“appraisal tool”… Maybe that’s the leak?
How specifically are you finding information on these domains? I suspect somewhere along the chain there’s an exploitable link. If that’s not the case, then this looks like the add/drop scheme described in Bob Parsons link.