27

I recently registered a .com domain name though a well known registrar. I made the mistake of adding my phone number to the domain.

The domain name is fairly obscure, and I registered it for an extended period (5 years). There is no publicly accessible website associated with the domain name, and I control the DNS servers (and mail servers).

In the 24 hours after registering the domain name I've received 2 unsolicited calls from third parties trying to sell me web design services. They lie/speak garbage when asked how they discovered this information.

My question is this - How are they discovering the domain name registration? Is there a public/semi-public database they are using, is my registrar selling this information or something else? Do the .com root nameservers create a record and sell data of requests made against them?

  • 9
    I have 3 *.com domains and 5 *.de domains... all with my full address, mail and phone number... never got a letter, mail or call... – Mischa Oct 13 '17 at 8:57
  • 7
    @MischaBehrend you're very lucky. As for davidgo: sign up for a separate/new Google account, and set up Google Voice on it -- do NOT forward the number to your actual phone, but just have it forward text/voice messages to the new email. Then use the new Google email and Voice # in your WHOIS data and you can still receive legit messages but now YOU get to choose when you have to sift through the crap. Also be prepared for the inevitable snail-mail spam: dcsny.com/technology-blog/idns-domain-registrar-scam – Doktor J Oct 13 '17 at 14:21
  • I've had a solid handful of domains registered for decades with a number I've kept for that same length of time, and have yet to receive and unsolicited call regarding domain/web services. Then again, I don't know what magic Google Voice does to protect me from spam callers. – music2myear Oct 13 '17 at 23:49
  • 1
    In my experience it's ramped up in recent years. Nowadays a new domain gets me maybe 25 phone calls and 50 emails in the following weeks. Web design, logo design, business advertising. – Matt Nordhoff Oct 14 '17 at 5:18
  • 1
    @AndreaLazzarotto But any idea how they know to look up a domain that was just registered? – I say Reinstate Monica Oct 14 '17 at 17:27
39

Every domain is required by ICANN to have a WHOIS entry, which among other things, includes the name, address, email, and phone number information of the domain's registrant, administrative, and technical contacts. While it's against the rules (section 3.3.5) to use this for marketing purposes, it's done all the time. It's partly for this reason that many domain registrars offer a "privacy" service whereby they act as a communication proxy for the domain's actual contacts.

There is no central WHOIS database, so I'll be honest I don't know how they find newly created domains*. While WHOIS records do contain information about when the domain was created, last updated, etc., I'm not aware of a way to query a WHOIS database based on these fields. But then I'm not a spammer either...

According to ICANN's website handling complaints about abuse of WHOIS data is outside their authority and they suggest you seek other methods to deal with the problem:

Spam complaints are outside of ICANN's scope and authority; for these types of complaints, please refer to one of the options listed below:

  • You may want to contact a law enforcement agency in your jurisdiction
  • You may want to file a complaint with a consumer protection entity such as the International Consumer Protection and Enforcement Network or the US Federal Trade Commission
  • You may want to contact the spammer's Internet Service Provider
  • You may want to contact the registrar of the spammer's email

If it's any consolation I've registered my fair share of domains and my experience has been the phone calls and spam email come to an end rather quickly.


*I did a quick Google search and discovered a number of services offering bulk access to WHOIS data.

  • Thank you for your email. I was aware of the who's database and it's contents but was unaware that ICANN let's it be abused (after reading whois.icann.org/en/primer I'm pretty sure that this is how the data is being acquired. ) – davidgo Oct 13 '17 at 5:39
  • 3
    @Seth, except for their statement "Under the ICANN contracts, WHOIS can be used for any legal purpose except to enable mass unsolicited, commercial advertising or solicitations, or to enable high volume, automated, electronic processes that send queries or data to a registry or registrar's systems, except as necessary to manage domain names." – davidgo Oct 13 '17 at 8:39
  • 1
    My first thought on how they discover new addresses would be bruteforce - automatically run whois queries on random strings, random words (from a dictionary API, say), or a combination of both, and logging the responses. Though I have no idea if that's how its actually done. Could be a bunch of people in a room manually typing in random whois queries for all I know. – CGriffin Oct 13 '17 at 13:55
  • 1
    You can also do a whois com -L or similar query to get lists of data from a whois server – PlasmaHH Oct 13 '17 at 14:20
  • 2
    @davidgo it's worth noting that "can be used", here, likely means "you are allowed to do this without getting in trouble". It does not mean "it is physically impossible to spam, but other things are possible". That might be why the spammers were hesitant to tell you exactly how they acquired your contact details. – Ethan Kaminski Oct 13 '17 at 17:20
1

Each gTLD registry is mandated through its ICANN contract to provide its zonefiles.

The zonefiles list all published domain names, which is almost all domain names in the TLD, but not all: this excludes domain names without nameservers (a totally legit case, you can sometimes wish to protect a name without associating it with any online service), or domain names being "on hold" (the EPP statuses clientHold or serverHold that remove the domain names from publication).

You can do a search on CZDA to find the online platform that will enable anyone, for free, upon accepting a contract, to be able to grab any gTLD zonefile, that are updated each day.

So, it is very easy that way to get a list of domain names, if you do it 2 days in a row you can compute the difference and find the newly added domain names (which would basically be the newly registered domain names, with some exceptions for the reasons outlined on top), and then do whois queries to grab the contact data associated to these domains and then contact people.

Note that when you access the CZDA you are signing a contract that enforce some rules on what you can or can not do with the data. I am not sure that the activity described here falls into the acceptable case of the contract, but I am not a lawyer and this is extremely difficult to respect. Anyway, it is trivial technically.

ccTLDs most often do not provide access to their zonefiles. Some of them (like .FR) just provide each day the list of newly registered domain names. Which puts you back exactly at the previous step when you computed the difference of two zonefiles, and then enables you to contact people in the same way.

Also, and completely unrelated, if you read carefully the ICANN registrars contract (so again only for gTLDs) you will find inside a clause showing that the registrars have to sell their full database of names + contact data in some specific cases. This is costly ($10 000 per registrar!) but can also be a way to get the data.

A way to protect yourself against all of these solicitations is to register your domain names with privacy/proxy services so that your personal data never appears in whois output. This is offered by many registrars, and will become more and more the norm, due to new regulations about data privacy for individuals, like the GDPR in European Union.

0

You have received many good answers already but I think my experience indicates this information is being sold on a grand scale at a very fundamental level of access. I registered 3 domains 6mo ago and received about 50 telemarketing calls. 3mo later I moved and updated my ICANN information - it immediately triggered another volley of marketing calls. So, it seems the information is immediately available and triggered with any changes :(

This is so blatant and consistent as to make me believe the information is immediately available directly from ICANN and/or the name registration entities, either deliberately or through negligence. It's quite probable the name registrars are actively black marketing the information or at least negligent in protecting it.

Even after the last update 3mo ago I continue to receive 1-2 calls a day. In the future, I will use expired or message only phone numbers. (I have a magic jack number I no-longer use, or I could use a google voice number that is no-longer in use.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.