Finding a new hostname.. the brute force approach

Due to hosting costs, I decided to switch hosting companies. Because sourcelocation.net is part of the hosting package and I'm hosting my site in Germany (cheap) and I didn't want to go into moving sourcelocation.net (it's a boring name anyway) I decided to start looking for another hostname.

For those who read code, I did this:

#!/bin/bash
mkdir -p ~/hosts
egrep --no-filename -o '^[^[:space:]0-9]+' *.index > ~/hosts/words.txt
tr '[:upper:]' '[:lower:]' < words.txt |sort --unique > words_unique.txt
echo -n 'Words left: '
wc -l words_unique.txt

#Don't check any with dashes or number, simple as possible
egrep '^[a-z]+$' words_unique.txt > hostnames.txt

# Use only the 4 to 7 length domain names
egrep '^.{4,7}$' hostnames.txt > hosts.txt

echo -n 'Hosts left: '
wc -l hosts.txt

echo 'Check with DNS lookup (fairly safe)' 
for h in `cat hosts.txt`;do
	echo -n "$h "
	test -e stop && break
	resolveip $h.net >/dev/null 2>&1 || echo $h >> hosts_dnsfail.txt
done

echo -n 'Doing a whois on: '
wc -l hosts_dnsfail.txt

echo 'Check with whois lookup (may be snooped)'
for h in `cat hosts_dnsfail.txt`;do
	echo -n "$h "
	test -e stop && break
	whois $h.net|grep  'Domain Name: ' >/dev/null 2>&1 || echo $h >> hosts_whoisfail.txt
done

And ended up with logfish.net I first wanted goofish.net but that was already taken, so I decided to look for another kind of fish and ended up with logfish.

Now for those who don't, I'll explain.

I started with a dictionary: the dict.org dictionary files. After downloading I extracted them (for f in *.tar.gz; do tar -xzf $f;done) and took the words from the index files. The first word on the index files is the interesting part, so we tell egrep to only take the first word up to a space or number. Now any word ending in a number will be chopped down, so the first "with0inthemiddel" will become "with", which is sloppy but I didn't really care because I was going to do away with number later on anyway.

egrep --no-filename -o '^[^[:space:]0-9]+' *.index > ~/hosts/words.txt
tr '[:upper:]' '[:lower:]' < words.txt |sort --unique > words_unique.txt
echo -n 'Words left: '
wc -l words_unique.txt

After selecting the words, we translate (tr) the words to lowercase, sort them and only leave only single occurrences (sort --unique). I now had 192853 left.

Now we filter it down some more: drop the dashes and select only hostnames with between the 4 and 7 letters

egrep '^[a-z]+$' words_unique.txt > hostnames.txt
egrep '^.{4,7}$' hostnames.txt > hosts.txt

That left me with 62706 host names. On this we do a simple resovleip lookup (simple DNS lookup). This just checks to see if the hostname has an address attached to it, which is less intensive as doing a full whois.

for h in `cat hosts.txt`;do
	echo -n "$h "
	test -e stop && break
	resolveip $h.net >/dev/null 2>&1 || echo $h >> hosts_dnsfail.txt
done

I was looking for a hostname in the .net TLD, but if you feel like it you can change all .net to anything else you might want. The first filtering left 21027 hosts. This means that 41679 of the hosts list was already taken up. However, 33% is still something to choose from. Checking them all took about 5 to 10 hours, but it's not an intensive task.

Because you may want to stop in the middle of that time, you can do that by simply executing touch ~/hosts/stop, this is what the test -e is for. Also if you want to start over, make sure you (re)move hosts_dnsfail.txt to start with a clean list.

The last check is a full whois, this is also the least safe as there are some stories about how whois requests may be snooped:

for h in `cat hosts_dnsfail.txt`;do
	echo -n "$h "
	test -e stop && break
	whois $h.net|grep  'Domain Name: ' >/dev/null 2>&1 || echo $h >> hosts_whoisfail.txt
done;

Again the same stop check is done and basically the same checking. This left me with 15973 .net names that I could use! Which is about 25% of the original candidates. And I've decided to attach the file below so you can do your own hostname searching. Not sure how many will be gobbled up in the future, but you should be ok for a while. Still, I hate domain sitter, so I'm hoping to build a system to fight them later on (Hint: expand BlockSite for IP matching, add a button to load an external list, build a database interface to register, check and update a list like that).

Most files mentioned in this text can be found below. Happy hostname hunting to all!

Attachment	Size
words_unique.txt.gz	580.76 KB
hosts.txt.gz	158.6 KB
hosts_dnsfail.txt.gz	61.35 KB
hosts_whoisfail.txt.gz	48.65 KB

log of Logfish.net

Finding a new hostname.. the brute force approach