“Arms dealer” registrar probed by ICANN

ICANN’s top security thinkers are looking into hotly denied claims that an Israeli registrar collaborated with malware distributors.

Luckily for the registrar, GalComm, so far they’ve come up empty-handed and ICANN has told the company it does not consider it “malicious”.

ICANN told GalComm this week that its Security, Stability and Resiliency team is looking into a report published by security consultancy Awake Security in June entitled “The Internet’s New Arms Dealers: Malicious Domain Registrars”.

The report connected GalComm to over 100 malicious browser extensions, used to steal data, that have been installed 33 million times. GalComm was apparently the attackers’ registrar of choice.

While Awake did not report the registrar to ICANN, GalComm took it upon itself to write to ICANN to deny the allegations, saying that it merely acted as a neutral registrar and had no involvement in hosting or distributing the malware.

It also demanded that Awake retract its report and apologize or face legal consequences. The report is still available.

Now, ICANN has written back (pdf) to assure the registrar that its investigations to date has been “unable to corroborate the findings Awake Security presented and it does appear that Awake Security had an inaccurate picture of the total domains under management by GalComm”.

It added that the investigation is ongoing, however:

Based on the information we have been able to obtain to date, we have no reason to believe it appropriate for GalComm to be considered a “malicious domain registrar” as asserted by Awake Security. However, as noted in Awake Security’s report, the malicious actors behind the domains in question may be utilizing detection evasion techniques. As such, our investigations continue, and we appreciate GalComm’s cooperation and support of those investigations.

ICANN has previously told news outlets that it receives very few complaints about GalComm, none related to malware.

The two biggest registrars knock it out of the park in Q2

GoDaddy and Tucows, the industry’s two largest registrars, both last week posted very strong second-quarter results due to the beneficial impact of the coronavirus lockdown.

Market-leader GoDaddy in particular seems to have knocked it out of the park, adding a ridiculous 400,000 net new customers during the April-June period, the strongest quarterly performance in the company’s 20-year history.

The company reported domains revenue of $369.6 million, up 10.5% on the year-ago quarter, its strongest-performing segment.

Tucows, meanwhile, reported domains revenue essentially flat at $60 million, but pointed to registration growth as an indicator of its showing.

Tucows CEO Eliot Noss said in prerecorded remarks that new registrations from its reseller channel were up 41% in the quarter, with overall wholesale registrations up 7% to 4.3 million.

In the retail channel, domains under management was up 9% year-over-year to 400,000, with new registrations up more than 20%.

The CEOs of both companies were unambiguous that the coronavirus pandemic could take credit for their results. Noss said:

As expected, in Q2 we saw the full effects of the pandemic that we began to experience toward the end of Q1, with businesses globally moving quickly online, and displaced workers turning to entrepreneurship as the next stage in their career paths. A large proportion of that new registration activity was those resellers who focus on helping small and micro-sized businesses and start-ups establish a web presence for the first time.

GoDaddy CEO Aman Bhutani characterized the virus as a catalyst for businesses stubbornly remaining offline to finally get a web presence, telling analysts:

COVID-19 has pushed a number of people past the point of inertia where they were not adopting digital… because people have no choice but to go digital to support their businesses, we’re seeing people experimenting with ideas. We’re seeing people come online, even though they had hesitated to do it in the past.

Overall, GoDaddy reported revenue up 9.4% at $806.4 million. Its net loss was $673.2 million, due mostly to a one-time tax-related payment.

Tucows overall revenue was $82.1 million, down from $84.1 million, largely due to the drag factor of its recently restructured Ting Mobile business. Net income was $157,000, down from $2.6 million.

.bible-thumping anti-porn registrar goes titsup

An American registrar that prided itself on promoting .bible domain names and refusing to sell to pornographers has gone out of business.

PurityNames, which called itself “the only company that refuses to profit from pornography”, ceased operations July 27 and has had its accreditation agreement with ICANN voluntarily terminated.

In a notice on its web site, the company blamed its demise on “recent increases in regulatory requirements and costs as well as economic headwinds”.

Founded by seasoned ICANN policy expert Jim Prendergast, the company’s shutdown appears to have been handled the right way.

PurityNames’ small customer base has been transferred to 20-year-old Israeli registrar Domain The Net, and pre-paid hosting packages will be honored, according to the registrar.

The company was founded in 2011 in order to give registrants a “family-friendly” venue for registering names. It refused to deal with not only porn but also gambling and other “immoral” services.

It also actively promoted .bible domain names. Prendergast is an ICANN policy consultant for the .bible registry.

But apparently there was not much demand for either. As of March, PurityNames had 288 domain names under management, down from a 2015 peak of 536, and only 10 .bible registrations.

Tucows sells off Ting business, retreats into the back-end

Tucows has sold its Ting Mobile brand and customer based to DISH Network, repositioning itself as a provider of white-label back-end mobile services.

The company which is also the second-largest domain registrar, has found success in recent years as a mobile virtual network operator (MVNO) with Ting. Following the DISH deal, it will become a mobile services enabler, or MSE.

It’s basically a move away from providing customer-facing mobile services. Instead, it will provide the back-end technology platform, and DISH is its first customer.

CEO Elliot Noss said in a prerecorded statement:

We still get asked about the connective tissue between Domains and the mobile business, and it all boils down to our competence in billing, provisioning, and customer service for underserved technology markets.

He added that Tucows has been approached by other potential MSE partners over the years.

DISH gets to use the Ting brand for two years, with an option to acquire it at the end. Tucows will continue to offer Ting wired broadband services, but will change its name if DISH exercises the buyout option.

All Ting mobile customers have been handed over to DISH as of Saturday, but no money has changed hands up-front. Instead, Tucows expects to see increased margins over time from the cost savings and monthly fees DISH will pay it. It will also be paid for transitioning the business over to DISH.

Tucows expects the deal to be “neutral to slightly negative” to its 2020 earnings.

DISH is primarily a satellite television provider, but it entered the mobile market a month ago with the acquisition of Boost Mobile.

Israeli registrar denies “arms dealer” claims

Israeli registrar GalComm has denied being involved in a widespread malware distribution scheme after being fingered by a security outfit.

Last month Awake Security accused the registrar, officially Communigal Communication Ltd, of being “at best complicit in malicious activity”.

The firm published a report entitled “The Internet’s New Arms Dealers: Malicious Domain Registrars” which linked GalComm to a network of malicious Chrome browser extensions the firm said can steal sensitive data from users who have them installed.

It identified 111 such plug-ins, which it said have been downloaded 33 million times, using over 15,000 domains registered via GalComm.

GalComm has around 48,000 domains registered in gTLDs at the last count, so that’s a sizable percentage of the registrar’s business.

Awake came to the conclusion that GalComm was well-aware of what its customers were up to.

Now, the registrar has sent a cease-and-desist notice to Awake, CC’d to ICANN (pdf), in which it denies all knowledge and responsibility for the malware.

GalComm’s line, to summarize, is that it’s just a registrar, and that it has no obligation to monitor how its customers use their domains.

It adds that the domains in question amount to 10% of its DUM. Still a pretty big chunk.

The company wants Awake to retract its report by today, which it has not yet done, or it will call in the lawyers.

CSC becomes first foreign registrar to get the China nod

It’s probably not the best time, politically, to be bragging about doing business in China, but CSC has nevertheless just announced that it’s been given the nod to act as a registrar in China.

The company claims to be the first non-Chinese registrar to be given an official government license to operate in the country, though many registries have obtained one over the last few years since harsh new regulations came into power.

Under the Chinese rules, web site owners need a license to operate, and they can only register domains from approved registrars in approved TLDs.

It’s basically a great big censorship tool, but it doesn’t seem to have stopped every Chinese citizen from registering domains via foreign-owed registrars.

CSC has a corporate client base, so it’s got more incentive than most to follow the rules to the letter.

“CSC’s success in becoming licensed as a foreign-owned registrar positions the company as a go-to resource for global organizations doing business in China,” the company said in a press release.

Endurance also got a lockdown bump in Q2

Endurance International Group added its name to the list of registrars to see a lift from the coronavirus pandemic in the second quarter.

The company, which counts brands including Domain.com, BuyDomains and ResellerClub in its stable, this week upgraded its guidance for Q2.

Endurance said it added roughly 97,000 net subscribers in the quarter, compared to a loss of 13,000 in Q2 2019.

It expects revenue to be $274 million compared to an analyst consensus of $271.25 million, and adjusted EBITDA of about $84 million compared to the $76.3 million reported a year ago.

Cash bookings, perhaps a better indicator of actual sales during the quarter were up 5% year over year at $281.6 million.

Unlike other registrars and registries that have reported a lockdown bump, Endurance suggested that it performed well in spite of, rather than because of, the pandemic. In a statement, CEO Jeffrey Fox said:

As we entered the second quarter, the healthcare and economic uncertainties brought on by COVID-19 were impacting global businesses, including the millions of small businesses we serve. Despite these challenges, we remain focused on delivering value to our customers as they navigate this complex environment.

Endurance will report its Q2 results July 30.

One.com takes big chunk of Danish market with third acquisition this year

European registrar One.com says it is now the biggest player in the Danish market after acquiring rival Larsen Data, which does business as GratisDNS, for an undisclosed sum.

One.com says that the deal means it now sponsors over 400,000 of the 1.3 million extant .dk domains, making it the largest local registrar.

GratisDNS has been around since 2001. It’s not a big player in gTLDs, with only 550 names under management at the last count.

It’s the third announced acquisition by One.com this year. It also bought Dutch hosting provider Hostnet and Norwegian registrar SYSE.

The company also recently said that, like so many other registrars, business has been booming during the coronavirus pandemic as bricks-and-mortar businesses relocate online.

Interestingly, sales were up 55% year-on-year in locked-down Denmark, but only up 7% in quarantine-free Sweden.

One.com also runs the .one gTLD, which has almost 78,000 names in its zone file right now. The registrar has been offering first-year regs for free recently.

GratisDNS had planned to apply for a city gTLD for Copenhagen back in 2012, but failed to secure governmental interest.

Web.com acquires another of the original five registrars

Consolidation in the domain industry continues apace, with Web.com bringing one of the remaining original five competitive registrars into its stable for AUD 12.2 million ($8.3 million) in cash.

It’s acquiring an Australian company called Webcentral Group, which until last month was known as ARQ Group and before that as Melbourne IT.

Webcentral also runs the retail registrars Netregistry and, in New Zealand, Domainz. It has about 330,000 customers, though not all are registrants.

Web.com says the deal gives it a deeper footprint in the Aussie, Kiwi and Southeast Asian markets.

My records show that Webcentral had about 130,000 domains under management at the end of March on its Melbourne IT tag, down by about 6,000 year over year. That’s not counting regs in ccTLDs such as .au.

Netregistry had another 113,000 gTLD domains, down from 129,000 a year earlier.

After the deal closes, Web.com will own the three oldest active registrars as measured by IANA ID — Network Solutions, Register.com and now Melbourne IT. The latter two were among the first five to go live after ICANN introduced competition at the registrar level in 1999.

For Webcentral, the deal marks the conclusion of a three-stage sell-off that started over a year ago when it sold its TPP Wholesale business to UK consolidator CentralNic.

Then, this February, it announced the sale of its enterprise unit to private equity for AUD 36 million ($25 million). It had been publicly looking for a buyer for its remaining SMB registrar business for many months.

The root cause of the sell-offs appears to be the company’s crippling debt.

Webcentral had expected to be hit unfavorably by the coronavirus pandemic, but that was largely due to its exposure to the digital marketing market, via its WME brand, rather than dwindling domain sales.

GoDaddy blamed the same problem for its recently announced layoffs.

Webcentral is currently listed on the Australian Stock Exchange. Web.com itself fell into private equity hands in a $2 billion deal in 2018.

GoDaddy domains doing just fine during pandemic, lays off hundreds anyway

GoDaddy has announced hundreds of lay-offs as part of a restructuring made necessary by the coronavirus pandemic, but it says its domain name business is still doing pretty well.

The market-leading registrar late last week announced changes that will affect 814 of its US-based employees.

Hundreds will be laid off. Others will be offered jobs in states a thousand miles away from home.

But at the same time, GoDaddy increased its estimates for second-quarter revenue, saying its domain business is doing okay.

The main victims of the restructuring are those in outbound sales, employees who cold-call customers to up-sell them on high-margin products such as GoDaddy Social, a social media management service.

Because GoDaddy Social isn’t selling well any more, apparently due to the pandemic, 331 staff are losing their jobs.

There are another 213 employees, currently based in GoDaddy’s native Arizona, that will be moved into customer support roles — which for GoDaddy is also a up-sell role — instead.

Another 135 sales staff based in Iowa will be told to move to Arizona — well over 1,000 miles away — or lose their jobs.

GoDaddy will be closing both of its two offices in Austin, Texas.

Despite the carnage, the company seems to be treating its affected employees quite well by American standards.

They’ll all get paid until at least September 1, and get healthcare benefits (because this is America, where healthcare is a privilege that has to be earned by phone-jockeying) up to the end of the year.

GoDaddy had previously promised it staff that there would be no layoffs in Q2.

The company also said last week that it will make 1% more revenue that it had previously expected.

It now expects $790 million in Q2, up 1% on its previous guidance.

That increase is, according to GoDaddy, due to sales of domains and web sites.

This coincides with other industry evidence that domain sales are doing okay right now.