EXAMPLE ONLY — all numbers, names and registrars on this page are invented, to show how results would be presented. It says nothing about any real company.
Example report · 12/04/2027
Results after 90 days
In this made-up scenario, names added to the cart at Registrar A were registered by a third party more often than control names. The pattern was not seen at Registrars B and C. The data does not show who registered the names or why.
Names
300
6 searched groups + control
Registered by others
9
3.0% overall
Control registered
0 / 60
near-zero baseline
Started
05/01/2027
90-day window
Share registered, by group
Fake data
Registrar A Registrar B Registrar C Control
Table view
| Registrar | Action | Names | Registered | Rate | p vs. control |
|---|---|---|---|---|---|
| Registrar A | Search + cart | 40 | 6 | 15.0% | 0.003 |
| Registrar A | Search only | 40 | 2 | 5.0% | 0.158 |
| Registrar B | Search + cart | 40 | 0 | 0.0% | 1.000 |
| Registrar B | Search only | 40 | 0 | 0.0% | 1.000 |
| Registrar C | Search + cart | 40 | 1 | 2.5% | 0.400 |
| Registrar C | Search only | 40 | 0 | 0.0% | 1.000 |
| Control | Never searched | 60 | 0 | 0.0% | — |
One-sided Fisher exact test against the control. Six groups were tested, so a single p-value near 0.05 is weak evidence on its own; only the Registrar A cart group is clearly separated from the control here.
Timing
Fake data
Registrar A (80 names) Registrar B (80 names) Registrar C (80 names) Control (60 names)
Table view
| Group | Names | Registered | Days after search |
|---|---|---|---|
| Registrar A | 80 | 8 | 1.2, 1.9, 2.8, 3.3, 6.1, 9.4, 11.0, 17.5 |
| Registrar B | 80 | 0 | — |
| Registrar C | 80 | 1 | 41.3 |
| Control | 60 | 0 | — |
Registrar A's registrations cluster in the first days. The single registration at Registrar C came 41 days after the search, which is more consistent with an independent registration.
Registered names (example)
| Domain | Searched on | Action | Registered (UTC) | Delay | Registered via |
|---|---|---|---|---|---|
| examplealpha.com | Registrar A | 12/01/2027 09:42 | 1d 04:05 | Registrar X | |
| examplebeta.com | Registrar A | 17/01/2027 14:05 | 2d 19:12 | Registrar X | |
| examplegamma.net | Registrar A | 24/01/2027 03:31 | 9d 02:24 | Registrar Y | |
| exampledelta.com | Registrar C | 19/03/2027 22:10 | 41d 07:12 | Registrar Z |
Action: search only search + added to cart never searched (control)
How to read this
- The control group had 0 of 60. That sets a near-zero base rate, so even a few registrations in a group stand out.
- Registrars B and C show no clear effect. If the leak were on the user's side (an extension, a network), every group would show it.
- This shows an association between searching on a registrar and later registration. It does not prove intent or identify who registered the names.
- The result should be replicated, ideally by someone else with a different connection.
Registrar response
[Registrar A was sent these findings on 12/04/2027 with a deadline of 26/04/2027. Their reply, unedited, would appear here. If there is no reply by the deadline, that is stated here too.]
Verify it yourself
- Assignment list hash and its OpenTimestamps receipt:
manifest-2027-01-04.txtand.ots(example). - Raw data:
domains.csv,search_log.csv,rdap_checks.csv. Each screenshot's SHA-256 is insearch_log.csv. - Any name can be checked by anyone with an RDAP lookup.