How I got a new domain name

Welcome! If you're reading this, you might have noticed that my blog and this post is on my new domain name frederikbraun.de.

And here is the story. The story of a young nerd in the 1990s. The story of my aunt, who went to the Miniatur Wunderland, left the tourist attraction, got past the secretary, and asked the owner if he still needs his domain name.

Many years ago

The story starts in my older brother's room. I was about 16 years old and it was around the year 2000. Back then, I didn't have my own internet access. While I did have my own PC, only my brother and his PC were connected. This was for one main reason: We had to run a long ethernet cable from the phone connection to the PC and through the whole flat. This ~20m cable was a solid tripping hazard and also, more importantly, well protected by my older brother.

Anyway, somedays as I was sitting in my brother's room hanging out on IRC and learning about computer stuff, I learned about how one could get their own domain name and host web pages. A very exciting topic back then. (To save my personal reputation, all of my teenage home pages will remain unknown.)

The domain name I wanted to register at that time was frederikbraun.de, my real name as a cool and nerdy place on the internet that I could use as an email or homepage.

Back in the day, other kid who had an email address was at hotmail, yahoo or gmx. It was clear to me that I could really show my extreme technical prowess by having my own domain name for basic internet stuff. (Remember, this was the 1990s and I was a teenager. Of course I wanted to "show it to the whole world".)

Anyway, by the time I figured out how to register a domain name, I realized that the most interesting variations of my name were taken. Not only were they taken, they were all redirecting to a small model train museum in Hamburg.

Aside: For those who don't know, the Miniatur Wunderland is now the largest model railway system in the world and the most popular tourist attractions in Germany. (Though I have never actually visited).

I then went to look at the DENIC (registry for .de names) website and tried their WHOIS client to learn more. "He's got the domain, he's using it to promote his business likely also for email". I was stuck.

For years, I kept on checking the WHOIS entry regularly, looking for a potential expiration date. But then, at some point, I had to admit defeat and get some other domain names. (And as it goes with the stereotypical nerd, many domains names: frederik-braun.com, security.plumbing, 0e.vc, ...).

Fast forward to the 2020s

At some point last year, I remembered this old story. I remembered that it would still be nice to get my domain name. So, I opened a new Firefox tab and tried to open the page.

Huh. Nothing? The page didn't load. Oh wow, I thought. Am I lucky? Did the domain name expire? Turns out: No. The DNS entries are all wrong, but the domain name is still registered. At this point, I tried to learn more, but starting 2018, the registrar for .de DENIC stopped supplying personal information in WHOIS to comply with GDPR. So, what could I do? All I could learn was a broken DNS record and a WHOIS entry with the "tech admin" contact for the domain name. The admin contact pointed to a small IT company in Hamburg, so my guess was that the domain name was still owned by the same Frederik as 20 years ago.

I tried probing the MX records and to my surprise, the domain name wasn't even used for email addresses! At this point, it became clear that the domain name was perpetually renewed by its owner, yet completely unused. I would just have to reach out... but how?

How do you personally reach the owner of Germany's most popular tourist attraction?

I don't claim to have any OSINT skills but I tried searching around on the net. Lots of boulevard stuff mostly. No page about the owners of the Wunderland on their homepage either. Then I tried LinkedIn, but no luck. It only shows you people you're conneceted with, and then a hop or two. I also tried a free LinkedIn Premium account. Still no luck.

I felt like I was stuck. Again.

IRL

This all changed when our family visited my aunt earlier this spring. My aunt told me that she will be going to the Miniatur Wunderland with her colleagues from work the following week. I reminded her how funny it was, that its owner is also called Frederik Braun. We wondered if she could ask around, see if she can get an email address of the other Frederik.

And so she did: She walked right out of the tourist attraction and found his office. Naturally, the secretary tried to fend her off. "The boss is busy, lots of meetings. No can do". Then, just when she tried to tell the whole story to the secretary again, the owner walked by from the other direction. He wasn't even in his office.

So my amazing aunt told the story again. The other Frederik heard the story and found it very amusing. It's apparently not the first time for him to have found a namesake. He asked if I am the opera singer of the same name (What?) and told her the email address I should use to reach out.

The End

And that's what happened: I sent a polite email sharing my story and a couple of weeks later here we are.

My blog is now on frederikbraun.de.

Thanks to Abhishek Nagekar for reading the draft of this blog post. The remaining mistakes are all mine :)

If you find a mistake in this article, you can submit a pull request on GitHub.

Other posts

  1. Prompt Injections and a demo (Wed 18 September 2024)
  2. The Mozilla Monument in San Francisco (Fri 05 July 2024)
  3. What is mixed content? (Sat 15 June 2024)
  4. How I got a new domain name (Sat 15 June 2024)
  5. How Firefox gives special permissions to some domains (Fri 02 February 2024)
  6. Examine Firefox Inter-Process Communication using JavaScript in 2023 (Mon 17 April 2023)
  7. Origins, Sites and other Terminologies (Sat 14 January 2023)
  8. Finding and Fixing DOM-based XSS with Static Analysis (Mon 02 January 2023)
  9. DOM Clobbering (Mon 12 December 2022)
  10. Neue Methoden für Cross-Origin Isolation: Resource, Opener & Embedding Policies mit COOP, COEP, CORP und CORB (Thu 10 November 2022)
  11. Reference Sheet for Principals in Mozilla Code (Mon 03 August 2020)
  12. Hardening Firefox against Injection Attacks – The Technical Details (Tue 07 July 2020)
  13. Understanding Web Security Checks in Firefox (Part 1) (Wed 10 June 2020)
  14. Help Test Firefox's built-in HTML Sanitizer to protect against UXSS bugs (Fri 06 December 2019)
  15. Remote Code Execution in Firefox beyond memory corruptions (Sun 29 September 2019)
  16. XSS in The Digital #ClimateStrike Widget (Mon 23 September 2019)
  17. Chrome switching the XSSAuditor to filter mode re-enables old attack (Fri 10 May 2019)
  18. Challenge Write-up: Subresource Integrity in Service Workers (Sat 25 March 2017)
  19. Finding the SqueezeBox Radio Default SSH Password (Fri 02 September 2016)
  20. New CSP directive to make Subresource Integrity mandatory (`require-sri-for`) (Thu 02 June 2016)
  21. Firefox OS apps and beyond (Tue 12 April 2016)
  22. Teacher's Pinboard Write-up (Wed 02 December 2015)
  23. A CDN that can not XSS you: Using Subresource Integrity (Sun 19 July 2015)
  24. The Twitter Gazebo (Sat 18 July 2015)
  25. German Firefox 1.0 ad (OCR) (Sun 09 November 2014)
  26. My thoughts on Tor appliances (Tue 14 October 2014)
  27. Subresource Integrity (Sun 05 October 2014)
  28. Revoke App Permissions on Firefox OS (Sun 24 August 2014)
  29. (Self) XSS at Mozilla's internal Phonebook (Fri 23 May 2014)
  30. Tales of Python's Encoding (Mon 17 March 2014)
  31. On the X-Frame-Options Security Header (Thu 12 December 2013)
  32. html2dom (Tue 24 September 2013)
  33. Security Review: HTML sanitizer in Thunderbird (Mon 22 July 2013)
  34. Week 29 2013 (Sun 21 July 2013)
  35. The First Post (Tue 16 July 2013)
π