Drop catching: I wrote a bot and accidentally DDoSed a registry

Hey folks so I wrote a dropcatch bot for a ccTLD that shall remain nameless. Super stoked about it, ran it on a OVHcloud VPS (https://www.ovhcloud.com/en/vps/), polling every 2 seconds against the registry whois server. 72 hours later: IP banned, nastygram from their ops team, almost got my account terminated.

Turns out I was doing like 43k queries/day and their rate limit is 100/hour. Whoops. I thought I was being polite with 2 second intervals lol. The bot was just a python script with zero backoff, just while True: query()

Lessons:
- read the TOS before you code, not after
- exponential backoff is not optional
- I got lucky, they accepted my apology and explanation
- now I am contributing to an open source throttling library so other people dont do this

The registry actually has a formal channel for high-volume queries that I found out about later. Rrp or something? Not whois. If anyone knows details drop em here. Gonna fix my mistakes and share the fix.

Thank you for sharing this candidly, @marcus_qc. I have seen similar situations with customers running monitoring scripts on their infrastructure.

A few notes from my side:
- Most registries offer a port 43 whois rate limit of 50-100 queries per hour
- Some offer authenticated channels with higher limits via agreement
- I generally recommend checking with the registry's technical contact before deploying automated tools

I would be happy to review your throttling library implementation via DM if that would be helpful. Their network operations team has worked with several ccTLD operators and may have relevant contacts to share.

— Jane @ Contabo

My server has cron job checking domain expiry, this is same problem xd, I set this for every 5 minute and registry send angry email no they not tell limit in TOS, this is hidden somewhere. Now I use this for 1 hour and no problem.

This is for .pl registry, they have different rule than others, this is confusing. No I think all registry should publish limit clear on website, not bury in PDF. I fix my script with sleep and random delay, now this is good. Xd

I did same thing with a wordpress plugin once haha it was checking domain availability for a multisite install every page load hit whois 200 concurrent users yeah that went bad fast host threatened to nullroute me I just switched to a local cache with 24hr ttl problem solved no fancy backoff needed just stop hammering the server haha

Best practices for registry query automation:

- Review the registry's published acceptable use policy
- Implement exponential backoff starting at minimum 60 seconds
- Cache all responses locally; do not query for unchanged data
- For high-volume requirements, contact the registry directly for:
* Bulk access agreements
* RDAP service credentials
* Data escrow participation

Hetzner https://www.hetzner.com maintains formal agreements with multiple ccTLD operators for legitimate bulk query access. Unauthorized automated access may result in permanent IP restriction and potential legal action under computer fraud statutes.

I run about thirty client sites on Hetzner and learned this the hard way after my drop-catching bot got out of hand.