[gnso-rap-dt] Glue Record / Nameserver WHOIS abuse/spamming

[George Kirikos <icann+rap@xxxxxxxx>]

Hi folks,

I'm just listening to the conference call of today talking about the
definition of "registration abuse", and was curious whether folks
consider spamming of the WHOIS database for nameservers to fit our
scope.

For folks on a Mac, if you do a "WHOIS" from a terminal for various
popular domains, you'll see what I mean. For example, a WHOIS of
"microsoft.com" returns:

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

MICROSOFT.COM.ZZZZZZ.MORE.DETAILS.AT.WWW.BEYONDWHOIS.COM
MICROSOFT.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
MICROSOFT.COM.ZZZZZ.DOWNLOAD.MOVIE.ONLINE.ZML2.COM
MICROSOFT.COM.ZZZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
MICROSOFT.COM.ZZZ.IS.0WNED.AND.HAX0RED.BY.SUB7.NET
MICROSOFT.COM.WILL.LIVE.FOREVER.BECOUSE.UNIXSUCKS.COM
MICROSOFT.COM.WILL.BE.SLAPPED.IN.THE.FACE.BY.MY.BLUE.VEINED.SPANNER.NET
MICROSOFT.COM.WILL.BE.BEATEN.WITH.MY.SPANNER.NET
MICROSOFT.COM.WAREZ.AT.TOPLIST.GULLI.COM
MICROSOFT.COM.TOTALLY.SUCKS.S3U.NET
MICROSOFT.COM.SOFTWARE.IS.NOT.USED.AT.REG.RU
MICROSOFT.COM.SHOULD.GIVE.UP.BECAUSE.LINUXISGOD.COM
MICROSOFT.COM.RAWKZ.MUH.WERLD.MENTALFLOSS.CA
MICROSOFT.COM.OHMYGODITBURNS.COM
MICROSOFT.COM.MORE.INFO.AT.WWW.BEYONDWHOIS.COM
MICROSOFT.COM.LOVES.ME.KOSMAL.NET
MICROSOFT.COM.LIVES.AT.SHAUNEWING.COM
MICROSOFT.COM.IS.NOT.YEPPA.ORG
MICROSOFT.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
MICROSOFT.COM.IS.IN.BED.WITH.CURTYV.COM
MICROSOFT.COM.IS.HOSTED.ON.PROFITHOSTING.NET
MICROSOFT.COM.IS.GOD.BECOUSE.UNIXSUCKS.COM
MICROSOFT.COM.IS.A.STEAMING.HEAP.OF.FUCKING-BULLSHIT.NET
MICROSOFT.COM.IS.A.MESS.TIMPORTER.CO.UK
MICROSOFT.COM.HAS.ITS.OWN.CRACKLAB.COM
MICROSOFT.COM.HAS.A.PRESENT.COMING.FROM.HUGHESMISSILES.COM
MICROSOFT.COM.FILLS.ME.WITH.BELLIGERENCE.NET
MICROSOFT.COM.CAN.GO.FUCK.ITSELF.AT.SECZY.COM
MICROSOFT.COM.ARE.GODDAMN.PIGFUCKERS.NET.NS-NOT-IN-SERVICE.COM
MICROSOFT.COM

and for a WHOIS of "godaddy.com" one gets back:

GODADDY.COM.VATAXIDERMIST.COM
GODADDY.COM.TYLERDEXTER.COM
GODADDY.COM.THECOTTONWIFE.COM
GODADDY.COM.THECLANSMANSOI6.COM
GODADDY.COM.THEANTHEMS.NET
GODADDY.COM.TEST.CHUMCHUM.NET
GODADDY.COM.SUPERSEXYGAMES.COM
GODADDY.COM.SHOPCOMMON.COM
GODADDY.COM.SHIRLEEMCGARRY.COM
GODADDY.COM.SANKOFACORP.COM
GODADDY.COM.SANGRAALBODYWORK.COM
GODADDY.COM.RUSSIANHORNY4U.COM
GODADDY.COM.RESPECTED.BY.WWW.DNDIALOG.COM
GODADDY.COM.RENASCOTT.NET
GODADDY.COM.RABENSMM.COM
GODADDY.COM.QUINTAFLORIDA.COM
GODADDY.COM.QHSSE.COM
GODADDY.COM.NIKKISBOUTIQUE.COM
GODADDY.COM.NAWAZSONS.COM
GODADDY.COM.MADE4BABES.COM
GODADDY.COM.LANDLCONNECTION.COM
GODADDY.COM.KARLAADAMS.COM
GODADDY.COM.INDYMETROWOMAN.COM
GODADDY.COM.HOWARDHUEY.NET
GODADDY.COM.GGONYA.NET
GODADDY.COM.BLUEPLANETIMPORTS.COM
GODADDY.COM.BLUENEONMEDIAGROUP.COM
GODADDY.COM.BERNADETTEHAROLD.COM
GODADDY.COM.AND.ALEX.FUCKED.BY.WWW.DNDIALOG.COM
GODADDY.COM.AMYDONG.COM
GODADDY.COM

These domains take advantage of the pattern matching done by the
Internic WHOIS database. From experience, some domains have thousand
or tens of thousands of nameservers defined, mostly for the purpose of
spamming the WHOIS database (i.e. to show up when folks are looking
for the WHOIS of a real domain).

Sincerely,

George Kirikos
http://www.leap.com/