By reading their FAQ it appears that they use DNS NS records (not WHOIS) to check whether a domain is registered or not. That's relatively safe from leaking. T

By reading their FAQ it appears that they use DNS NS records (not WHOIS) to check whether a domain is registered or not. That's relatively safe from leaking. They are showing suggested alternative domains for sale through BuyDomains.com. It's possible they have a database of available domains, but they may also be using an API which would leak searches.