How to make $15,000 buying expired domains

•

A story about how someone (sadly not me) made $15,000 in crypto by buying expired domain names ⬇️

Handshake ( handshake.org ) is a blockchain-based alternative to domain names. To prevent squatters from buying popular names and reselling them, Handshake reserved the domains of the top 100,000 websites.

For example because Twitter.com is one of the most popular sites, the Handshake domain "twitter/" would be reserved for Twitter. To claim it, Twitter would need to configure some DNS settings to prove they own the .com, and they get their Handshake version for free.

In addition to that, they'd also get a bunch of Handshake tokens (HNS) which are currently worth about $0.20 a piece. The amount of tokens varies depending on website popularity. Twitter would get 630,133 coins (~$127,000 USD). Less popular sites get 503 coins ($100 USD).

Ok, so how do you make money knowing this? Assuming you don't have a top 100,000 website? Well, you buy one!

Domain names expire all the time. Maybe not Twitter.com – but I figured some of the top 100,000 sites might have. You could then register the domain and claim the $100 USD in tokens. I wrote a script to check all 100,000 domains. See if any are available.

First, I downloaded a JSON file (provided by Handshake) that contains a snapshot of the Alex top 100,000 websites that are eligible for the free coins. I then imported those into an SQLite database.

Next, I'd check the whois of each domain to see if it was still registered or available. This uses the iana.org/whois API behind the scenes.

Here's what the output looks like. This process took a few hours…

Of all the domains I checked, I found 464 domains (0.5%) that were supposedly available for registration. However, the script wasn't able to properly check every single domain name. Some WHOIS results couldn't be parsed, etc. Still there were probably 100's of eligible domains

Now comes the interesting part. Checking each domain to see if they were already claimed. Each domain could only be claimed once. So it's possible someone else already claimed the coins and then just let the name expire. Time to check the Handshake API!

This script uses the API found on dns.live to check each domain and see if the coins were already claimed or not. I didn't want to hammer their server so I made sure to add a delay between each API call. All the results were saved to the SQLite database.

The moment of truth! Did we find any eligible domains that are still unclaimed but available for registration? We did! 23 domains to be exact. That would only be $2,300 minus registration fees. But still not too bad. However…

When I registered insuranceinsure.tk (one of the domains that was eligible, unclaimed and available) I ran into a problem. To verify ownership and claim the tokens, you need to proof ownership through something called DNSSEC… Turns out .TK domains don't support that 😅

I checked the remaining 22 domains and they all had interesting ccTLD's. Such as .dz, .jp, .ir, etc. Turns out none of them support DNSSEC. So unfortunately I wasn't able to claim any tokens. It seems like I was too late. Someone else must have beat me to it…

The Handshake API responses not only included which domains are already claimed, but also by which wallet. So I ran one final database query…

There's one wallet with almost 150 claimed domains! With $100 USD per domain, that's $15,000 in claimed tokens! Assuming an average $10 registration fee per domain, that's $13,500 in profit 🤑

It's interesting there's a few more wallets like that. It's possible they are all owned by the same person. Because whoever came up with this trick first is likely to try it on ALL domains immediately. That's over $35,000 USD in free tokens 🤯

Because transactions in the blockchain are all public, we can figure out when these domains were claimed. e.hnsfans.com/address/hs1qjv5s285kv9ffwcjug3vtwsyly9v6tgag2eu8u7 Looks like it happened about a year ago. So yeah, I was way too late to the party 😅

There's still a small opportunity here to claim those remaining 23 domains (see below) with the special ccTLDs. You'd just need to wait until they support DNSSEC. Once they do, you should be able to make a nice profit.

You could register them now and hope DNSSEC support gets added before the renewal fees kill your potential profit. Or could you set up some sort of system/alert for when DNSSEC support is announced. I'll leave that as an exercise to the reader…

If you're interested in learning more about Handshake and its actual use case check out handshake.org If you had a GitHub account in 2019 with 15 or more followers, you can claim about $1,000 USD in free tokens. handshake.org/claim/