WhoIs Searches May Be Compromised

SAN FRANCISCO — Domain name queries may be compromised, according to eWeek.com columnist and Internet security expert Larry Seltzer, who believes that a shady cyber squatter is monitoring queries and registering domains before prospective site owners get a chance to do so.

Seltzer began his investigation after an email from a reader who complained that a company known as Chesterton Holdings had registered her query, placed a landing page at the domain and then dumped the site several days later only after seeing poor traffic results.

The Chesterton Holdings site, which gives virtually no information about the company or its owners, offers visitors the following description of its services:

"We acquire domain names through an automated process rather than by any process that would intentionally infringe on any person's rights. If you have any questions about a domain, please submit your query to us below. It is our policy to transfer a domain name to any entity that, in our reasonable opinion, has a legitimate claim. We will promptly transfer a domain name to you if you can show us that you have a legitimate claim."

According to Seltzer, his concerned reader had used CNET’s domain search page, which offers meta-search results from several services, including Web.com, Dot.FM, Enic.cc and APlus.net.

Seltzer ran his own domain queries using the same methods, finding that in less than 30 hours Chesterton Holdings had registered his queries.

A call placed by Seltzer’s reader to APlus.net suggested that Chesterton monitors WhoIs queries, something that Seltzer believes to be impossible.

Seltzer contacted CNET to inform them of the problem. While neither he nor CNET had any concrete answers, Seltzer decided to post.

“With a whole lot more testing, I think I could figure out the source of Chesterton's domain name feed, but I decided it was time to get the story out first,” he said.

Seltzer posited four theories on how Chesterton had accessed the WhoIs queries:

  • “CNET, or someone at CNET, could be passing the requests on to Chesterton. I don't believe this for a second.”
  • “One of the hosting services that CNET is checking with (and there could be more than they indicate) could be passing data on to Chesterton. This seems unlikely to me.”
  • “Chesterton could have compromised one of the servers involved in the process, for instance the WhoIs server used by one of the hosting services. This seems possible to me. There are a number of other hacking techniques, DNS cache poisoning for example, that could indirectly give Chesterton access to data from these queries.”
  • “Verisign could be passing the data on to Chesterton. I don't believe this, either.”
  • An XBIZ story in May reported that add/drop domain registration schemes were on the rise, according to GoDaddy.com CEO Bob Parsons. Practitioners of the schemes take advantage of the five-day window before they are charged for the domain, meaning that a company such as Chesterton, if Seltzer’s allegations are correct, could register compromised queries without incurring any registration costs.

    Despite Seltzer’s efforts the mystery remains.

    “Even though I've speculated on possibilities that are more or less likely than others, I don't think I'm close to a definitive explanation,” he said. “All I really know is that there's no legitimate way to do what Chesterton Holdings is doing, and I hope they finally get called for it.”

    Copyright © 2024 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
    Reproduction in whole or in part in any form or medium without express written permission is prohibited.

    More News

    More Conservative Organizations Distance Themselves From Anti-Porn Project 2025

    A growing list of conservative groups which had formerly endorsed Project 2025 — which calls for the total criminalization of adult content production and distribution — have reportedly distanced themselves from the blueprint, following Donald Trump’s claims that he disagrees with an unspecified number of its positions.

    BranditScan Unveils Protection Plan for Adult Studios

    BranditScan has launched a new content protection plan tailored specifically for adult studios.

    CAM4 Debuts Weekly 'Skyy Knox's CAM Crawl' Livestream

    CAM4 is launching "Skyy Knox’s CAM Crawl," a new livestream running every Sunday at 3 p.m. PDT.

    Texas Judge Pauses AG Ken Paxton's Aylo Lawsuit Until SCOTUS Decision

    A Texas district judge granted a request Wednesday to pause proceedings in the lawsuit filed by Attorney General Ken Paxton against Aylo over Pornhub’s alleged failure to implement Texas’ controversial age verification requirements, pending the outcome of the Free Speech Coalition-led lawsuit against Paxton, which will be heard by the Supreme Court during the next term.

    Author of UN Report Recommending Worldwide Criminalization of Sex Work, Porn to Speak at NCOSE Summit

    Jordanian activist Reem Alsalem, a special rapporteur on violence against women and girls at the United Nations Human Rights Council who recently issued a controversial report recommending that governments abolish all forms of sex work, including porn, will speak at anti-porn lobby NCOSE’s 2024 summit in August.

    Spicey AI Voice Chat Platform Launches

    Spicey AI, a platform that uses artificial intelligence to create interactive voice messages from chatbots based on adult performers, has launched.

    Utherverse to Host 8th Annual VirtualCon in September

    Virtual reality and metaverse technology company Utherverse will hold the eighth edition of its annual virtual conference, VirtualCon, from Sept. 26-28.

    Pornhub Shuts Down Access in Nebraska Over Age Verification

    Aylo began blocking access to Pornhub in Nebraska on Monday, in anticipation of the state’s new age verification law — one of many such bills promoted by religious conservatives around the country — which is scheduled to go into effect Thursday.

    FeelMe AI Launches 3 New Subscription Tiers

    FeelMe AI has launched three new subscription levels, allowing users to connect compatible Kiiroo sex toys to their videos for interactive solo play.

    CamSoda Launches AI Girlfriend Builder

    CamSoda has debuted a personalized "AI girlfriend" feature, which allows users to create their very own virtual companion at no charge, including free NSFW role-play and chat.

    Show More