# Session Manifest: Namecheap Buy Now Domain Analysis
## Complete Research, Pipelines, and Creative Development

---

# PART I — DOMAIN RESEARCH

## Source Data

| File | Source | Size | Last Downloaded |
|------|--------|------|-----------------|
| `Namecheap_Market_Sales_Buy_Now.csv` | `d3ry1h4w5036x1.cloudfront.net/reports/` | ~85,600 rows | 2026-05-09 (fresh) |

**CSV Schema:** `permalink, domain, price, extensions_taken`

---

## RDAP Pipeline Architecture

### The Problem
Legacy WHOIS protocol is unusable at scale — Verisign throttles to ~4 queries/min, each query takes 5–15 seconds. For 10,000+ domains, this is not viable.

### The Solution
**RDAP** (Registration Data Access Protocol) is the modern HTTPS/JSON replacement. Key advantages:
- REST API over HTTPS — no TCP session negotiation
- Returns structured JSON (~2.5KB per response)
- ~100x faster throughput than WHOIS
- Better rate limits from all major registries

### Per-TLD RDAP Routing

| TLD | RDAP Server | Endpoint Pattern | Concurrency | Throughput |
|-----|-------------|------------------|-------------|------------|
| .com | `rdap.verisign.com` | `/com/v1/domain/{domain}` | 5 workers | ~500/min |
| .net | `rdap.verisign.com` | `/net/v1/domain/{domain}` | 5 workers | ~500/min |
| .org | `rdap.publicinterestregistry.org` | `/rdap/domain/{domain}` | 3 workers | ~200/min |
| .io | `rdap.nic.io` | `/domain/{domain}` | 2 workers | ~50/min |
| .co | `rdap.go.co` | `/v1/domain/{domain}` | 2 workers | ~50/min |
| .me | `rdap.identity.digital` | `/rdap/domain/{domain}` | 3 workers | ~150/min |

### Implementation

```bash
# TLD-aware parallel RDAP with xargs -P
cat domains.txt | xargs -P 5 -I {} sh -c '
  d="{}"
  tld="${d##*.}"
  case "$tld" in
    com|net) url="https://rdap.verisign.com/$tld/v1/domain/$d" ;;
    org)     url="https://rdap.publicinterestregistry.org/rdap/domain/$d" ;;
    io)      url="https://rdap.nic.io/domain/$d" ;;
    co)      url="https://rdap.go.co/v1/domain/$d" ;;
    me)      url="https://rdap.identity.digital/rdap/domain/$d" ;;
  esac
  created=$(curl -s --max-time 10 "$url" | grep -oP "(?<=eventDate\":\")[0-9]{4}" | head -1)
  [ "$created" -le 2022 ] && echo "$d => $created"
'
```

### Benchmarks
- **WHOIS**: 18 domains → timed out at 120 seconds (~0.15/sec)
- **RDAP (sequential)**: 5 domains → 3 seconds (~1.7/sec)
- **RDAP (parallel x4)**: 100 domains → 1.15 seconds (**~87/sec**)
- **Speed improvement**: **580x faster**

### For Production Scale (100K+ domains)
| Approach | Cost | Throughput |
|----------|------|------------|
| xargs -P (single machine) | Free | ~2K/min |
| Go/Node worker pool + rate limiter | Free | ~5K/min |
| WhoisXML Batch API | ~$100/mo | 50K/batch |
| DomainTools Iris | ~$500/mo | Unlimited |
| Multi-VPS fan-out (10 machines) | ~$50/mo | ~20K/min |

---

## Reputation Checking Toolkit

### Blocklist Sources Used

| Source | Type | Access | Status |
|--------|------|--------|--------|
| Disposable Email Blocklist (5,438 domains) | `disposable-email-domains/disposable_email_blocklist.conf` | Free, public | ✅ Used |
| Spamhaus Zen (IP + domain) | DNSBL | Query-refused (127.255.255.254) | ❌ Blocked from this IP |
| Barracuda BRBL (IP) | DNSBL | Open | ✅ Used |
| Spamcop (IP) | DNSBL | Open | ✅ Used |
| CBL / Abuseat (IP) | DNSBL | Query-refused | ❌ Blocked |
| SORBS (IP) | DNSBL | Open | ✅ Used |
| Mailspike (IP) | DNSBL | Open | ✅ Used |
| GBUDB (IP) | DNSBL | Open | ✅ Used |
| URIBL (domain) | DNSBL | Query-refused | ❌ Blocked |
| SURBL (domain) | DNSBL | Open | ✅ Used |
| URLhaus (malware) | API | Unauthorized | ❌ Needs API key |
| AbuseIPDB | API | Unauthorized | ❌ Needs API key |

### DNS Reputation Signals

| Signal | What It Tells You |
|--------|-------------------|
| **A record** | Has a website. Check content for spam/parking/legit use. |
| **MX record** | Has email configured. `0 .` = null MX (blocks all), Google/Proton/Zoho = active use. |
| **TXT / SPF** | `v=spf1 -all` = reject all (clean). `~all` = accepting mail. `+all` = open relay (red flag). |
| **rDNS** | Custom rDNS = dedicated mail infra. Generic = shared hosting. |
| **NS** | Afternic = domainer parking. Cloudflare = active site. NameCheap default = parked. |
| **CT logs** | SSL certs prove prior HTTPS use. Wildcard certs = subdomains = active infra. |
| **Wayback Machine** | Archived snapshots = web history. No snapshots = clean. |

---

# PART II — $5 DOMAIN INVENTORY

## Complete $5 TLD Breakdown

| TLD | Total | Aged (pre-2022) | % Aged |
|-----|-------|-----------------|--------|
| .com | 322 | 6 | 1.9% |
| .net | 22 | 0 | 0% |
| .org | 45 | Unknown (all spot-checked 2024-25) | ~0% |
| .io | 4 | Unknown (RDAP blocked) | ~0% |
| .co | 24 | Unknown (RDAP blocked) | ~0% |
| .me | 43 | Unknown (RDAP blocked) | ~0% |
| Garbage TLDs | ~10,300 | Not checked | N/A |
| **Total** | **~10,723** | **6 confirmed** | **0.06%** |

---

## Confirmed Aged $5 Domains (Full List)

### 1. championjets.com — 🥇 #1 PICK
| Attribute | Value |
|-----------|-------|
| Creator | 2015-05-31 |
| Age | **10 years** |
| NS | Afternic (ns1.afternic.com, ns2.afternic.com) |
| A record | 76.223.54.146, 13.248.169.48 (Amazon Global Accelerator) |
| MX | `0 .` (null MX — never email) |
| TXT/SPF | `v=spf1 -all` (blocks all mail) |
| SSL/CT history | **None** |
| Wayback Machine | **No snapshots** |
| Content | Afternic lander page (JS redirect to `/lander`, then Access Denied) |
| Subdomains | All resolve to Afternic IPs via wildcard |
| RBLs (IP) | Clean (Barracuda, Spamcop, SORBS) |
| Disposable blocklist | Not listed |
| **Risk** | **None** |
| **Name quality** | Two-word real compound ("champion jets") — aviation-themed, professional |

### 2. squaredealconsulting.com — 🚨 GOOGLE WORKSPACE HISTORY
| Attribute | Value |
|-----------|-------|
| Creator | 2016-05-27 |
| Age | **9 years** |
| NS | NameCheap default (dns1.registrar-servers.com) |
| A record | None |
| MX | **Google Workspace** (aspmx.l.google.com — 5 MX records) |
| TXT | `google-site-verification=ulQceiy25SIOLukHw2v6bGNVpaF7kOXLw_ZYoR_qDK0` |
| SSL/CT history | **2025-05-23** (SSL cert issued 2 weeks ago) |
| Content | HTTP 000 (no response) |
| **Risk** | **Medium** — former operating business with Google Workspace email. Google has a reputation score for this domain. Unknown if clean or flagged. |
| **Verdict** | Not recommended for email hosting. Unknown Google reputation is a liability. |

### 3. dyoxen.com — 🥉 OK PICK
| Attribute | Value |
|-----------|-------|
| Creator | 2016-06-01 |
| Age | **9 years** |
| NS | Afternic |
| A record | Afternic/Amazon IPs |
| MX | `0 .` (null MX) |
| TXT/SPF | `v=spf1 -all` |
| SSL/CT history | **Yes** — Let's Encrypt wildcard certs Aug 2018 to Apr 2019 (~8 months active use) |
| Wayback Machine | No snapshots |
| Content | Afternic lander |
| RBLs (IP) | Clean |
| **Risk** | **Low** — 2018-2019 SSL use is undocumented but current state is clean null MX |
| **Name quality** | Gibberish syllable ("dyoxen") — pronounceable but no meaning |

### 4. urbancodex.com — 🥈 #2 PICK
| Attribute | Value |
|-----------|-------|
| Creator | 2019-06-01 |
| Age | **6 years** |
| NS | Afternic |
| A record | Afternic/Amazon IPs |
| MX | `0 .` (null MX) |
| TXT/SPF | `v=spf1 -all` |
| SSL/CT history | **Yes** — Let's Encrypt wildcard certs Jun 2019 to Feb 2020 (~8 months active use) |
| Wayback Machine | No snapshots |
| Content | Afternic lander |
| RBLs (IP) | Clean |
| **Risk** | **Low** — 2019-2020 SSL use is undocumented, similar to dyoxen. Current state clean. |
| **Name quality** | **Best name of the lot** — "urban codex" = city code, city guide, dev framework. Extremely versatile brand. |

### 5. me-baan.com
| Attribute | Value |
|-----------|-------|
| Creator | 2020-05-22 |
| Age | **5 years** |
| NS | NameCheap default |
| A record | None |
| MX | NameCheap eforward (light forwarding only) |
| TXT/SPF | `v=spf1 include:spf.efwd.registrar-servers.com ~all` |
| SSL/CT history | None |
| Content | HTTP 000 |
| **Risk** | Low |
| **Name quality** | "Me baan" = "my home" in Thai/Hindi. Foreign language, niche. |

### 6. okayarchive.com
| Attribute | Value |
|-----------|-------|
| Creator | 2022 (exact date pending) |
| Age | **~3 years** |
| NS | Not checked |
| **Risk** | Low but barely aged |
| **Verdict** | Too young at 3 years. Minimal deliverability advantage. |

---

## Domains Sold During Session

| Domain | Price | Age | When Sold |
|--------|-------|-----|-----------|
| **fizzawizza.com** | $5 | 13 years (2012) | Between old CSV (19:24 UTC, May 8) and fresh CSV (May 9) |

fizzawizza was the best pick — completely blank slate, zero SSL, zero web, zero email. It was sold before we could act.

---

## Investigated & Rejected Domains

### Drop-Catch Domains (re-registered after dropping, prior owner history)
| Domain | Current Created | Real History | Issue |
|--------|-----------------|--------------|-------|
| **wccutv.com** | 2024-05-15 | SSL 2016-2022 (~6 yrs) | Name suggests former TV station domain. Trademark risk, backlinks, unknown broadcast history. |
| **pbqinc.com** | 2024-05-31 | SSL 2021-2022 (~1.5 yrs) | "PBQ Inc" sounds like a former business. Undocumented prior use. |

### Fresh Registrations (2024–2025)
| Domain | Created | Notes |
|--------|---------|-------|
| techtrico.com | 2024-05-30 | Genuinely fresh, blank, but 1 year — useless for deliverability |
| scrivle.com | 2025-07-01 | Fresh |
| esrantour.com | 2025 | Fresh |
| infocusmm.com | 2024 | Fresh |
| jakespeck.com | 2025 | Fresh |
| kalpgecesi.com | 2025 | Fresh |
| mirahtrek.com | 2025 | Fresh |
| muguper.com | 2025-05-19 | Fresh |
| pukuca.com | 2025 | Fresh |
| runexz.com | 2025 | Fresh |
| tezealma.com | 2025 | Fresh |
| ttkelce.com | 2025 | Fresh |
| wccutv.com | 2024-05-15 | Fresh (drop-catch, see above) |
| trysippure.com | 2025 | Fresh |
| quicklyv.com | 2025 | Fresh |
| gauchonest.com | 2025 | Fresh |
| stirformen.com | 2025 | Fresh |
| goldlogsa.com | 2025 | Fresh |

### Active Email Domains (red flags)
| Domain | Created | Issue |
|--------|---------|-------|
| **noxliquid.com** | 2025-08-15 | **Actively running email on OVH VPS.** A record → 51.178.138.94, MX → mail.noxliquid.com, SPF `~all`, rDNS → `mail1.noxliquid.com`. Operational mail server being sold while live. |

---

## Final Rankings: Best Domains for Email Hosting

| Rank | Domain | Price | Age | Risk | Action |
|------|--------|-------|-----|------|--------|
| 🥇 | **championjets.com** | $5 | 10 yrs (2015) | ✅ None | **BUY NOW** — Cleanest remaining pick |
| 🥈 | **urbancodex.com** | $5 | 6 yrs (2019) | ⚠️ Low (minor SSL history) | **STRONG BACKUP** — Best brand name |
| 🥉 | **dyoxen.com** | $5 | 9 yrs (2016) | ⚠️ Low (SSL history) | Acceptable alternative |
| — | **squaredealconsulting.com** | $5 | 9 yrs (2016) | 🚨 Medium (Google Workspace history) | Only if you want Google-tagged domain |
| — | **me-baan.com** | $5 | 5 yrs (2020) | Low (eforward only) | Niche foreign name |
| — | **okayarchive.com** | $5 | 3 yrs (2022) | Low | Too young |

---

# PART III — CREATIVE DEVELOPMENT

## urbancodex — Movie Concept

### The Front: Urban Planning Consultancy (PUBLIC)

> *"Decoding the urban future. We analyze city systems to help municipalities and developers build smarter communities."*

- Boutique consulting firm
- White papers on zoning, transit, sustainable development
- Conference presentations on smart cities
- Boring, legitimate, invisible

### The Reality: Russian IRA Influence Platform (SECRET)

The **Urban Codex** is the Internet Research Agency's master playbook for fracturing Western urban populations.

| Word | Public Meaning | Real Meaning |
|------|---------------|--------------|
| **Urban** | City planning & development | The **target**: Western urban populations. The cities where division causes maximum damage — London, New York, Berlin, Paris, Los Angeles |
| **Codex** | A book of best practices & standards | The IRA's **systematic methodology**. A codex is a manuscript, a rulebook, a bible. This is their bible for weaponizing social media against Western democracy |

### IRA Internal Usage

Inside the St. Petersburg troll farm, "the codex" refers to the compiled playbook of:
- Every persona template (angry veteran, concerned mom, woke activist, libertarian crypto bro)
- Every narrative calibration per city (racial tension in Chicago, housing crisis in London, immigration in Berlin, election distrust in Atlanta)
- Real-time sentiment dashboards tracking 30+ Western cities
- Automated content generation tuned to each urban demographic's psychological profile

The header on every monitor: **URBANCODEX v4.2 — TARGET ACQUISITION MODULE**

### Dramatic Scene Beat

```
INT. SERVER ROOM — ST. PETERSBURG — NIGHT

A dimly lit room. Dozens of monitors showing real-time
social media sentiment for 30 Western cities.
Every screen header reads: URBANCODEX v4.2.

A character leans in, squinting at a monitor.

                    CHARACTER
           urbancodex.com...

They pull out a phone, type the URL.
The site loads: sleek, professional.
"Urban planning for tomorrow's cities."

                    CHARACTER (V.O.)
           It's not a consultancy.

They zoom in on the login button at the
bottom of the page.

                    CHARACTER (V.O.)
           'Urban' isn't the place.
           It's the people. The people
           they're manipulating.

They click LOGIN. The page redirects.
A Russian-language dashboard appears.
City names scroll: LONDON, NEW YORK,
BERLIN, PARIS, ATLANTA...

                    CHARACTER (V.O.)
           And 'codex'...
           They literally wrote the book
           on how to tear them apart.
```

---

## Key Supporting Materials

### Existing Files in Workspace

| File | Contents |
|------|----------|
| `buynow_email_host_top10.md` | Initial top 10 report (now superseded by exhaustive search) |
| `yym_me_research.md` | Deep dive on yym.me (actively used personal VPS dashboard — rejected) |
| `buynow_top20_com.md` | Top 20 .com analysis (bifurcation between vintage $19K+ and fresh $5-40) |
| `research_three_aged_com.md` | Deep dive on fizzawizza, championjets, dyoxen |
| `research_urbancodex_wccutv.md` | Deep dive on urbancodex and wccutv (drop-catch discovery) |
| `buynow_exhaustive_search.md` | Exhaustive $5-$70 search methodology and findings |
| `research_pbqinc_techtrico_noxliquid.md` | Deep dive on three rejected candidates |
| `ip_check_noxliquid.md` | OVH IP 51.178.138.94 blocklist check (noxliquid.com) |
| `domains_over_10_years_under_10.csv` | Rebuilt auction list filter (4,387 verified aged domains) |
| `Namecheap_Market_Sales_Buy_Now.csv` | Fresh Buy Now CSV (~85K domains) |

### Key Tools & Commands

```bash
# Download fresh Buy Now CSV
curl -sL "https://d3ry1h4w5036x1.cloudfront.net/reports/Namecheap_Market_Sales_Buy_Now.csv" \
  > Namecheap_Market_Sales_Buy_Now.csv

# Filter $5 .com domains  
awk -F',' 'NR>1 && $2 ~ /^[a-zA-Z0-9-]+\.com$/ && ($3+0)==5 {print $2}' \
  Namecheap_Market_Sales_Buy_Now.csv

# Parallel RDAP with xargs
cat domains.txt | xargs -P 5 -I {} sh -c '
  created=$(curl -s --max-time 10 "https://rdap.verisign.com/com/v1/domain/{}" \
    | grep -oP "(?<=eventDate\":\")[0-9]{4}" | head -1)
  [ "$created" -le 2022 ] && echo "{} => $created"
'

# DNS sweep
dig +short A,MX,TXT,NS domain.com

# CT log check
curl -s "https://crt.sh/?q=domain.com&output=json"

# Disposable email blocklist
curl -sL "https://raw.githubusercontent.com/disposable-email-domains/\
disposable-email-domains/master/disposable_email_blocklist.conf"

# IP RBL check
rev=$(echo "$ip" | awk -F. '{print $4"."$3"."$2"."$1}')
dig +short A "$rev.b.barracudacentral.org"
dig +short A "$rev.bl.spamcop.net"
```