May 18th 2020
This week I built a script that allowed me to end up purchasing netfix.soy, facebook.网站, microsoft.みんな, and google.קום.
I give a whistle-stop overview of how this happened on my blog post. If you haven't read it yet, I'd recommend you do first (its only a 2 minute read). Here I want to go into a bit more detail about the project, domain names, the implications, and the overall Tiny Projects journey.
Domain names really interest me. There's just something about them. When you buy a domain name you're also buying that exciting feeling of starting something new, whether it be a business, a blog, or a malicious website that bricks someone's pc. You go into buying a domain with the thought "this domain name is going to be attached to website that's gonna be HUGE!".
The idea for this project genuinely came to me when I accidentally typed "Google" into Google Domains. I felt like a grandma who'd just typed Google into the Google Chrome search bar.
I was instantly intrigued though. For most, Google is synonymous with "Internet". They come across as a massive tech giant that can't be touched, so I found it quite funny and humbling that it was once possible to buy a google.x domain name.
I had one burning question though: were there any other Google domains left out there in the wild?
It was a big risk, I wasn't sure if there was.
My first thought was: How do I code something that tells me what domain names are left?
You might stop me right there and ask: "Why would you need to do that? There's so many different websites out there where you can search for and buy different domain names! GoDaddy? 101Domains? Squarespace?".
Well that's true, there's loads. But, as I learnt, each website is only selling a subset of the 1500 available top level domains that are currently released (as of May 2020). So, a website like Google Domains might have the rights to sell .soy, but another website like GoDaddy does not.
I needed a definitive list of which domains were available, and I couldn't find a good solution on the internet.
I therefore used Nodejs to write a really tiny (< 20 lines of Javascript) program to perform WHOIS queries to each top level domain name registry. It actually worked! Here is what the output for Facebook looked like:
I must stress it is definitely NOT kosher to do this. I'm not planning on releasing the code as I don't really want to encourage mass scraping of registries. But its not hard to imagine how it could be done.
I had my list for Google, now I needed to just buy a domain name. Super easy.
I was super wrong.
For each domain ending, I looked up who was the registry owner in IANA's Root Database, which usually also showed me a website where I could purchase the domain ending.
Things quickly went sour. I really thought this whole project was done for. Each domain name on that list had a problem associated with it that meant I couldn't register it. I talk about google.gi in my blog post, but another example was google.gop:
I was able to purchase google.gop, and I can even view a page that lets me manage the DNS records. However, its all fake. The domain hasn't actually be transferred over to me. My account just shows this:
To give a bit of context as to why I'm not able to buy these domains, you first need to understand how these top level domains are brought into the world.
Lets take a top level domain like .boats. This came into existence because one day some profiteering individual thought "hey! I think people are really going to want .boat domain names, I could make a killing selling these". This person goes to The Internet Corporation for Assigned Names and Numbers, or "ICANN" and pays $185,000 to get .boats live.
There is obviously a lot more that goes on here, you need to submit for a domain name that is unique and useful, and a lot of documentation is required. Its a really long process surrounded by a lot of red tape.
Once .boats is live though, the indivdual becomes a registry, and has to manage the database of .boat domain names. They also get to set the rules of who can register for one. For example, with .boats, you can only register if you're a member of the boating industry.
The problem I faced was that I was not meeting the requirements to register these domains. I also faced problems where domains had been reserved for Google in the future if they decided they wanted it, or, I was just plain not able to buy it because I could infringe on Google's trademark. This enforcement is great, and stops people sniping domains from other brands, and creating malicious websites that would damage the company's reputation.
I had a breakthrough when I started trying the weirder looking domains:
This is Punycode, which allows ASCII characters to be represented within domain names. It allows for Japanese, Chinese, Greek and other alphabets to be used in domain names. It also allows for fun things like Emoji domains.
I still had to try about 10 Punycode domains before I came across google.קום. After banging my head against the wall for so long, I still didn't believe it was available, even when the $33.71 left my account and the domain was sitting there in the "manage" section.
But, I hooked it up to a tiny website, set it live on the web. Holy moly it actually worked.
I quickly went on to purchase facebook.网站 and microsoft.みんな to complete my micro portfolio. I hope you enjoyed the terrible puns.
I think its pretty bad that I was able to pull this off. If I was evil, I could knock up a fake looking Google login page and be phishing for innocent people's usernames & passwords within hours. People may generally trust a .com domain, but with more and more top level domains being released, .coms are slowly becoming less relevant.
Some of you might be wondering: Are you going to get into trouble for buying the domains of these tech giants? Truthully, I don't really know. However, I don't believe I'm acting in bad faith, I'm not cybersquatting (just email if you want your domain back Google), and I'm not infringing on any trademarks.
Does a domain name count as a trademark? Tricky question. There's been cases like Chris Puchowicz vs Donald Trump and Tom Scott vs the UK Governmet, who both bought identical domain names to well known trademarks and created parody websites. Both websites are still running, even though they've been asked to take them down and been threatened with legal action. These are quite funny examples, but potentially there are other serious cases out there where the trademark owner did manage to take down the offending website and also sue for damages.
This project was fueled by the question: are there any other Google domains left out there in the wild? In the end I answered that question: Yes. I think I also exposed some pretty scary implications about how easy it is to get one.
Don't get me wrong. There are lots of measure in place to stop people buying these names (I experienced them). Google Domains even warned me about buying Netflix.soy. But, I still managed to slip through the net. Even if a website was up for a few days, or hours, damage could still be done.
There was not much building this week, but I feel I learnt so much about a topic I was really interested in.
Overall Tiny Projects is going great so far. Thank you everyone who's emailed, followed, tweeted or commented on my article about Tiny Websites. This website got over 100k views in a day. It was so exciting.
Next week I'm going to do a more code-based project. Bring on Week 2.