Porn Sites Hijack Expired Domain Names

11/03/2002 Written by Carolyn Duffy Marsan, Network World

The num­ber of domain names being allowed to expire – inten­tion­ally or acci­den­tally – is at an all-​time high. Now shady mid­dle­men called traf­fic aggre­ga­tors are increas­ingly buy­ing these names and redi­rect­ing cor­re­spond­ing Web traf­fic to other sites, pri­mar­ily porn and gam­bling venues.

Orga­ni­za­tions as var­ied as the Boston Phil­har­monic Orches­tra and the Dutch gov­ern­ment have seen their expired domain names snapped up by traf­fic aggre­ga­tors and redi­rected to porn sites. Oth­ers, includ­ing the United Nations and the U.S. Depart­ment of Edu­ca­tion, have received irate e-​mails from online cus­tomers com­plain­ing about unde­tected links to porn sites.

“The links caused a hell of a stir,” says Edward Loeb, a pro­gram man­ager with Allied Tech­nol­ogy Group, a con­trac­tor that oper­ates the U.S. Depart­ment of Education’s Web site. “The pub­lic is not at all happy to find…their tax­pay­ers’ dol­lars spent on Web sites that link to pornog­ra­phy. It was quite an embar­rass­ment to us.”

Track­ing Tools Help

Using an early ver­sion of a new tool called LinkScan 9.0, Loeb found 15 links to porn sites buried among the 65,000 inter­nal and exter­nal links on the Depart­ment of Education’s Web site.

The links were to two domains that had changed own­er­ship from edu­ca­tional out­fits to traf­fic aggre­ga­tors.

Mar­keters of link-​checking soft­ware such as LinkScan are updat­ing their offer­ings with the capa­bil­ity to check links for adult con­tent.

“We just started see­ing this trend in the last three months,” says Michael Wei­der, chair of Watch­fire, which sells a Web site quality-​assessment tool called WebXM that iden­ti­fies unin­ten­tional links to adult con­tent. He says some com­pa­nies have as many as 200 of these poten­tially embar­rass­ing URLs buried within their con­tent.

The prob­lem has got­ten seri­ous enough that the Inter­net Cor­po­ra­tion for Assigned Names and Num­bers recently issued a pro­posal to cre­ate a 30-​day wait­ing period before expir­ing domain names can be resold. ICANN’s pol­icy paper says that in recent months it has seen “a ris­ing tide” of com­plaints related to domain names inad­ver­tently chang­ing own­er­ship.

Embar­rass­ing Slip
The sit­u­a­tion can prove embar­rass­ing for com­pa­nies.

Con­sider what hap­pened to The Spe­cial Inter­est Group on CD/​DVD Appli­ca­tions and Tech­nol­ogy, a 15-​year-​old non­profit orga­ni­za­tion. The group, which held its last con­fer­ence in 1999, acci­den­tally let its domain name – www​.sig​cat​.org – expire.

In Decem­ber, Domains For Sale, an Eston­ian traf­fic aggre­ga­tor with an Illi­nois tele­phone num­ber, pur­chased SIGCAT’s domain name and now redi­rects traf­fic to a porn oper­a­tor named Adult City.

“We found out about a month ago that the site looked a lot dif­fer­ent than it used to,” says Jerry McFaul, a U.S. Geo­log­i­cal Sur­vey employee and founder of SIG­CAT. Renew­ing the domain name “fell through the cracks. We had a Web­mas­ter in one state, an ISP in another state, and we were here in Vir­ginia. Each of us thought the other was cov­er­ing the renewal.”

McFaul says he con­tacted Domains For Sale and was told he could buy back the domain name but “not to bid any­thing under $1000.” Because the group is non­profit, he decided not to spend the money. Instead, SIG­CAT is evolv­ing into a new orga­ni­za­tion, the DVD Asso­ci­a­tion, with a new Web site: www​.dvda​.org.

Domains For Sale did not respond to phone calls for this story.

The SIG­CAT snafu also tripped up Amtower & Com­pany, an Ash­ton, Mary­land provider of direct-​marketing ser­vices to the fed­eral gov­ern­ment. Amtower had links to www​.sig​cat​.org on some of its business-​to-​government Web sites.

Com­pany Pres­i­dent Mark Amtower says he had “not a clue” that he was link­ing to a porn site.

“I own about 300 dif­fer­ent [business-​to-​government] URLs,” he says. “I damn well don’t want one of them linked to porno.”

Big (if Shady) Busi­ness
SIG­CAT isn’t the only orga­ni­za­tion to have its expired domain name pur­chased by Domains for Sale or its sis­ter com­pa­nies, which include Triple Zero Net­works and The Host­mas­ter. These com­pa­nies all have addresses in the for­mer Soviet Union and the same tele­phone num­ber in Illi­nois.

They have pur­chased many for­merly rep­utable domain names, includ­ing can2k​.com, which Indus­try Canada orig­i­nally used to explain the mil­len­nium bug; wsodc​.org, which was used by the Wash­ing­ton Sym­phony Orches­tra; and cli​mat​e​change2000​.org, which the Dutch gov­ern­ment used to pub­li­cize a meet­ing of the United Nations Frame­work Con­ven­tion on Cli­mate Change in 2000.

The num­ber of expired domain names rose from 750,000 per month in August 2001 to more than 2,250,000 per month in Decem­ber 2001, accord­ing to Snap­Names.

Traf­fic aggre­ga­tors like Domains for Sale pur­chase dozens of expir­ing domain names with active traf­fic each month and redi­rect them to gam­bling or porn sites, which in turn pay the traf­fic aggre­ga­tors for each cus­tomer that orig­i­nates from the redi­rected URL. Typ­i­cally domain names are sold for $35 a year.

The iden­ti­fi­ca­tion and pur­chase of expired domain names has got­ten eas­ier in the last year, thanks to the avail­abil­ity of auto­mated ser­vices that track and pur­chase expir­ing names. These ser­vices, from com­pa­nies such as Snap­Names, Dot­ster, and Enom, are increas­ingly used by traf­fic aggre­ga­tors. Other com­pa­nies, such as Exody​.com, Local​Whois​.com, and Domains bot​.com, pro­vide traf­fic aggre­ga­tors with lists of soon-​to-​expire names.

“The peo­ple who are inter­ested in dropped names are pri­mar­ily the traf­fic aggre­ga­tors,” says Matt Stearn, a vice pres­i­dent at Enom. “They’ll buy from one to 50 names on any par­tic­u­lar day.”

Reg­u­la­tory Tightrope
Reg­u­lat­ing this sit­u­a­tion is tricky for ICANN, which must pro­tect the free-​speech rights of porn oper­a­tors while ensur­ing that domain-​name hold­ers are given proper noti­fi­ca­tion and enough time to renew their names.

In its pol­icy paper, ICANN says most of the prob­lems are caused by the inat­ten­tion of domain name hold­ers who for­get to renew reg­is­tra­tions. Com­pa­nies often fail to receive noti­fi­ca­tion of a pend­ing domain name expi­ra­tion because the e-​mail address listed at the time of the reg­is­tra­tion is no longer valid.

Cur­rently deleted names are avail­able for resale imme­di­ately or, in some cases, after a five-​day reg­istry hold.

ICANN pro­poses deleted names be put on hold for 30 days before resale, giv­ing reg­is­trars and domain name hold­ers time to cor­rect mis­taken dele­tions. The delay would serve as a “last resort” noti­fi­ca­tion to a Web site oper­a­tor that a name had expired because the name wouldn’t resolve dur­ing the 30 days prior to the name’s avail­abil­ity for resale. The pro­posal would apply to names end­ing in .com, .net, .org, .biz, .info, and .name.

Mop­ping Up
In the mean­time, Web­mas­ters are stuck clean­ing up the mess that inap­pro­pri­ate links cause.

Jan Golin­ski, Web­mas­ter for the U.N.‘s Frame­work Con­ven­tion on Cli­mate Change, dis­cov­ered in Novem­ber that his site inad­ver­tently linked to adult con­tent. The site had links to cli​mat​e​change2000​.org. The Dutch gov­ern­ment failed to renew the domain name reg­is­tra­tion, so a traf­fic aggre­ga­tor snapped it up and redi­rected the traf­fic to Adult City’s Web site.

“I deleted every­thing that was con­nected to cli​mat​e​change2000​.org,” Golin­ski says. He also estab­lished a new pol­icy about exter­nal links. Still, Golin­ski says the new link­ing pol­icy wouldn’t have pre­vented the recent fiasco.

Loeb, who oper­ates the U.S. Depart­ment of Education’s Web site, says the only way to be sure that you’re not link­ing to adult con­tent is to use link-​checking soft­ware. The lat­est ver­sions of these pack­ages range in price from $1000 to $75,000.

“It’s worth it to have this kind of a tool because the cost of being wrong is too high,” Loeb adds.