   Public Service Announcement: Domain Tasting
This is a public service announcement for anyone thinking of registering a TLD.A couple of weeks ago I did a bit of "domain window shopping" for a top-level domain I wanted for my startup BREW/J2ME game company. The domain (which I won't reveal, since I don't have a product ready yet) was something totally unique that I made up and that no one else had used before me. So, I do a whois search on it, see that [my name].com is still available, and go ahead and decide not to buy it.Little did I know, since the last time I bothered registering a TLD (a few years ago), a little automated scam known as Domain Tasting started going on. My whois search was logged, and the domain I window shopped for was registered by a bot run by someone who buys domain names in bulk (eg: pays $6000 up front for about 1000 domains). So basically, these people get whois search logs, use a bot to register every available searched-for name they can, and put Google/Yahoo ad pages on there and fish for clicks. They also occasionally try to extort people who want the domains for legitimate purposes (I'll get to that later).The reason domain tasting is such a recent phenomenon is because of a ratification to the ICANN rules back in 2003, which allows for a five day grace period during which a registrant can unregister a domain and get a full refund, incase he misspells his name or something. Domain tasters use this to automatically drop ad page sites that aren't profitable. This change to the rules was not discussed, debated upon, or anything. Someone at ICANN just added it in there and no one contested it.So back to my little tale. I was shocked to see that someone had registered my domain just a few hours after I searched for it. So, I looked at the whois data, and saw the name of a fairly prolific domain taster. I didn't know anything about domain tasting at the time, so I mistakenly thought that maybe this guy was an honest fellow who mistakenly registered my name for whatever reason. His home page looked innocent enough. It was nice and clean and slick looking, no popups or porn ads, and it had a friendly message at the bottom that said, "If you believe a domain I registered is infringing on your valid copyright, please contact me at contact@[whateverthisguysnameis].com." So like an idiot I contacted him, because I do have a registered trademark for my name, and after several days he got back at me offering the domain to me for $900 (to "cover my costs," he says. He needs $900 to cover the cost of a $6 domain? Yeah, right!). I just ignored him and hoped he would forget all about me. Turns out, I'm not by far the only one he's tried to get exactly $900 out of.So at this point, stacks of smoke are fuming out of my ears and I'm about ready to cry, thinking this guy stole [mybusinessname].com away from me and there was nothing I could do about it. In between that time, I Googled his name and learned a bit about the scam he was running. I found an article by Bob Parsons of godaddy.com which described the scheme, as well as blogs and forum posts from several other victums of this guy specifically. Turns out that, according to Parsons, this is a problem for registrars too, because of the many domains that get registered under this scheme, only about 10 percent of all domains registered on the entire Internet are retained past the five day period. And all this has just happened within the year. It's tying up domains that people have legitimate usage purposes for, and potentially costing registrars a lot of money. Misspelled domains generally aren't a problem, especially compared to the even bigger problem that has arisen out of the introduction of the five day grace period.The scammer, for some reason, decided to not risk wasting the $6 (since my name was so unique, he wouldn't get any ad clicks anyway; it's virtually worthless to anyone except me) and got his refund and unregistered it, allowing me to scoop it back up again before he or someone else could tie it up in their domain tasting scheme (if I'm in his bot's registry, I'm sure I'm in a bunch of other peoples). So, I was able to finally get my domain, after a big scare thinking that this guy was going to hold it up for a year or more, prevent me from doing business during that time, and potentially run some other schemes through that domain, getting my name blacklisted from various Internet filtering services along the way. Still, five or more days of deferred business, or worse, having to potentially change stationary, business registration, and trademarks for your company, could have a devastating effect, so I felt the need to warn my fellow game developers about this problem which I was totally unaware of. The only solution at the moment seems to be not doing a whois search until you're absolutely ready to buy the domain you're after at that moment (which isn't a huge deal, since they're so remarkably cheap these days. I was just ignorant of the fact that someone was looking at my domain searches and using them for ad clicks and extortion).Don't expect ICANN or anyone else to help you out on this either. It's ridiculous that they made that rule change anyway as it helps virtually no one, but they've shown no interest in revoking it. If you're doing whois searches on available names, and someone (often the same entity) registers them all within a few days or hours, you've been hit by domain tasting. After that, the best you can hope for is using one or more monitoring services to snatch the domain back from the scammer after the five day drop period, and, though I was lucky in spite of my airheadedness, you should obviously not contact these people and express interest in the domain they've pulled from under your feet. Again, the best way to avoid this is by not window shopping for domains, and just getting them as soon as you search for them.On a lighter note, after I got mine back, I responded to the gentleman who tried to milk $900 I don't have out of me:"Funny thing, I actually had the check written out and was ready to pay you the $900 for the domain, but then I logged into my domain backordering service and discovered that I already had it! Well, thanks anyway. Good luck on your domain scam, I hope it goes very well for you."   
  As much as I don't like the sound of "domain tasting" it does strike me as a rather clever way of making money [oh]Any idea how they manage to get the search logs for whois? I'm no expert on those sorts of things, but I would've thought that you'd have to have whois's or your ISP's permission to get that info?Jack   ;  This is why I whois only on Godaddy.com   ;  Wow that is quite a scam... thx for the warning I never would have seen it coming.   ;Quote:Original post by jollyjeffersAny idea how they manage to get the search logs for whois? I'm no expert on those sorts of things, but I would've thought that you'd have to have whois's or your ISP's permission to get that info?That's something that I'm still unclear of. I don't even know how or why that kind of information would be publically available for domain tasters.Quote:Original post by MaegaThis is why I whois only on Godaddy.comI don't recall having performed a whois on any site other than GoDaddy.com, actually. I could be mistaken, though. Bob Parsons claims in his blog that Go Daddy doesn't facilitate any of this, so I must have been careless and done a search through some shady whois site by mistake. Still, I'm not sure, so a good general rule of thumb would just be not searching until you're ready to buy. That's what I'm doing from now on, regardless of who I search with.   ;  Just make sure you're not buying from just anyone. I've lost 2 domains due to hosting companies crumbling and selling off my domains.They still aren't unregistered after 3 years [lol].   ;Quote:Original post by jollyjeffers[...]Any idea how they manage to get the search logs for whois? [...]It's not that they 'get the logs', it's that they record when you type your idea into their box. At least, this is the way many people loose domains (by using a not-reputable site for whois searches).I use the command-line tool from SysInternals.Net and I've never had a problem.   