Freenom settles $500 million Meta lawsuit and will exit domain business

Facebook has claimed another domain industry scalp. Freenom said this week it has settled the cybersquatting lawsuit filed against it by Meta last year, and that it is getting out of the domain name business.

The registry/registrar said in a brief February 12 statement (pdf) that it will pay Meta an undisclosed sum and has “independently decided to exit the domain name business”.

Just how “independent” that decision was is debatable. The company lost its ICANN registrar accreditation last year and is believed to have lost its government contracts to run the ccTLDs for Equatorial Guinea, Central African Republic, Mali, Gabon, and possibly also Tokelau, its flagship .tk domain.

Meta had claimed in its complaint that Freenom had typosquatted its trademarks thousands of times, including domains such as faceb00k.ga. It sued for 5,000 counts under US anti-cybersquatting law, seeking $100,000 for each infringement, for a cool half-billion bucks in total.

Freenom and its network of co-defendant affiliates said in their defense that Meta had access to an abuse API that allowed it to turn off such domains, but had never used it. It also claimed many of the cited typosquats had already been shut down by the time the suit was filed.

It seems the names in question were likely those registered by abusive third-parties that were reclaimed and monetized by Freenom under its widely criticized free-domains business model, which made its TLDs some of the world’s most-abused.

But the claims on both sides evidently will not be tested at trial. The last court filing, dated late December, showed the two parties were to enter mediation, and Freenom put out the following statement this week:

Freenom today announced it has resolved the lawsuit brought by Meta Platforms, Inc. on confidential monetary and business Terms. Freenom recognizes Meta’s legitimate interest in enforcing its intellectual property rights and protecting its users from fraud and abuse.

Freenom and its related companies have also independently decided to exit the domain name business, including the operation of registries. While Freenom winds down its domain name business, Freenom will treat the Meta family of companies as a trusted notifier and will also implement a block list to address future phishing, DNS abuse, and cybersquatting.

Meta said in its Q4 Adversarial Threat Report this week that the settlement showed its approach to tackling DNS abuse is working.

Freenom’s gTLD domains have been transferred to Gandi. It’s less clear what’s happening to its ccTLD names, though social media chatter this week suggests the company has been giving registrants in affected ccTLDs nine-year renewals at no cost.

Domain universe grows on new gTLDs despite .com shrinkage

The number of domain names on the internet grew by about 600,000 during the fourth quarter of 2023, despite the drag caused by shrinkage in .com and .net, according to Verisign’s latest Domain Name Industry Brief.

There were 359.8 million registered domains at the end of the year across all TLDs, a 0.2% increase over September, the latest DNIB says.

The growth was hampered by declines in Verisign’s own flagship gTLDs, which were down by 1.2 million names over Q3 and a million names year-over year. Verisign blamed softness in China for the declines during its Q4 earnings call last week.

New gTLD reg volume picked up most of the slack, growing by 1.6 million or 5.3% over Q3, and 4.4 million or 15.9% over 2022. This seems to have been largely driven by six-figure increases at a handful of low-cost gTLDs coupled with smaller increases across the board.

ccTLDs grew more modestly, up about 200,000 names or 0.2% quarter over quarter and 5.3 million names, 4%, year over year. There were 138.3 million ccTLD domains at the end of the year. Growth seems to have been tempered by six-figure declines in the likes of .uk and .ru.

Registry service provider evaluation handbook published

ICANN has released the first draft of its RSP Handbook, the guidelines and questionnaire for registry service providers that want to get pre-approved by the Org ahead of the next new gTLD application round.

The Handbook is aimed at the few dozen companies that offer back-end services to gTLD registries — companies such as GoDaddy, Identity Digital and CentralNic — to guide them through the process of getting approved under the new Registry Service Provider Evaluation Program.

The program was called for by the GNSO community in order to minimize the amount of time-consuming, expensive evaluation work required for each new gTLD application. If a gTLD applicant’s selected RSP has been pre-approved by ICANN, it’s an automatic pass on the technical part of the application.

The new Handbook 1.0 envisages four types of RSP. A “Main RSP” is a full-service provider that looks after all technical aspects of a registry back-end. There are also categories for companies that provide DNS resolution only and DNSSEC services.

A fourth type, the “Proxy RSP”, is aimed primarily at companies that provide secondary registry services in countries that have very restrictive domain licensing rules. That basically means China, and proxies such as ZDNS.

Incumbent gTLD RSPs have a distinct advantage in the Handbook process. If they’re in good standing with ICANN and have complied with their service level agreements for the last six months, they can skip the second, technical part of the evaluation.

Incumbents also get a streamlined process for additional registry services — stuff like name-blocking and registry locks — they wish to offer. If they already offer them in an existing gTLD, they get to skip the full Registry Services Evaluation Process.

The Handbook is a first draft and does not currently include things like fees and dates. It’s not yet open for public comment but you can read the 108-page PDF here.

ICANN expects to launch the pre-evaluation program 18 months before it starts accepting new gTLD applications, so applicants have a list of approved RSPs to choose from. With a Q2 2026 target date for the next application window, that means the RSP program could launch later this year.

WebUnited inks deal to “mirror” country’s TLD in the blockchain

Blockchain domains startup WebUnited says it has signed up its first registry client to a service that allows domain names to be “mirrored” on a blockchain naming service.

The company has inked a deal with Global Domains International, the registry for Samoa’s .ws ccTLD (sometimes marketed as a generic for “web site”), that will let its registrars up-sell matching .ws names on the Polygon blockchain.

WebUnited, a Swiss-based joint venture of domain registry ShortDot and “Web3” naming player Freename, says registrants will be able to use their mirrored .ws names to address cryptocurrency wallets, for example.

The company essentially acts as a registry service provider for its registry clients in much the same way as regular RSPs do now, except instead of putting domains into EPP databases and the consensus DNS, it adds them to a blockchain.

Registrars that choose to sign up to the service will use an “EPP-like” API to access the registry, ShortDot COO Kevin Kopas said. He expects .ws to charge about five bucks a year for the blockchain add-on domains.

Kopas said WebUnited is also mirroring policies found in regular domain names, so if somebody loses their domain in a UDRP case, for example, they also lose their matching blockchain name.

After .ws, ShortDot’s own TLDs — .bond, .sbs, .icu, .cyou and .cfd — are also expected to offer the mirroring service. Because these are gTLDs governed by ICANN contracts, ShortDot first has to go through the Registry Service Evaluation Process for approval.

Kopas said that once ShortDot has completed its RSEP it will be able to supply gTLD clients with template language to get their own RSEPs approved. He said WebUnited has a pipeline of potential ccTLD and gTLD registries that have expressed an interest in the service.

.com is shrinking but Verisign raises prices again anyway

Verisign has confirmed that it plans to exercise its fourth and final .com price-increasing power under its current registry contract, even as its domains under management continues to head south.

The company confirmed last night that it will increase the annual registration and renewal wholesale fee for a .com domain from $9.59 to $10.26 on September 1 this year. It’s the last of the four times it’s allowed to raise prices by up to 7% in its current contract with ICANN, which expires in November.

The news came as Verisign reported its fourth-quarter and full-year 2023 financial results, which were as profitable as we’ve come to expect.

But in terms of domains under management, .com and .net continued to decline, which CEO Jim Bidzos told analysts was all China’s fault. Domains managed by Chinese registrars shrank by 2.2 million in Q4, leading to an overall .com/.net shrinkage of 1.2 million names.

There were nine million new .com/.net registrations in Q4, down from 9.7 million in the same quarter in 2022.

Bidzos said the decline in China was due to factors such as stricter local regulations and a weaker economy, and said he expects those challenges to continue to hit Verisign’s numbers in 2024. He did not blamed higher prices for the drop.

Indeed, the .com zone file has been shrinking by about 1,500 domains per day on average since the start of the year. Zone numbers are usually a reliable predictor of DUM trends.

Revenue from China was down about $14.4 million, CFO George Kilguss said.

Bidzos said Verisign expects its DUM to be flat this year, with a possible 1% swing either way.

For Q4, the company reported revenue up 3% year over year at $380 million, with $265 million net income, up from $179 million a year earlier.

For the whole of 2023, revenue was up 4.8% at $1.49 billion and net income was $818 million, up from $674 million in 2022.

UK cybersquatting complaints hit record low

There were fewer cybersquatting complaints filed against .uk domain holders in 2023 than in any other year since Nominet started reporting its annual stats, according to the latest annual Nominet DRS report.

There were just 511 complaints filed last year, down from 568 in 2022, according to the latest report. That’s the lowest number for at least the last 14 years Nominet has been reporting its annual DRS stats. The highest number was 728, in 2015.

Just 48% of cases resulted in a domain being transferred to the complainant (compare to the 82% WIPO reported for its UDRP cases in 2023), up from 43% in 2022, Nominet said.

The number of disputed domains was 680, down from 745 in 2022, but the number of domains in .uk complained about rocketed from 26 to 122, the second-highest level since Nominet opened the second level for direct registrations a decade ago.

The number of disputed .co.uk domains was down from 686 in 2022 to 538 in 2023.

The decline in cybersquatting complaints come as .uk as a whole continues to shrink. The second and third levels combined lost a net 366,778 domains in 2023, ending December at 10,732,479 domains, according to Nominet stats.

No excuses! PIR to pay for ALL registries to tackle child abuse

Public Interest Registry has announced that it will pay for all domain registries to receive alerts when child sexual abuse material shows up in their TLDs.

The non-profit .org operator said today that it will sponsor any registry — gTLD or ccTLD — that wants to sign up to receive the Domain Alerts service from the Internet Watch Foundation, the UK-based charity that tracks CSAM on the internet.

According to the IWF, only a dozen registries currently receive the service, PIR said.

“Our sponsorship will extend access to Domain Alerts to over a thousand TLDs at no cost enabling any interested registry to help prevent the display of criminal, abusive content on their domains,” the company said.

PIR didn’t say how much this is likely to cost it. IWF doesn’t publish its prices, but it seems only paying members usually receive the service. Its membership fees range from £1,000 ($1,259) to £90,000 ($113,372) a year, based on company size.

The partnership also means all registries will have free access to the IWF TLD Hopping List, which tracks CSAM “brands” as they move between TLDs whenever they are taken down by registries in a given jurisdiction.

IWF says that in 2022 it found 255,000 web pages hosting CSAM, spread across 5,416 domains. PIR says it has removed 5,700 instances of CSAM across its portfolio of TLDs over the last five years.

Airline gTLD crashes and burns

Another would-be dot-brand has added itself to the list of “On second thoughts…” gTLD registries, asking ICANN to tear up its contract.

Century-old Avianca, Colombia’s largest airline, filed its termination papers with ICANN in December and ICANN published them for comment last week.

While the original 2012 application clearly stated that .avianca was intended as a single-registrant dot-brand, Avianca never actually got around to applying for its Spec 13 exemptions so I won’t be technically counting it as a dead dot-brand.

Despite being operational since early 2016, the TLD never had any registrations beyond the mandatory nic.avianca registry placeholder.

The back-end registry services provider and original application consultant was Identity Digital (née Afilias).

Nominet to overhaul .uk registry, turn off some services

Nominet has opened a public consultation on its plans to modernize the .uk domain registry, which will involve increased standardization around international norms and turning off some older services.

It’s an extensive consultation — 37 proposals and 92 questions spread over more than 50 pages — aimed mainly at the registrars that will have to update their systems to integrate with the new registry. But registrants will also be affected.

The plans would see changes to Nominet’s underlying registry platform that would alter how renewals, proxy registrations, grace periods and transfers between registrants and registrars are handled, and the retirement of the current Whois system, among many other items.

Nominet reckons its proposals will help it save money on ongoing maintenance and software licensing as well as eventually simplifying things for its member registrars.

The company currently runs two registry platforms in parallel: the old UK registry and the newer EPP registry, which is based on the latest technical standards and compliant with ICANN requirements.

It runs its gTLDs, such as .wales and .cymru, as well as its dozens of back-end clients, on the newer system. The plan is to shift .uk over to the newer RSP platform too.

The proposal also calls for Nominet to align with ICANN’s plans to stop requiring registrars to operate Whois services a year from now, replacing them with the newer RDAP standard, which provides the same functionality.

Other older, less-used services, such as the Domain Availability Checker, would either be retired or replaced with EPP-based equivalents.

There’s a lot to absorb in the consultation documents, but at first glance it strikes me that large international registrars that already integrate with dozens of registries probably don’t have much to worry about; smaller, .uk-focused registrars with fewer resources may show some resistance due to the amount of development work likely to be required.

But Nominet says that it is taking this into account with its timetable, saying: “If the changes go ahead, we will give considerable advance notice to Registrars to allow time for development activities”.

The consultation is open for the next three months, punctuated by five explanatory webinars.

Russia blames DNSSEC, not Ukraine, for internet downtime

Another ccTLD has blamed DNSSEC after seeing hours of downtime affecting its country’s biggest web services yesterday.

This time it’s Russia’s ccTLD.ru, which confirmed today that it was responsible for the widely reported outages on Tuesday, which had sparked speculation that a cyber-attack related to the war in Ukraine might be the culprit.

It was rather a DNSSEC failure that affected both .ru and the Cyrillic .рф domains, the registry said. It was related to a cryptograpghic key rollover, the registry indicated.

“After the failure was detected, the updated keys were revoked, and the functionality of the .RU zone was fully restored, which took about two hours, including the distribution of data through the DNS system,” the registry said on its web site.

“The investigation into the incident is currently ongoing, but it is already clear that the main cause of the failure was the imperfection of the software used to create the encryption keys,” it added.

The explanation was echoed by Russian government officials on social media, and it’s sadly rather plausible. DNSSEC failures at ccTLDs, and to a lesser extent gTLDs, usually related to fluffed key rollovers, are rather common.

There have been similar outages reported in the last few years in Australia (twice), Namibia, Fiji, and Sweden. And those are just the ones reported on this blog. People who track this kind of thing more closely have recorded hundreds of incidents.