ICANN security advisor predicts “hundreds” of new gTLDs will “go dark”

A security company led by a member of ICANN’s top security committee reckons that “hundreds” of new gTLDs are set to fail, leading to web sites “going dark”.
Internet Identity, which provides threat data services, made the prediction in a press release this week.
IID’s CTO, quoted in the release, is Rod Rasmussen. He’s a leading member of the Anti-Phishing Working Group, as well as a member of ICANN’s influential Security and Stability Advisory Committee.
He has a dim view of new gTLDs:

Most new gTLDs have failed to take off and many have already been riddled with so many fraudulent and junk registrations that they are being blocked wholesale. This will eventually cause ripple effects on the entire domain registration ecosystem, including consolidation and mass consumer confusion as unprofitable TLDs are dropped by their sponsoring registries.

The press release acknowledges that ICANN has an Emergency Back-End Registry Operator (EBERO) program, which will keep failing gTLDs alive for up to three years after the original registry operator goes out of business.
But it continues:

questions abound as to who would risk an investment in poorly performing TLDs, especially as they start to number in the hundreds. “That’s why eventually some are going to just plain go dark,” added Rasmussen.

The prediction is for “2017 and beyond”. Given the existence of the EBERO, we’re probably looking at 2020 before IID’s claim can be tested.
It’s a bit of a strange prediction to come out of a security company.
The whole point of EBERO is to make sure domain names do not go dark, giving either the registry the chance to sell on the gTLD or the registrants a three-year heads-up that they need to migrate to a different TLD.
It would be a bit like being told that there’s a horrible bit of malware that is set to brick your computer, but that you’ll be fine if you change your anti-virus provider in the next three years.
I could live with that kind of security threat, personally.
But what are the chances of hundreds of live, non-dot-brand going fully post-EBERO dead in the next few years?
I’d say evidence to date shows the risk may be over-stated. It may happen to a small number of TLDs, but to “hundreds”?
We’ve already seen new gTLD registries essentially fail, and they’ve been taken over by others even when they’re by definition not profitable.
Notably, .hiv — which has a contractual agreement with ICANN to not turn a profit — failed and was nevertheless acquired by Uniregistry.
We also see registries including Afilias and Donuts actively searching for failing gTLDs to acquire.

Complaints over 50% .uk price hike

.uk registrars are petitioning Nominet to complain about plans to increase the price of a .uk domain name by up to 50%.
The registry announced the price increase, which will come into effect March 1 next year, on Wednesday.
A one-year registration will go up to £3.75 ($5.65) wholesale, still cheaper than any gTLD I can think of.
Currently, Nominet charges £3.50 for a one-year reg and £2.50 per year for multi-year registrations.
The company heavily hinted, in an email, that some of this extra cash will wind up in registrars’ pockets, due to promotional spending:

Our new pricing strategy aims to accomplish three things. Firstly, as with any business the price we charge is linked to our ability to deliver a fantastic service. Secondly, we want to invest in the .UK namespace to ensure we can differentiate over the long-term. Thirdly, we want to be able to invest in marketing and promotions in order to secure prominence at point of sale – which our current pricing levels cannot support.

The price of a .uk domain has not increased since 1999, Nominet said.
Increasing the price from a posh coffee to a London beer is presumably not a big deal for most registrants, but domainer-registrars are unhappy.
Andrew Bennett of Netistrar has set up a web site at egm.uk to call for “outraged” registrants and Nominet members to voice their opposition to the changes.
The site points out that Nominet has said it will review its pricing annually.
It calls on Nominet to have a three-month public consultation then a member vote before introducing the changes.
At time of publication, 77 registrants and 47 Nominet members have signed the petition.
On its web site, Nominet lists 2,048 members.

Verisign warns about Chinese .com boom

Verisign has warned investors that the current boom in .com sales is largely coming from Chinese domainers and may not be sustainable.
The company has added an unprecedented 4.1 million domain in .com and .net so far during the fourth quarter.
“While there continues to be demand for domain names globally, the recent increased volume for Verisign’s top level domains, as well as top level domains of other registries, during the fourth quarter is coming largely through registrars in China,” the company said in a Securities and Exchange Commission filing.
It listed several factors that are likely responsible for the sudden uptick, but warned that renewal rates are typically not great.

In the past, Verisign has discussed many factors that affect the demand for domain names, including, but not limited to economic, social, and regulatory conditions, Internet adoption, Internet penetration, and increasing e-commerce. In addition to these factors affecting demand, Verisign is also evaluating additional potential factors unique to China that may also be responsible for the recent increased volume of new registrations in China.
In no particular order, these potential factors, or combination of factors, could include, but may not be limited to, government initiatives in China to develop their online economy such as ‘Internet Plus;’ registry and registrar regulatory requirements; cultural influences such as the popularity of numeric domain names; increasing competition amongst Chinese registrars; potential increases in domain name investment activity; and recent capital markets volatility and access to capital in China.
Verisign cannot predict if or how long this increased pace of gross additions will continue and we cannot at this time predict what the renewal rate for these domain names will be. Verisign has noted in the past that renewal rates for domain names registered in emerging markets, such as China, have historically been lower than those registered in more developed markets.

It’s difficult to imagine that Chinese investors have managed to find four million unregistered domains worth keeping.
There are currently 123,497,852 domains in the .com zone file, according to Verisign’s web site.
Verisign is not the only registry that appears to be benefiting from a deluge of registrations from China.
XYZ.com has seen over 440,000 domains added to its .xyz zone file in the last three weeks, bringing its total to over 1.5 million, which appear to be largely coming through Chinese registrars.

Verisign v XYZ judge confirms both companies suck

Verisign and XYZ.com have both come out of a US lawsuit looking like scumbags.
Explaining his dismissal of Verisign’s false advertising lawsuit against .xyz registry XYZ.com, Virginia judge Claude Hilton today said that XYZ.com’s statements about its registration numbers were “verifiably true”.
At the same time, he confirmed that they came about as a result of a bullshit deal with Network Solutions to bolster .xyz’s launch numbers.
The judge’s ruling confirms for the first time the financial details of the deal between XYZ and Web.com (Network Solutions) that saw .xyz’s registration volume rocket in its first few weeks of general availability. He wrote:

Web.com purchased 375,000 domain names for a price of $8 each totaling $3 million dollars. In exchange, XYZ purchased advertising from Web.com in the form of 1,000 impressions for $10 each, at a total cost of $3 million dollars. Instead of cash exchanging hands, advertising credit was given to XYZ and the .xyz domain names were given to Web.com, who subsequently gave them away as free trials to their subscribers.

In other words, XYZ bought $10,000 of advertising for $3 million and paid for it with $3 million of free .xyz domains — 375,000 of them.
That bogus deal enabled XYZ to report big reg volume numbers without actually, legally, lying,
“The statements regarding Defendants’ revenue and number of registrations are statements of fact that are verifiably true,” the judge wrote.

When the Defendants [XYZ.com] stated they were a market leader in new TLD’s and that they had the most new registrations than any other TLD, they were basing that information off of an accurate zone file. Further, the zone file confirms that there are over 120 million .com registrations and one {1) million .xyz registrations. These statements are also true.

The judge said he was dismissing the suit not just because XYZ wasn’t lying, but also because Verisign couldn’t show that it had been harmed.
The number of .com registrations has actually been going up, he noted.
Much of Verisign’s complaint centered on this ad:

Verisign said the ad lied about the availability of .com domains, which XYZ denied.
The judge said:

The video posted to YouTube is puffery and opinion. It displays no actual domain names, and communicates a subjective measure of value and superiority, not capable of being proven false.

“Puffery” is a term with legal weight in false advertising cases under US law. It basically means that advertisers are allowed to exaggerate. XYZ had in fact used the “puffery” defense.
The judge seems to have relied heavily on zone file analysis to reach his conclusions. He wrote.

according to Plaintiff’s [Verisign’s] own data, .com names are largely unavailable. In a given month, Plaintiff reports that it receives about two (2) billion requests to register <.com> domain names, yet fewer than three (3) million are actually registered.

I believe that “two billion” number refers to how many “attempted adds” Verisign gets every month for .com domains, as reported in its monthly reports with ICANN.
That number would include every automated attempt to register a dropping domain by every registrar.
It’s not a reflection of how many actual human beings attempt and fail to register .com domains and, in my view, it’s worrying that the judge took it to mean that.
In summary, the lawsuit managed to unearth the dirty reality behind XYZ’s launch “success”, whilst also making Verisign look like a petty, petulant, child.
Everybody loses.
Except the lawyers, obviously, who have been paid millions.

ICANN reveals 12 more data breaches

Twelve more new gTLD applicants have been found to have exploited a glitch in ICANN’s new gTLD portal to view fellow applicants’ data.
ICANN said last night that it has determined that all 12 access incidents were “inadvertent” and did not disclose personally identifiable information.
The revelation follows an investigation that started in April this year.
ICANN said in a statement:

in addition to the previous disclosures, 12 user credentials were used to access contact information from eight registry operators. Based on the information collected during the investigation it appears that contact information for registry operators was accessed inadvertently. ICANN also concluded that the exposed registry contact information does not appear to contain sensitive personally identifiable information. Each of the affected parties has been notified of the data exposure.

The glitch in question was a misconfiguration of a portal used by gTLD applicants to file and view their documents.
It was possible to use the portal’s search function to view attachments belonging to other applicants, including competing applicants for the same string.
Donuts said in June that the prices it was willing to pay at auction for gTLD string could have been inferred from the compromised data.
ICANN told compromised users in May that the only incidents of non-accidental data access could be traced to the account of Dirk Krischenowski, CEO of dotBerlin.
Krischenowski has denied any wrongdoing.
ICANN said last night that its investigation is now over.

English beats Portuguese in $2.2m .hotels auction

Booking.com has won the right to operate .hotels after an auction concluded a protracted fight over the gTLD.
In an ICANN-run auction yesterday, Booking.com prevailed with a winning bid of $2.2 million.
Its sole competitors was Travel Reservations (formerly Despegar Online), which had applied for the Portuguese word .hoteis.
In 2012, a String Similarity Review panel concluded that .hotels and .hoteis look too similar to coexist, due to the likelihood of confusion between I and l in sans-serif fonts.
Neither applicant agreed with that decision, knowing that it would result in a expensive auction, and Booking.com filed a Request for Reconsideration and then, in March 2013, an Independent Review Process complaint.
After two years, it lost the IRP. But the panel said it had “legitimate concerns” about the fairness of the SSR process and ordered ICANN to pay half of its costs.
Now, Booking.com has had to fork out another $2.2 million for the string.
That’s not particularly expensive as ICANN-auctioned gTLDs go. Eight of the 13 other strings ICANN has auctioned have sold for more.
ICANN’s auction proceeds to date now stands at $63,489,127, which is being held in a separate bank account for purposes yet to be determined.

.pro now open to all

Afilias today made the .pro gTLD available to anyone, regardless of their professional qualifications.
The previously restricted TLD was able to do so as a result of its six-week-old contract with ICANN, which loosened many of the conditions former registry RegistryPro originally agreed to when the TLD was delegated 13 years ago.
Under the original Registry Agreements, RegistryPro — since acquired by Afilias — had to verify the professional credentials of potential registrants.
Now that .pro has been brought under something that looks a lot like the 2012 new gTLD RA, it’s pretty much a free-for-all.
The registry said in a press release:

despite demand from registrants and registrars alike, .PRO names have historically been denied to professionals from a wide range of fields such as policemen, firefighters, journalists, programmers, artists, writers, and many others.

In my personal experience, it has been possible to register a .pro domain without providing credentials. I’ve been paying for one for a few years, though I’ve been unable to actually use it.
The gTLD was approved in the original, first round of new gTLD applications, back in 2000.
Part of the original deal was that it would be restricted to three classes of professions — lawyer, doctor, accountant — and only available to buy at the third level.
The third-level limitation was lifted many years ago, but .pro continued to be restricted to people who could show a credential.
However, even as recently as 2012 then-RegistryPro-CEO Karim Jiwani was telling DI that the secret to growth was more restrictions, not less.
He’s no longer with the company.
.pro’s registration numbers have have been suffering the last few years.
The registry peaked at roughly 160,000 names in July 2012, and has been on a downward track ever since. It started this July with about 122,000 registrations.
As part of its new deal with ICANN, Afilias no longer has price caps — previously set around .com prices — and has had to implement some of the provisions of the new gTLD Registry Agreement.
One such provision is the Uniform Rapid Suspension policy, which continues to cause controversy in the industry.

.feedback regs Fox trademark to itself during sunrise

Top Level Spectrum, the new .feedback registry, has painted a second gigantic target on itself by registering to itself a .feedback domain matching one of the world’s largest media brands.
The company has registered fox.feedback and put up a web site soliciting comment on Fox Broadcasting Company.
This has happened whilst .feedback is still in its sunrise period.
The intellectual property community is, I gather, not particularly happy about the move.
The domain fox.feedback points to a web site that uses TLS’ standard feedback platform, enabling visitors to rate and comment on Fox.
The site has a footnote: “Disclaimer: This site is provided to facilitate free speech regarding fox. No direct endorsement or association should be conferred.”
Fox had no involvement with the registration, which Whois records show is registered to Top Level Spectrum itself.
Registry CEO Jay Westerdal said that the domain is one of the 100 “promotional” domains that new gTLD registries are allowed to set aside for their own use under the terms of their ICANN contracts.
Registries usually register names like “buy.example” or “go.example”, along with the names of early adopter anchor tenant registrants, using this mechanism.
I’m not aware of any case where a registry has consciously registered a famous brand, without permission, as part of its promotional allotment.
“The website is hosted automatically by the Feedback platform,” Westerdal said. “Fox Television Network has raised no concerns and has not applied for the domain during sunrise. We are testing out promotion of the TLD with the domain as per our ICANN contract.”
Fox may still be able to buy the domain during sunrise, he said.
“This is a Registry Operation name. During sunrise, If we receive an application from a sunrise-eligible rights holders during sunrise for a Registry Operations name we may release the name for registration,” he said.
Fox’s usual registrar is MarkMonitor. Matt Serlin, VP there, said in an email that the TLS move could be raised with ICANN Compliance:

I find it curious that this branded domain name would have been registered to the registry prior to the sunrise period which is restricted to the 100 registry promotional names. The fact that the domain is actually resolving to a live site soliciting feedback for The Fox Broadcasting Company is even more troubling. MarkMonitor may look to raise this to ICANN Compliance once the registry is able to confirm how this domain was registered seemingly outside of the required process.

The IP community originally fought the introduction of the 100-domain pre-sunrise exception, saying unscrupulous registries would use it to stop trademark owners registering their brands.
While there have been some grumblings about registries reserving dictionary terms that match trademarks, this may be the first case of a registry unambiguously targeting a brand.
Top Level Spectrum courted controversy with the trademark community last week when it told DI that it plans to sell 5,000-brand match domains to a third party company after .feedback goes into general availability in January.
Westerdal told us this is not “cybersquatting”, as the sites contain disclaimers and are there to facilitate free speech.
What do you think about this use of brands as “promotional” domains?
It’s indisputably pushing the envelope of what is acceptable, but is it fair? Should registries be allowed to do this?

XYZ says it won’t block censored Chinese domains

New gTLD registry XYZ.com has said it will not preemptively censor domain names based on the wishes of the Chinese government.
Over the last couple of days, CEO Daniel Negari has sought to “clarify” its plans to block and suspend domain names based on Chinese government requests.
It follows XYZ’s Registry Services Evaluation Request for a gateway service in the country, first reported by DI and subsequently picked up by the Electronic Frontier Foundation, a Wall Street Journal columnist, Fortune magazine and others.
The clarifications offered up by XYZ probably did more to confuse matters.
A blog post on Wednesday said that XYZ will not reserve any .xyz domain names from being registered, except those ICANN makes all new gTLD registries reserve.
Subsequent comments from Negari stated that XYZ will, as the RSEP stated, prevent names that have been banned in China from being registered.
However, there’s one significant difference.
Now, the registry is saying that it will only put those bans in place for domain names that have been specifically banned by the Chinese government when the name had already been registered by a Chinese registrant.
So, if I understand correctly, it would not preemptively ban anyone anywhere from registering [banned term].xyz.
However, if [banned term].xyz was registered to a Chinese resident and the Chinese government told the registry to suspend it, it would be suspended and nobody would be able to re-register it anywhere in the world.
Negari said in a blog comment yesterday:

if we receive a Chinese legal order tomorrow (before the gateway has launched) which requires disabling a domain name registered in China and properly under Chinese jurisdiction, then it will be disabled at the registry level, and not by the gateway. When the gateway launches the name will continue to be unavailable, and the gateway will not implement the action on a localized basis only in China. The normal registry system would continue to be the only system used to resolve the name globally. Again — the specific stability concern ICANN had was that we would use the Chinese gateway to make .xyz names resolve differently, depending on what country you are in. I completely agree that our [RSEP] re-draft to address that concern came out in a way that can be read in a way that we sincerely did not intend.

So there is a list of preemptively banned .xyz, .college, .rent, .security and .protection domains, compiled by XYZ from individual Chinese government requests targeting names registered to Chinese registrants.
Negari said in an email to DI yesterday:

To clarify the statement “XYZ will reserve domains,” we meant that XYZ will takedown domains in order to comply with “applicable law.” Unfortunately, the inaccuracies in your post caused people to believe that we were allowing the Chinese government to control what names could be registered or how they could be used by people outside of China. The idea that XYZ is going to impose Chinese law and prevent people outside of China from registering certain domain names is simply incorrect and not true. To be 100% clear, there is no “banned list.”

That was the first time anyone connected with XYZ had complained about the October 12 post, other than since-deleted tweets that corrected the size of the list from 40,000 domains to 12,000.
The RSEP (pdf) that causes all this kerfuffle has not been amended. It still says:

XYZ will reserve names prohibited for registration by the Chinese government at the registry level internationally, so the Gateway itself will not need to be used to block the registration of of any names. Therefore, a registrant in China will be able to register the same domain names as anyone else in the world.

This fairly unambiguous statement is what XYZ says was “misinterpreted” by DI (and everyone else who read it).
However, it’s not just a couple of sentences taken out of context. The context also suggests preemptive banning of domains.
The very next sentence states:

When the Gateway is initially implemented we will not run into a problem whereby a Chinese registrant has already registered a name prohibited for registration by the Chinese government because Chinese registrars are already enforcing a prohibition on the registration of names that are in violation of Chinese law.

This states that Chinese residents are already being preemptively banned, by Chinese registrars, from registering domains deemed illegal in China.
The next few paragraphs of the RSEP deal with post-registration scenarios of domains being banned, clearly delineated from the paragraph dealing with pre-registration scenarios.
In his blog post, Negari said the RSEP “addressed the proactive abuse mitigation we will take to shut down phishing, pharming, malware, and other abuse in China”.
I can’t believe this is true. The consequence would be that if China sent XYZ a take-down notice about a malware or phishing site registered to a non-Chinese registrant, XYZ would simply ignore it.
Regardless, the takeaway today is that XYZ is now saying that it will not ban a domain before it has been registered, unless that domain has previously been registered by a Chinese resident and subsequently specifically banned by the Chinese government.
The registry says this is no different to how it would treat take-down notices issued by, for example, a US court. It’s part of its contractual obligation to abide by “applicable law”, it says.
Whether this is a policy U-turn or a case of an erroneous RSEP being submitted… frankly I don’t want to get into that debate.
Disclosure: during the course of researching this story, I registered .xyz domains matching (as far as this monoglot can tell) the Chinese words for “democracy”, “human rights”, “porn” and possibly “Tiananmen Square”. I have no idea if they have value and have no plans to develop them into web sites.

Forget .sucks, .feedback will drive trademark owners nuts all over again

Top Level Spectrum, the new gTLD registry behind .feedback, plans to give sell domains matching 5,000 of the world’s top brands to a third party that does not own the trademarks.
That’s one novel element of a .feedback business model that is guaranteed to drive the intellectual property community crazy in much the same way as .sucks did earlier this year.
The other piece of ‘innovation’ will see all .feedback domains — including the 5,000 brands — point by default to a hosted service that facilitates comment and criticism.
An example of such a site can be seen at www.eggsample.feedback. The registry’s CEO, Jay Westerdal, has a .feedback site at www.jay.feedback
If you agree to use the hosted service with your domain, the domain and service combined will cost a minimum of just $20 per year.
However, if you want to turn off the hosted service and use your .feedback like a regular domain, pointing to the web site of your choice, the price will ratchet up to $50 a month, or $620 a year.
Those are the wholesale prices. Both services will be offered through registrars, where some markup is to be expected.
The hosted service is being offered by Feedback SAAS LLC, a company that, judging by its web site, appears to share ownership with Top Level Spectrum, though Westerdal says the two firms have different employees.
It’s not dissimilar to the model employed by .tel, where name servers by default point to a registry-hosted service.
Unlike .tel, .feedback registrants will be able to opt out of using the SAAS service and point their domains to whatever name servers they want.
Westerdal told DI that .feedback is in the process of making a deal with a “third party” he could not yet name to have 5,000 branded .feedback domains deployed during the Early Access Period of the .feedback launch. That’s scheduled to start January 6.
“We are striking a deal to get feedback sites out there. We want everything to have feedback,” he said. “We are signing an agreement to get the ball rolling by doing a founders program to get names out there. Your favorite shoe, your pizza place, your everything.”
“The sites are all geared towards free speech and giving reviews,” he said. He said:

No trademark infringement will occur though, the sites are all geared towards free speech and giving reviews. Confusing the public that the brand is running the site will not happen, each site has a disclaimer and makes it clear the brand is not running the site.

Asked whether we were talking about a genuine third party or a shell set up by the registry, he said: “A real third party. I am not playing games.”
He said the higher pricing for the naked domain registration is intended to discourage companies from turning off the domains matching their brands.
The whole point of .feedback is to solicit feedback.
The as-yet unspecified third-party taking possession of the 5,000 brand names would not be prevented from selling the domains to the matching brand owner, or to any third parties, he said, though he would not be in favor of such a move.
He said that $20 a year to run a configurable .feedback site, with moderator privileges, is a “great deal” compared to the $300-a-month service he said consumer review site Yelp offers.
The SAAS service will make additional revenue by selling added features, suitable for enterprises, he said.
.feedback went into its sunrise period last week with a $2,000 wholesale fee — the same high price that attracted criticism for .sucks.
The original Registry Service Evaluation Process for the .feedback service hit ICANN over a year ago (pdf).
I missed it then. Sorry.
I noticed it today after corporate registrar MarkMonitor blogged about it.
Matt Serlin, VP of MarkMonitor, who blogged his opinion on .feedback’s strategy earlier today, said in an email that the .feedback strategy was “more objectionable” than he had thought, and that “[W]e would most likely look to raise to ICANN if that is his stated intent.”