How I hijacked the top-level domain of a sovereign state • Hacker News Board

Re: How I hijacked the top-level domain of a sovereign state

#61

Post by random5634 » Sat, Jan 16, 2021, 1:08 AM UTC

CydeWeys wrote: post #23

yaveti wrote: post #13

Earlier quoted context omitted.

It's not uncommon for organisations to be late with renewing their domains and you probably don't want to send false alarms.

Once it's in the redemption grace period the domain is already on the way to deletion. That's not part of the normal domain lifecycle; that's part of the deletion lifecycle. This was not a false alarm.

You clearly have never ever worked in domain renewals before. Many people only renew once dns stops resolving. I've seen govt agencies use this as their reminder to renew.

And yes, many scammers out there send postcards to businesses offering to assist for $1,000 on the renewals - and many people pay. So people do send out "alerts" the way you ask - most commonly exploitive and at least I give the advice to ignore ALL such renewal alerts. If you are telling people to respond to those you are sending people down scam ally.

Re: How I hijacked the top-level domain of a sovereign state

#62

Post by soonnow » Sat, Jan 16, 2021, 9:59 AM UTC

howlgarnish wrote: post #59

Tepix wrote: post #44

Earlier quoted context omitted.

According to tld-list.com, the .th TLD is the most expensive ccTLD at $5000 and .ru is the cheapest at $2.99

Top-level .th (Thailand) is very expensive, but .co.th is reasonable ($50/yr).

But you do need to have a registered business in Thailand with the exact name as the domain name to register the domain.That's a fact for co.th, I'm not sure about .th though, but I would assume it to be true.

Re: How I hijacked the top-level domain of a sovereign state

#63

Post by CydeWeys » Sat, Jan 16, 2021, 2:06 PM UTC

random5634 wrote: post #61

CydeWeys wrote: post #23

Earlier quoted context omitted.

Once it's in the redemption grace period the domain is already on the way to deletion. That's not part of the normal domain lifecycle; that's part of the deletion lifecycle. This was not a false alarm.

You clearly have never ever worked in domain renewals before. Many people only renew once dns stops resolving. I've seen govt agencies use this as their reminder to renew. And yes, many scammers out there send postcards to businesses offering to assist for $1,000 on the renewals - and many people pay. So people do send out "alerts" the way you ask - most commonly exploitive and at least I give the advice to ignore AL…

> Many people only renew once dns stops resolving.

DNS stops resolving because the domain is pending deletion. At that point it's not a renewal, it's a restore (which costs a lot more money). Refer to the brown "Domain no longer in zone" section of ICANN's lifecycle chart: http://archive.icann.org/en/registrars/gtld-lifecycle.jpg If people are actually regularly using restores instead of renews then they're unnecessarily throwing away lots of money.

> I've seen govt agencies use this as their reminder to renew.

What TLDs were these government agencies using? gTLDs have uniform policies but ccTLDs and special purpose TLDs like .gov do not (and you cannot generalize your experience there to gTLDs). But the expired nameserver domain registration under discussion in this article is a .com, which is a gTLD, so it goes through the standard lifecycle of 30 day redemption grace period + 5 day pending delete period, and during these its DNS is yanked.

Source: I've been in the domains industry for 7 years and run 44 TLDs.

Re: How I hijacked the top-level domain of a sovereign state

#64

Post by Leherenn » Sat, Jan 16, 2021, 9:06 PM UTC

hsbauauvhabzb wrote: post #53

dougk wrote: post #17

I had a gut feeling it will be '.cd' before clicking on the article and I was right. Dealing with the state entity (SCPT) that manages this TLD is quite a pain. It's so painful that I've given up managing all the .cd domains I used to own. .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.

What’s to stop a TLD seller doubling their price? Is there any regulation against the practice?

There was some discussions here recently about this, and from memory the answer was nothing, except reputation. They're free to do whatever they please with it, though jacking the price suddenly might not be great business long term.

Re: How I hijacked the top-level domain of a sovereign state

#65

Post by random5634 » Mon, Jan 18, 2021, 10:44 PM UTC

CydeWeys wrote: post #63

random5634 wrote: post #61

Earlier quoted context omitted.

You clearly have never ever worked in domain renewals before. Many people only renew once dns stops resolving. I've seen govt agencies use this as their reminder to renew. And yes, many scammers out there send postcards to businesses offering to assist for $1,000 on the renewals - and many people pay. So people do send out "alerts" the way you ask - most commonly exploitive and at least I give the advice to ignore AL…

> Many people only renew once dns stops resolving. DNS stops resolving because the domain is pending deletion. At that point it's not a renewal, it's a restore (which costs a lot more money). Refer to the brown "Domain no longer in zone" section of ICANN's lifecycle chart: http://archive.icann.org/en/registrars/gtld-lifecycle.jpg If people are actually regularly using restores instead of renews then they're unnecessa…

Then you should absolutely know that pending deletion is not a black swan event. Can you talk to someone with some data in this space? You will find pending deletion -> restore is a surprisingly common pattern.

As to govt agencies - sure, many use .org and .com domains routinely. These do not get special treatment - and I do generalize my experience from .com and .org to these govt run websites without hesitation.

Despite ideas - just because a public agency is using these domains does not make them magic.

https://www.sfcdcp.org/

https://acphd.org/

to pick two domains within 10 seconds.

I'm going to stop here. Despite your claims that folks don't go into pending deletion - they do. I am responding to top comment - people fail to renew their domains on time routinely. I've seen it happen with some surprise in govt agencies (ie, someone in a dept spins up a website, and renews when someone complains its not working and they get permission to spend the money to renew - which is not instantaneous even for small purchases) as well.

All my points stand and I remain unconvinced by your claims that these govt agency websites can't expire (they do routinely), that pending deletion is a black swan event (it is not) or that folks don't fail to renew on a timely basis (they do frequently).