Detecting parked domains
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads? I'm hoping there is other method besides chasing a list of constantly changing IP addresses being used by the parking advertising companies.
On Tue, Aug 01, 2006 at 03:35:40PM -0400, Sean Donelan <sean@donelan.com> wrote a message of 6 lines which said:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
I don't think it is possible: "being parked" cannot be defined in an algorithmic way. My own domain sources.org does not even have a Web site (and I swear it is not parked). Let's try: * Bayesian filtering on the content of the Web page, after suitable training? * Number of different pages on the site (if n == 1 then the domain is parked)? * (Based on the analysis of many sites, not just one) Content of the page "almost" identical to the content of many other pages? (Caveat: the Apache default installation page...)
Stephane Bortzmeyer wrote:
On Tue, Aug 01, 2006 at 03:35:40PM -0400, Sean Donelan <sean@donelan.com> wrote a message of 6 lines which said:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
I don't think it is possible: "being parked" cannot be defined in an algorithmic way. My own domain sources.org does not even have a Web site (and I swear it is not parked).
Let's try:
* Bayesian filtering on the content of the Web page, after suitable training?
* Number of different pages on the site (if n == 1 then the domain is parked)?
* (Based on the analysis of many sites, not just one) Content of the page "almost" identical to the content of many other pages? (Caveat: the Apache default installation page...)
Dont forget there are mail only domains. I used to have one. Now it is used to forward html somehow to my real homepage. ; <<>> DiG 9.1.3 <<>> -t any peter-dambier.de @212.227.123.12 ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28472 ;; flags: qr aa rd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;peter-dambier.de. IN ANY ;; ANSWER SECTION: peter-dambier.de. 86400 IN SOA ns15.schlund.de. hostmaster.schlund.de. 2005050401 28800 7200 604800 86400 peter-dambier.de. 86400 IN NS ns15.schlund.de. peter-dambier.de. 86400 IN NS ns16.schlund.de. peter-dambier.de. 86400 IN MX 10 mx0.gmx.de. peter-dambier.de. 86400 IN MX 10 mx0.gmx.net. peter-dambier.de. 10800 IN A 82.165.62.90 ;; Query time: 63 msec ;; SERVER: 212.227.123.12#53(212.227.123.12) ;; WHEN: Tue Aug 1 22:18:51 2006 ;; MSG SIZE rcvd: 217 <HT ML><HE AD> <TI TLE>Peter und Karin Dambier</TI TLE> </HE AD> <FR AMESET ROWS="100%,*" BORDER="0" FR AMEBORDER="0"> <FR AME SRC="http://www.peter-dambier.gmxhome.de/" SCROLLING="AUTO" NAME="bannerframe" NORESIZE> </FR AMESET> <NOF RAMES> Peter und Karin Dambier <P> <DI V AL IGN="CENTER"><A HR EF="http://www.peter-dambier.gmxhome.de/">http://peter-dambier.de/</A></D IV> </NOF RAMES> </HT ML> -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter@peter-dambier.de mail: peter@echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/
I have a large list of parked domains how would you like to query it and why do you want to? -rick Sean Donelan wrote:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads? I'm hoping there is other method besides chasing a list of constantly changing IP addresses being used by the parking advertising companies.
On Wed, Aug 02, 2006 at 09:10:31PM +0200, Florian Weimer wrote:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
AFAICT, the main challenge is to define what "parked" means in the context of your application.
It seemed quite obvious to me: he's talking about domain squatting. "Parking" is just a euphemism. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |
In article <20060802200448.GA44921@icarus.home.lan>, Jeremy Chadwick <nanog@jdc.parodius.com> writes
AFAICT, the main challenge is to define what "parked" means in the context of your application.
It seemed quite obvious to me: he's talking about domain squatting. "Parking" is just a euphemism.
I have domains (and over time most of mine have once been in this condition) which I've registered (for me, and no speculation involved) but not yet got around to publishing a website for. I also have several where the published (and useful) website is just one page (harking back to a previous suggestion for a test of parking). None of my sites has ever had any advertising (nor are likely to). -- Roland Perry
* Jeremy Chadwick:
On Wed, Aug 02, 2006 at 09:10:31PM +0200, Florian Weimer wrote:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
AFAICT, the main challenge is to define what "parked" means in the context of your application.
It seemed quite obvious to me: he's talking about domain squatting.
I've heard suggestions to treat "parked" domains less threatening than other types of domain squatting. This approach is somewhat dubious, based on a few things we've seen.
Parked: A domain hosted by a middle-man for the sole purpose of generating revenue from pay-per-click advertising. Characterized by having no content of value. This definition *might* work for NANOG, but my parking friends would disagree with the above. Florian Weimer wrote:
* Sean Donelan:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
AFAICT, the main challenge is to define what "parked" means in the context of your application.
On Wed, 2 Aug 2006, Rick Wesson wrote:
Parked: A domain hosted by a middle-man for the sole purpose of generating revenue from pay-per-click advertising. Characterized by having no content of value.
this needs to be "no original content of value" BTW - for those who are still wondering about the question of detecting this in semi-automated way, I recommend looking at what nameservers are used as way to determine if it is likely to be parked domain. Not perfect but you'll find large number of such domains and if that does not do it then looking at common ip addresses of where the domain (www) is pointed to will help determining this even more. -- William Leibzon Elan Networks william@elan.net
i know this will come as a shock, but there ar eother uses for domain names than web sites
Randy Bush wrote:
i know this will come as a shock, but there ar eother uses for domain names than web sites
Surely you jest! Surely a domain with no listener on port 80 or 25 is not a legitimate domain. -- Requiescas in pace o email Ex turpi causa non oritur actio http://members.cox.net/larrysheldon/
The trouble I see with this, is that legitimate web hosts commonly run several domains off one server, distinguishing by host headers. So assuming that because 10 domains point at the same IP they must be parked, is a bad assumption. william(at)elan.net wrote:
On Wed, 2 Aug 2006, Rick Wesson wrote:
Parked: A domain hosted by a middle-man for the sole purpose of generating revenue from pay-per-click advertising. Characterized by having no content of value.
this needs to be "no original content of value"
BTW - for those who are still wondering about the question of detecting this in semi-automated way, I recommend looking at what nameservers are used as way to determine if it is likely to be parked domain. Not perfect but you'll find large number of such domains and if that does not do it then looking at common ip addresses of where the domain (www) is pointed to will help determining this even more.
On Wed, 2 Aug 2006, Cory Whitesell wrote:
The trouble I see with this, is that legitimate web hosts commonly run several domains off one server, distinguishing by host headers. So assuming that because 10 domains point at the same IP they must be parked, is a bad assumption.
It is. You need to have pre-determined (manually done) of what servers have these "parked" pages. Then if you see other domains pointing to the same server, its almost always another "parked domain". But as Randy points, just because its website is "parked" does not mean domain is not being used in some other way. But in my opinion this still qualifies domain as "parked" because common use of "parked domain" term has to do with content of its website and does not imply that domain is or is not being used in some unique way for email or some other traffic.
william(at)elan.net wrote:
On Wed, 2 Aug 2006, Rick Wesson wrote:
Parked: A domain hosted by a middle-man for the sole purpose of generating revenue from pay-per-click advertising. Characterized by having no content of value.
this needs to be "no original content of value"
BTW - for those who are still wondering about the question of detecting this in semi-automated way, I recommend looking at what nameservers are used as way to determine if it is likely to be parked domain. Not perfect but you'll find large number of such domains and if that does not do it then looking at common ip addresses of where the domain (www) is pointed to will help determining this even more.
Although the original poster did not state a reason for why they wanted to detect such a domain - others have since suggested that the web site content on such a "parked domain" is of no (original) value since only ads run on such a site. By that definition all billboards or stand alone advertising has no intrinsic content value. That complaint is justified only if you are lured into such a site under false pretense - such as by the site owner's active efforts at search engine pollution - so the "offending" behaviour has to go beyond simply running ads on a "parked domain" to which you may not have been solicited. Mistyping or typing in domain names and ending on such a site is a grey area - for example you dont blame the owner of a misdialed phone number for running any service they like on such a number just because it is two digits transposed from a "well known" or your otherwise intended phone number. That can go both ways - several cases of the wrong toll free number getting flooded with calls or the storied error from the 2004 US Presidential campaign when the Republicans sent the TV audience off to a Democratic leaning web site. Yes, there are some speculators that are counting on user errors of omission or commission but an algorithmic divining of what the intent is is problematic. Domain names are the "real estate" of the 21st century. You may wish to acquire a property for its "location", rent it to someone else now, and only wish to use it for your own use in the future. You could just leave it unoccupied. This would only be considered a problem if you engaged in deceptive advertizing outside that property to lure someone in and tried to sell them something else. That said, search engines do have their own heuristics on how to rank such pages "lower" in search results. Any articles that describe how Google's page ranking works talks about ratio of native content to hyperlinked content, number of outbound links to inbound links etc, number of links to other pages on the same site (many "parked domains" are single page sites but the reverse is not always true) Finally, if you have registered a domain lately - the web site associated with the domain is automatically associated with a "parked" page by most registrars (Network Solutions, Yahoo!, GoDaddy) immediately upon completion of registration and they run their own (revenue accruing to the registrar) ads on it till such time as you configure your own DNS servers and point it elsewhere. The maligned "middleman" comes into the picture later. I am as frustrated as the next person when I end up on a site that lured me in with clever manipulation of keywords and search engine optimization - only to show me ads - but I would be loath to paint all "parked domains" with a broad brush. Parked: A domain hosted by a middle-man for the sole purpose of generating revenue from pay-per-click advertising. Characterized by having no content of value.
Parked: A domain hosted by a middle-man for the sole purpose of generating revenue from pay-per-click advertising. Characterized by having no content of value.
This definition *might* work for NANOG, but my parking friends would disagree with the above.
If this is what you mean, then it is impossible to do so automatically. This definition requires determining the motiviation for the registration, which cannot be done by any technical means. For example, this definition would exclude a domain temporarily parked for a few months while a service is prepared and tested. If you mean determiming if a domain is likely to be parked or definitely has some other set of characteristics, it helps to work that out in precise detail. I'm not trying to be a pain, I'm genuinely trying to be helpful. For example, a commonly asked question is "how can I tell how much memory my program is using" and the canonical answer is "define what you mean by 'using memory' and the answer will be obvious (or at least you'll be on your way to getting it). (Physical memory? Virtual memory? Is the memory footprint of a shared library to be counted as 'used'? What if this is the only program that's using it? And so on.) DS
On Wed, 2 Aug 2006, Florian Weimer wrote:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
AFAICT, the main challenge is to define what "parked" means in the context of your application.
There seems to be DNSBL's for every other thing, I was expecting to find one for parked domain names or the server IP addresses used. This was for personal interest, rather than a commercial opportunity. I'm a lousy typist and its unlikely change. But I can write computer applications. I'd rather get a message my application can process rather than relying on a human. My preference is "legitimate" domain parking firms included a standardized piece of meta-data my application could detect and use as "this domain doesn't really exist." Sorta of a variant of the web robots.txt file, but I prefer it to be application independent, instead of assuming everything is HTTP Port 80. Perhaps start with a standard record associated with the parked domain, i.e. _notexist.example.com. For less legitimate domain parking (i.e. typo-squatters), its a different problem.
Sean Donelan wrote:
On Wed, 2 Aug 2006, Florian Weimer wrote:
Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads?
AFAICT, the main challenge is to define what "parked" means in the context of your application.
There seems to be DNSBL's for every other thing, I was expecting to find one for parked domain names or the server IP addresses used.
This was for personal interest, rather than a commercial opportunity. I'm a lousy typist and its unlikely change. But I can write computer applications. I'd rather get a message my application can process rather than relying on a human.
My preference is "legitimate" domain parking firms included a standardized piece of meta-data my application could detect and use as "this domain doesn't really exist." Sorta of a variant of the web robots.txt file, but I prefer it to be application independent, instead of assuming everything is HTTP Port 80. Perhaps start with a standard record associated with the parked domain, i.e. _notexist.example.com.
For less legitimate domain parking (i.e. typo-squatters), its a different problem.
How about creating a database domain(domain_owner,domain_name) and then querying by domain_owner. If the guy has more than 100 he looks like a squatter and can me manually looked at. e.g. 6.ag. 86400 IN NS ns1.sedoparking.com. 6.ag. 86400 IN NS ns2.sedoparking.com. auktion.ag. 86400 IN NS ns1.sedoparking.com. auktion.ag. 86400 IN NS ns2.sedoparking.com. bilder.ag. 86400 IN NS ns1.sedoparking.com. bilder.ag. 86400 IN NS ns2.sedoparking.com. ... tvshop.ag. 86400 IN NS ns1.sedoparking.com. tvshop.ag. 86400 IN NS ns2.sedoparking.com. videothek.ag. 86400 IN NS ns1.sedoparking.com. videothek.ag. 86400 IN NS ns2.sedoparking.com. webhosting.ag. 86400 IN NS ns1.sedoparking.com. webhosting.ag. 86400 IN NS ns2.sedoparking.com. grep | wc says he has 51 lines. I guess it is 26 domains. The name suggests they are parked. 01.ag. 86400 IN NS ns19.schlund.de. 01.ag. 86400 IN NS ns20.schlund.de. 0800fitness.ag. 86400 IN NS ns11.schlund.de. 0800fitness.ag. 86400 IN NS ns12.schlund.de. 1-and-1.ag. 86400 IN NS ns3.schlund.de. 1-and-1.ag. 86400 IN NS ns4.schlund.de. ... zusatzverdienst.ag. 86400 IN NS ns7.schlund.de. zusatzverdienst.ag. 86400 IN NS ns8.schlund.de. zweitmarkt.ag. 86400 IN NS ns25.schlund.de. zweitmarkt.ag. 86400 IN NS ns26.schlund.de. zypern.ag. 86400 IN NS ns21.schlund.de. zypern.ag. 86400 IN NS ns22.schlund.de. grep | wc says 3226 lines. But they are a famous german hoster. I dont think they are squatting. Just for curiousity AG is the german equivalent of PLC or SA in french. I thought the namesevers would do. Maybe the whois gives more help. Cheers Peter and Karin -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter@peter-dambier.de mail: peter@echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/
On Aug 2, 2006, at 5:37 PM, Peter Dambier wrote:
How about creating a database domain(domain_owner,domain_name) and then querying by domain_owner. If the guy has more than 100 he looks like a squatter and can me manually looked at. And if you are not famous?
I have over 100 domains on my personal web server. _NONE_ of them are parked, although not all have web pages (and of the ones that do, none have ads). The personal name server I run (in a group of several name servers we run collectively) has approximately 1000 domains on it. I can't guarantee that there is not a single parked domain, but the overwhelming majority are not parked. I doubt we're "famous". How are you going to be able to tell they aren't parked? Pull up the web page on a few domains to see what they look like? Check all 1000 manually? Half? -- TTFN, patrick
Patrick W. Gilmore wrote:
I doubt we're "famous". How are you going to be able to tell they aren't parked? Pull up the web page on a few domains to see what they look like? Check all 1000 manually? Half?
Whose business is it. Who cares? -- Requiescas in pace o email Ex turpi causa non oritur actio http://members.cox.net/larrysheldon/
On Wed, 2 Aug 2006, Patrick W. Gilmore wrote:
I have over 100 domains on my personal web server. _NONE_ of them are parked, although not all have web pages (and of the ones that do, none have ads).
I tried not to attribute malice on the part of domain parking operators. I am looking for a way that you, or anyone else, could indicate a domain should not be considered "in service" although the name is registered and has an A record pointing to an active server so when I check that name it doesn't require a human to interpret the results. Most of the legit domain parking operators make it pretty obvious to a human looking at the web page its not an active domain name , e.g. The Future Home Of XYZ, Buy This Domain Now, etc. Unfortunately what may be obvious to a human is sometimes difficult for a dumb computer. I just want a way to make it equally obvious to a computer. As Randy points out, there is more to the Net than the Web, so the better solution should not depend on sending a query to port 80.
Sean Donelan wrote:
On Wed, 2 Aug 2006, Patrick W. Gilmore wrote:
I have over 100 domains on my personal web server. _NONE_ of them are parked, although not all have web pages (and of the ones that do, none have ads).
I tried not to attribute malice on the part of domain parking operators. I am looking for a way that you, or anyone else, could indicate a domain should not be considered "in service" although the name is registered and has an A record pointing to an active server so when I check that name it doesn't require a human to interpret the results.
Most of the legit domain parking operators make it pretty obvious to a human looking at the web page its not an active domain name , e.g. The Future Home Of XYZ, Buy This Domain Now, etc. Unfortunately what may be obvious to a human is sometimes difficult for a dumb computer. I just want a way to make it equally obvious to a computer. As Randy points out, there is more to the Net than the Web, so the better solution should not depend on sending a query to port 80.
Don't parked domains exist on a registrar owned IP? I would think a list could be built from spending some time contacting each registrar (http://www.icann.org/registrars/accredited-list.html). ;-) Or if you didn't mind over-compensating, you could at least assume that "Various Registrars" listed here: http://www.iana.org/assignments/ipv4-address-space will probably contain the registrar's public sites as well as hosted domains. Just my $.02 -Jim P.
On 8/3/06, Jim Popovitch <jimpop@yahoo.com> wrote:
Don't parked domains exist on a registrar owned IP? I would think a list could be built from spending some time contacting each registrar (http://www.icann.org/registrars/accredited-list.html). ;-)
Not always. You will find several registrars that run a value added "domain hosting + email" service - netsol, register.com, tucows etc all do that. That is - lots and lots of small personal domains, in active use, not parked or squatted upon --srs
I am looking for a way that you, or anyone else, could indicate a domain should not be considered "in service" although the name is registered and has an A record pointing to an active server so when I check that name it doesn't require a human to interpret the results.
You might be able to use lack of an SOA record as a hint. In my experience, parked domains often do not have SOA records because the parking companies are lazy. It is a lot easier to put all the parked domains in a parent zone file, or even use a wildcard, rather than have a zone file for each parked name. Duane W.
Duane Wessels wrote:
I am looking for a way that you, or anyone else, could indicate a domain should not be considered "in service" although the name is registered and has an A record pointing to an active server so when I check that name it doesn't require a human to interpret the results.
You might be able to use lack of an SOA record as a hint. In my experience, parked domains often do not have SOA records because the parking companies are lazy. It is a lot easier to put all the parked domains in a parent zone file, or even use a wildcard, rather than have a zone file for each parked name.
Duane W.
From DNS nutshell or from the "DNS and BIND" book the programme
check_soa peter-dambier.de
ns1.peter-dambier.de has serial number 2005050401 ns2.peter-dambier.de has serial number 2005050401 Can do. In the IASON tools there is a hacked version
chk1soa ns1.peter-dambier.de peter-dambier.de
soa("peter-dambier.de","2005050401","ns1.peter-dambier.de","195.20.224.105").
chk1soa m.root-servers.net peter-dambier.de
error("peter-dambier.de","m.root-servers.net","202.12.27.33","no soa"). IASON compiles on most flavours of unix including Mac OS-X and linux. http://iason.site.voila.fr/ http://www.kokoom.com/iason If you have an idea what is missing you are welcome to send me a private email. Cheers Peter and Karin -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter@peter-dambier.de mail: peter@echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/
On 3-Aug-2006, at 04:05, Duane Wessels wrote:
I am looking for a way that you, or anyone else, could indicate a domain should not be considered "in service" although the name is registered and has an A record pointing to an active server so when I check that name it doesn't require a human to interpret the results.
You might be able to use lack of an SOA record as a hint. In my experience, parked domains often do not have SOA records because the parking companies are lazy. It is a lot easier to put all the parked domains in a parent zone file, or even use a wildcard, rather than have a zone file for each parked name.
Surely for that to work for most of the domains we're talking about, the parking companies would need to be able to insert arbitrary records into zones such as "ORG", "NET" and "COM", which isn't something that any of the registries for those zones permit. Do you have an example of a parked domain with no SOA record? Joe
On Thu, 3 Aug 2006, Joe Abley said:
Do you have an example of a parked domain with no SOA record?
eoileon.com tri-cityhearald.com
Surely for that to work for most of the domains we're talking about, the parking companies would need to be able to insert arbitrary records into zones such as "ORG", "NET" and "COM", which isn't something that any of the registries for those zones permit.
No, they just make up their own COM zone. For example, the nameservers for eoileon.com are: ;; AUTHORITY SECTION: eoileon.com. 145225 IN NS ns1.chestertonholdings.com. eoileon.com. 145225 IN NS ns11.chestertonholdings.com. If I ask one of their auth nameservers about COM I get: $ dig +short @ns1.chestertonholdings.com com soa a.gtld-servers.net. nstld.verisign-grs.com. 2006021701 3600 900 1209600 21600 Which almost looks good, except they didn't get the email about Verisign's serial format change. $ dig +short com soa a.gtld-servers.net. nstld.verisign-grs.com. 1154620024 1800 900 604800 900 Duane W.
No, it does not look good :) ; <<>> DiG 9.1.3 <<>> -t any eoileon.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47446 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;eoileon.com. IN ANY ;; ANSWER SECTION: eoileon.com. 172800 IN NS ns11.chestertonholdings.com. eoileon.com. 172800 IN NS ns1.chestertonholdings.com. ;; AUTHORITY SECTION: eoileon.com. 172800 IN NS ns1.chestertonholdings.com. eoileon.com. 172800 IN NS ns11.chestertonholdings.com. ;; ADDITIONAL SECTION: ns1.chestertonholdings.com. 172800 IN A 204.13.160.12 ns11.chestertonholdings.com. 172800 IN A 204.13.161.12 ;; Query time: 146 msec ;; SERVER: 192.168.48.227#53(192.168.48.227) ;; WHEN: Thu Aug 3 20:11:49 2006 ;; MSG SIZE rcvd: 145 No SOA. Of course not. It is my own resolver :) but ; <<>> DiG 9.1.3 <<>> -t any eoileon.com @ns1.chestertonholdings.com. ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60197 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13 ;; QUESTION SECTION: ;eoileon.com. IN ANY ;; ANSWER SECTION: eoileon.com. 86400 IN A 204.13.161.31 ;; AUTHORITY SECTION: com. 86400 IN NS k.gtld-servers.net. com. 86400 IN NS l.gtld-servers.net. com. 86400 IN NS m.gtld-servers.net. com. 86400 IN NS a.gtld-servers.net. com. 86400 IN NS b.gtld-servers.net. com. 86400 IN NS c.gtld-servers.net. com. 86400 IN NS d.gtld-servers.net. com. 86400 IN NS e.gtld-servers.net. com. 86400 IN NS f.gtld-servers.net. com. 86400 IN NS g.gtld-servers.net. com. 86400 IN NS h.gtld-servers.net. com. 86400 IN NS i.gtld-servers.net. com. 86400 IN NS j.gtld-servers.net. ;; ADDITIONAL SECTION: a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 ;; Query time: 245 msec ;; SERVER: 204.13.160.12#53(ns1.chestertonholdings.com.) ;; WHEN: Thu Aug 3 20:12:12 2006 ;; MSG SIZE rcvd: 501 I wonder why bind did not say lame server? ; <<>> DiG 9.1.3 <<>> -t any eoileon.com @a.gtld-servers.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39156 ;; flags: qr rd; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;eoileon.com. IN ANY ;; ANSWER SECTION: eoileon.com. 172800 IN NS ns1.chestertonholdings.com. eoileon.com. 172800 IN NS ns11.chestertonholdings.com. ;; AUTHORITY SECTION: eoileon.com. 172800 IN NS ns1.chestertonholdings.com. eoileon.com. 172800 IN NS ns11.chestertonholdings.com. ;; ADDITIONAL SECTION: ns1.chestertonholdings.com. 172800 IN A 204.13.160.12 ns11.chestertonholdings.com. 172800 IN A 204.13.161.12 ;; Query time: 160 msec ;; SERVER: 192.5.6.30#53(a.gtld-servers.net) ;; WHEN: Thu Aug 3 20:19:33 2006 ;; MSG SIZE rcvd: 145 And no, they are not authoritative either.
check_soa eoileon.com
There was no response from ns11.chestertonholdings.com ns1.chestertonholdings.com: expected 1 answer, got 0 ; <<>> DiG 9.1.3 <<>> -t any eoileon.com @ns11.chestertonholdings.com. ;; global options: printcmd ;; connection timed out; no servers could be reached I should say the domain eoileon.com is at least broken if not broke :) Cheers Peter and Karin Duane Wessels wrote:
On Thu, 3 Aug 2006, Joe Abley said:
Do you have an example of a parked domain with no SOA record?
eoileon.com tri-cityhearald.com
Surely for that to work for most of the domains we're talking about, the parking companies would need to be able to insert arbitrary records into zones such as "ORG", "NET" and "COM", which isn't something that any of the registries for those zones permit.
No, they just make up their own COM zone.
For example, the nameservers for eoileon.com are:
;; AUTHORITY SECTION: eoileon.com. 145225 IN NS ns1.chestertonholdings.com. eoileon.com. 145225 IN NS ns11.chestertonholdings.com.
If I ask one of their auth nameservers about COM I get:
$ dig +short @ns1.chestertonholdings.com com soa a.gtld-servers.net. nstld.verisign-grs.com. 2006021701 3600 900 1209600 21600
Which almost looks good, except they didn't get the email about Verisign's serial format change.
$ dig +short com soa a.gtld-servers.net. nstld.verisign-grs.com. 1154620024 1800 900 604800 900
Duane W.
-- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter@peter-dambier.de mail: peter@echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/
On Aug 2, 2006, at 2:03 PM, Sean Donelan wrote:
There seems to be DNSBL's for every other thing, I was expecting to find one for parked domain names or the server IP addresses used.
That's not hard. It's the value of providing it I question. It only encourages them to start putting syndicated content on them and then it starts to get more confusing as to what is BS and what is real, which wastes even more time.
For less legitimate domain parking (i.e. typo-squatters), its a different problem.
Totally agreed, and one probably worth providing a solution to. Sites like www.stationary.com bother me a lot less than www.craigslists.org And http://www.myspaces.com ... Well, maybe that's no more disturbing than myspace. j/k CNET held onto tv.com for a long long time before making it a site. They're still parking radio.com. So some parked domains eventually get built out. So while it'd be easy to have a list of parked domains encouraging blocking content-less sites[1] will just teach domain parkers how to use XML-RPC calls to syndicate content from flickr and other web2.0 sites for google fodder, etc. I'm not sure if that's yet another arms race worth starting. Vixie's comments a few days back resonate pretty strongly in my mind. Botnets, spammers and other miscreants already waste enough of my time. Typo-squatting is a different beast indeed, one which annoys people endlessly. -davidu 1: I know Sean didn't specifically say he wanted to block sites, I'm just picking the obvious use of such a feed, especially if it were made public.
participants (19)
-
Cory Whitesell -
David Schwartz -
David Ulevitch -
Duane Wessels -
ennova2005-nanogļ¼ yahoo.com -
Florian Weimer -
Jeremy Chadwick -
Jim Popovitch -
Joe Abley -
Laurence F. Sheldon, Jr. -
Patrick W. Gilmore -
Peter Dambier -
Randy Bush -
Rick Wesson -
Roland Perry -
Sean Donelan -
Stephane Bortzmeyer -
Suresh Ramasubramanian -
william(at)elan.net