WHOIS Lost in Translation: (Mis)Understanding Internet Domain Name Expiration and Re-Registration

Tobias Lauinger, Kaan Onarlioglu, Abdelberi Chaabane, William Robertson, Engin Kirda
In Proceedings of the ACM Internet Measurement Conference (IMC)

measurement network security

Internet domain names expire when not renewed and may be claimed by a new owner. To date, despite existing work on abuses of residual trust after domain ownership changes, it is not well understood how often and how fast re-registrations occur, and the underlying processes are often over-simplified in scientific literature, leading to a potential bias in those studies. While in principle registration data is available in Whois databases, scalability issues and data ambiguities make re-registrations a challenging subject of study in practice. By focusing on domains about to be deleted, we were able to track 7.4 M com, net, org, biz and name domains over up to ten months to gather data for a survival analysis of re-registrations. Our results show that expiration processes may vary, and that many re-registrations happen soon after deletion, especially for older domains. We also discuss intricacies of Whois data to aid in avoiding potential pitfalls, as fast domain ownership changes combined with hidden domain states may pose challenges to operational and research communities.