuals who are taking part in this activity?

Done it before.

Don't see what's wrong with it.

 

[phrone]

I think it's business. Pretty damn good idea I think..

 

[Frontline]

How could they get a refund though?

 

[Steen]

How could they get a refund though?

Registrars have a 5 or 6 day refund period.

 

[clemzonguy]

Then can someone please direct me to a registrar where I can take advantage of this where it is automated?

 

[BLazeD]

^^^ me 2

 

[actnow]

Registrars have a 5 or 6 day refund period.

This is true.

However, It requires the registrar to do a lot of manual work.

I have asked Enom to do it two times over the past two years.
And, they make it difficult.

 

[clemzonguy]

This is true.

However, It requires the registrar to do a lot of manual work.

I have asked Enom to do it two times over the past two years.
And, they make it difficult.

I had it happen one time and they refunded the name.

I suspect these people either have registrar accounts with imaginary funds (that has already been prepaid and there is simply a credit/debit action taken) or they are working hand in hand with a registrar for this purpose. The problem is that I cannot yet establish who the identity is because once the domain is deleted so is any WHOIS record. I did not notice a high volume but I do not have an all-emcompasing view only the keyword that I was searching. Please flag any mispellings in markets you watch and let's see if we can sniff out the culprits.

 

[Steen]

Then can someone please direct me to a registrar where I can take advantage of this where it is automated?

Get a registrar partner.


I beleive PSI may be accepting.

Don't count on it being cheap though.

 

[NickM]

Registrar's have a 120 hr delete period where the registry fee is refunded.

I can get this done for any person who wants the facility. 96 hr delete period with $1 fee i.e if the domain is deleted within 4 days, you will get a $ knocked off from your refund.

Contact me

 

[Nameable]

cnobin.com lists it as a product, though I haven't tried it there yet.

From what I've heard the practice of regging and quickly deleting is heavily discouraged. I had a partner lined up who wanted to do this on a large scale and the registrars I asked said "no" - seems they thought the registry would take action against them for doing it too much.

 

[chatcher]

The problem is that I cannot yet establish who the identity is because once the domain is deleted so is any WHOIS record.

You could collect zone files over a few days, then when you see one deleted look back a day to see what the name servers were. That might help track down the registrar or maybe even the registrant.

 

[avs162]

i believe vgrs will stop the activity party once the percentage of deletions vs regs exceeds a threshold or detected

this is not new and has been going on for long time its just become more attractive with the rapid dns

it is not prohibited due to traffic minning but due to the abuse of the delete privlege which is meant for mistakes and non payment

problem is vgrs doesnt see this data for month or quarter or whatever time period and register will get away with it for month or more and some may not even realize that it is an issue with the registry

at least this is what i have heard

 

[larry4]

i believe vgrs will stop the activity party once the percentage of deletions vs regs exceeds a threshold or detected

this is not new and has been going on for long time its just become more attractive with the rapid dns

it is not prohibited due to traffic minning but due to the abuse of the delete privlege which is meant for mistakes and non payment

problem is vgrs doesnt see this data for month or quarter or whatever time period and register will get away with it for month or more and some may not even realize that it is an issue with the registry

at least this is what i have heard

This is true. VeriSign has and enforces a very strict policy regarding excessive deletes.

 

[DropWizard.com]

It is against registry rules to do massive registers and deletes. The facility is only supposed to be used for deleting mistakes.

Although I have never actually heard of Verisign taking action against offending registrars.

 

[clemzonguy]

Think I found the culprit (at least one of them).
However, looks like they are trying to hide.
The registrar was ITSYOURDOMAIN.COM but you cannot tell who registered it.
Since they are associated with NameFox it reeks already lol.

Registrant
SecureWhois, Inc.
SecureWhois, Inc.
[email protected]
904 S. Roselle Road #136
Schaumburg, IL 60193 US
+1.6306727455

 

[Donny Simonton]

Think I found the culprit (at least one of them).
However, looks like they are trying to hide.
The registrar was ITSYOURDOMAIN.COM but you cannot tell who registered it.
Since they are associated with NameFox it reeks already lol.

Yes, I can verify it is/was itsyourdomain.com. And they are the registrar.

This has been discussed on the registrar list last week.

Donny

 

[Dave Zan]

Yes, I can verify it is/was itsyourdomain.com. And they are the registrar.

This has been discussed on the registrar list last week.

Donny

Was anything done to IYD for it?

Registrar list?