China approves more Donuts, Afilias gTLDs

Donuts and Afilias have had two batches of new gTLDs approved for use in China.
The Ministry of Industry and Information Technology approved five Afilias TLDs and six Donuts TLDs last month. This means customers of Chinese registrars will now be able to legally use those names in China.
Afilias was approved for .info, .mobi and .pro, which were delegated following the 2000 and 2003 new gTLD application rounds and .kim and .red from the 2012 round.
Donuts simultaneously was cleared for .ltd, .group, .游戏 (“game”), .企业 (“business”), .娱乐 (“entertainment) and .商店 (“store”).
The approvals more than double the number of new gTLDs in Latin script to get the nod from MIIT, in what now appears to be a monthly occurrence.
In February, .ink and four Chinese-script TLDs passed the regulatory process, following .site and .shop in January and .vip, .club and .xyz in December.
MIIT approval means the chance of usage by Chinese registrants should go up, but it also ties these Western registries to relatively Draconian government policies when it comes to Chinese registrations.

CentralNic says revenue more than doubled in 2016

CentralNic’s revenue was up 110% in 2016, according to the company.
The registry today released its unaudited results for last year, showing EBITDA up 65% at £5.5 million ($6.7 million) on revenue of £22.1 million ($26.9 million)
The company, which has expanded into registrar services via acquisition in the last few years, said its recurring revenue — mainly domain registrations — now account for about 80% of revenue.
CentralNic has about a third of the new gTLD back-end market, primarily because it’s the provider for .xyz’s millions of cheapo registrations.
In its statement, it said it hopes to focus on growing more in China, where clients including .xyz were recently licensed.
It also intends to make more acquisitions, where the deals “meet clear strategic criteria including being earnings accretive in the short term with a strong recurring revenues base”.

How .com became a restricted TLD

Verisign has been given approval to start restricting who can and cannot register .com and .net domain names in various countries.
Customers of Chinese registrars are the first to be affected by the change to the registry’s back-end system, which was made last year.
ICANN last week gave Verisign a “free to deploy” notice for a new “Verification Code Extension” system that enables the company to stop domains registered via selected registrars from resolving unless the registrant’s identity has been verified and the name is not on China’s banned list.
It appears to be the system Verisign deployed in order to receive its Chinese government license to operate in China.
Under Verification Code Extension, Verisign uses ICANN records to identify which registrars are based in countries that have governmental restrictions. I believe China is currently the only affected country.
Those registrars are able to register domains normally, but Verisign will prevent the names from resolving (placing them in serverHold status and keeping them out of the zone file) unless the registration is accompanied by a verification code.
These codes are distributed to the affected registrars by at least two verification service providers. Verisign, in response to DI questions, declined to name them.
Under its “free to deploy” agreement with ICANN (pdf), Verisign is unable to offer verification services itself. It must use third parties.
The company added the functionality to its .com and .net registry as an option in February 2016, according to ICANN records. It seems to have been implemented last July.
A Verisign spokesperson said the company “has implemented” the system.
The Verification Code Extension — technically, it’s an extension to the EPP protocol pretty much all registries use — was outlined in a Registry Services Evaluation Process request (pdf) last May, and approved by ICANN not long after.
Verisign was approved to operate in China last August in the first wave of gTLD registries to obtain government licenses.
Under Chinese regulations, domain names registered in TLDs not approved by the government may not resolve. Registrars are obliged to verify the identities of their registrants and names containing certain sensitive terms are not permitted.
Other gTLDs, including .vip, .club, .xyz .site and .shop have been granted approval over the last few months.
Some have chosen to work with registration gateway providers in China to comply with the local rules.
Apart from XYZ.com and Verisign, no registry has sought ICANN approval for their particular implementation of Chinese law.
Because Chinese influence over ICANN is a politically sensitive issue right now, it should be pointed out that the Verification Code Extension is not something that ICANN came up with in response to Chinese demands.
Rather, it’s something Verisign came up with in response to Chinese market realities. ICANN has merely rubber-stamped a service requested by Verisign.
This, in other words, is a case of China flexing market muscle, not political muscle. Verisign, like many other gTLD registries, is over-exposed to the Chinese market.
It should also be pointed out for avoidance of doubt that the Chinese restrictions do not apply to customers of non-Chinese registrars.
However, it appears that Verisign now has a mechanism baked into its .com and .net registries that would make it much easier to implement .com restrictions that other governments might choose to put into their own legislation in future.

Phishing in new gTLDs up 1,000% but .com still the worst

The .com domain is still the runaway leader TLD for phishing, with new gTLDs still being used for a tiny minority of attacks, according to new research.
.com domains accounted for 51% of all phishing in 2016, despite only having 48% of the domains in the “general population”, according to the 2017 Phishing Trends & Intelligence Report
from security outfit PhishLabs.
But new gTLDs accounted for just 2% of attacks, despite separate research showing they have about 8% of the market.
New gTLDs saw a 1,000% increase in attacks on 2015, the report states.
The statistics are based on PhishLabs’ analysis of nearly one million phishing sites discovered over the course of the year and include domains that have been compromised, rather than registered, by attackers.
The company said:

Although the .COM top-level domain (TLD) was associated with more than half of all phishing sites in 2016, new generic TLDs are becoming a more popular option for phishing because they are low cost and can be used to create convincing phishing domains.
…
There are a few reasons new gTLDs are gaining traction in the phishing ecosystem. For one, some new gTLDs are incredibly cheap to register and may be an inexpensive option for phishers who want to have more control over their infrastructure than they would with a compromised website. Secondly, phishers can use some of the newly developed gTLDs to create websites that appear to be more legitimate to potential victims.

Indeed, the cheapest new gTLDs are among the worst for phishing — .top, .xyz, .online, .club, .website, .link, .space, .site, .win and .support — according to the report.
But the numbers show that new gTLDs are significantly under-represented in phishing attacks.
According to separate research from CENTR, there were 309.4 million domains in existence at the end of 2016, of which about 25 million (8%) were new gTLDs.
Yet PhishLabs reports that new gTLD domains were used for only about 2% of attacks.
CENTR statistics have .com with a 40% share of the global domain market, with PhishLabs saying that .com is used in 51% of attacks.
The difference in the market share statistics between the two sets of research is likely due to the fact that CENTR excludes .tk from its numbers.
Again, because PhishLabs counts hacked sites — in fact it says the “vast majority” were hacked — we should probably exercise caution before attributing blame to registries.
But PhishLabs said in its report:

When we see a TLD that is over-represented among phishing sites compared to the general population, it may be an indication that it is more apt to being used by phishers to maliciously register domains for the purposes of hosting phishing content. Some TLDs that met these criteria in 2016 included .COM, .BR, .CL, .TK, .CF, .ML, and .VE.

By far the worst ccTLD for phishing was Brazil’s .br, with 6% of the total, according to the report.
Also notable were .uk, .ru, .au, .pl, and .in, each with about 2% of the total, PhishLabs said.

Five more new gTLDs, one in English, get the nod from China

Top Level Design’s .ink has become the sixth new gTLD in the Latin alphabet to be approved for sale in China.
It was one of four new gTLDs given regulatory approval to begin operating properly in the country late last week. The others were all in Chinese script.
From Finnish-founded TLD Registry, .中文网 (“Chinese web site”) and .在线 (“Chinese online”) gained approval.
From local outfit Guangzhou Yuwei Information Technology Co, .集团 (“group”) and .我爱你 (“I love you”) were given the nod.
It’s the third batch of new gTLDs to get Chinese government approval since .vip, .club and .xyz in December. In January, .site and .shop joined their ranks.
Under China’s Draconian domain name regulations, only domains registered via local registries and registrars may be used.
Registries from outside the country have had to set up a local corporate presence and agree to China’s censorship policies in order to be compliant.

.com-dominated NamesCon auction already has one million-dollar bid

There’s still about week to go until this year’s NamesCon conference kicks off in Las Vegas, but the live auction that will close the first day of the show has already seen pre-bidding action.
One batch of domains has already received a high bid of $1,010,000, but does not appear to have yet met its reserve.
The batch is led by bar.com, but also includes bar.net, cafes.com, grill.com, place.com, pub.com and shelter.com.
Another five domains on the list, all .com names, have attracted bids in six figures, topped by the $800,000 bid for ol.com.
The list of names up for pre-bid on NameJet (100 of which will hit the live auction) is dominated by Verisign TLDs — .com, obviously, and to a lesser extent .net and .tv.
The biggest pre-bid for a 2012-round gTLD is the $1,010 currently offered for gold.club, roughly 110th on the list as ordered by current bid.
The most active new gTLD auction is currently shoes.xyz, which has 28 bidders but a top bid of just $330.
I’m not sure how much can be inferred from pre-bids, but it certainly seems that most of the money from domain investors is still being put into short, one or two-word .com domains.
The auction will begin at 1500 US Pacific Time next Monday, January 23.
The auction is being managed and promoted by Right Of The Dot and NameJet. Would-be buyers need a NameJet account to participate.
Names not sold during the live event will go to an extended auction until February 9. ROTD’s Monte Cahn said this is in order to give Chinese bidders time to bid after Chinese New Year (January 28 this year).

GMO and Radix secure Chinese gTLD approval

GMO Registry and Radix have won Chinese government approval for their respective new gTLDs .shop and .site.
It’s the second batch of foreign new gTLDs to get the nod from China’s Ministry of Industry and Information Technology, following .vip, .club and .xyz in early December.
They’re also the first two Asian registries from outside China to get the right to flog their domains in China — GMO is Japanese and Radix is UAE-based with Indian roots.
Their new Chinese government licenses mean Chinese registrars will now be able to allow their customers to actually use .shop and .site domains to host web sites.
The registries in turn have had to agree to enforce China’s rather arbitrary and Draconian censorship policies on their Chinese customers.
The approvals were announced by MIIT December 29.
.site currently has about 570,000 domains in its zone file, making it a top-10 new gTLD by volume, while .shop, which launched much more recently, has over 100,000.
The ability for Chinese customers to develop their domains is no doubt good for the long-term health of TLDs, but it’s not necessarily a harbinger of shorter-term growth in a market where domains are often treated little more than meaningless baseball cards to be traded rather than commodities with intrinsic value.

.xyz, .club and .vip get the nod to sell in China

The Chinese government has granted licenses to operate in the country to its first tranche of new gTLDs — .vip, .club and .xyz.
The agreements mean that Chinese registrars will be able to give their Chinese customers the ability to actually use their domains for web sites.
It also means the companies will be obliged to censor domains the government does not like, but only those domains registered via Chinese registrars.
The Ministry of Industry and Information Technology announced the licenses, given to the Chinese subsidiaries of Minds + Machines, .CLUB Domains and XYZ.com respectively, today.
M+M CEO Toby Hall told DI that it’s “a great moment of support for Chinese registrars”, giving them a “very clear signal about which TLDs they can focus on”.
XYZ.com said in a blog post that some of its Chinese registrars (its biggest channel) are planning on offering discounts to celebrate the approval.
It’s always been possible for Chinese people to register new gTLD domains via Chinese registrars — it’s estimated that 42% of the 27 million new gTLD domains in existence today are Chinese-owned.
However, Chinese citizens need a government license if they want to launch a web site, and the government only issues licenses for domains in approved TLDs.
In addition to .cn and China-based gTLDs, which were the first to be given the nod, Verisign was approved earlier this year for .com.
Hall said that while .vip has been popular with Chinese domainers, the MIIT license means it can start to tap the small business market there too.
Obtaining the license means that the three registries, which are all based in the US or Europe, will have to comply with Chinese regulations when it comes to Chinese customers.
That basically means the Chinese government gets to censor pretty much anything it doesn’t like, up to and including sites that “spread rumors”.
Hall said that there’s no chance of this censorship bleeding out to affect non-Chinese customers.
M+M, along with XYZ and .CLUB, are using Chinese registry gateway ZDNS to act as a proxy between their own back-ends (Nominet for .vip, Neustar for .club and CentralNic for .xyz) and Chinese registrars.
“All of our Chinese web sites go through ZDNS, so only web sites going through ZDNS would be affected,” Hall said, referring to the censorship rules.
Hall added that he was “not aware” of there being a blocklist of politically sensitive strings that Chinese customers are not allowed to register.

NameCheap stops selling .xyz domains

NameCheap may have sold over a million .xyz domains, but apparently it will sell no more than that.
The registrar confirmed to DI this evening that it is no longer taking .xyz registrations. It declined to explain why.
It has also stopped selling .college and .rent domains — two other gTLDs owned by XYZ.com. Other new gTLDs are not affected.
It’s reportedly not accepting inbound transfers either, though existing domains can be renewed.
The switch-off happened at the end of last month, a NameCheap representative said.
That’s just one month after the registrar celebrated its one millionth .xyz registration, which XYZ.com commemorated with a blog post bigging up NameCheap’s user-customers.
The move is peculiar indeed. NameCheap is the third highest-volume .xyz registrar, behind West.cn and Uniregistry, responsible for about 15% of .xyz’s domains under management.
It’s also NameCheap’s biggest direct-selling gTLD by a considerable margin.
NameCheap is well-known as primarily an eNom reseller — it accounts for 28% of eNom’s domains under management and 18% of its revenue, largely from .com sales.
But with new gTLDs it has started selling domains on its own IANA ticker, meaning a direct connection to the registry and more gross profit for itself.
According to June’s registry reports, the million .xyz names accounted for roughly two thirds of NameCheap’s total DUM (not counting names sold via eNom).
The closet rival in its portfolio is .online, which provided the registrar with about 81,000 DUM.
The registrar added about 350,000 .xyz domains in June, a month in which it briefly offered them at $0.02 each.
At that time, the company reported technical issues that led to a 12-24 hour backlog of registrations to process, though its blog post announcing the problem appears to have since been deleted.
NameCheap has declined to comment on the reason for the surprise move, and XYZ did not immediately respond to a request for comment.
The fact that all of XYZ.com’s TLDs have been cut off suggests some kind of dispute between the two companies, but the fact that renewals can still be processed would suggest that NameCheap has not lost its .xyz accreditation.
More info if I get it…

XYZ hires .top guy as first China employee

XYZ.com has hired its first Beijing-based employee, as part of its ongoing plan to formally enter the Chinese market.
The company said yesterday that it has appointed Mason Zhang, until recently chief marketing office at .top gTLD registry Jiangsu Bangning Science & Technology Co, as its new director of business development for China.
It’s part of XYZ’s seemingly interminable entry to the Chinese market, which is over a year old.
While the majority of .xyz’s registrations have been into China, the registry (along with pretty much every other Western registry) still does not have the necessary government permissions so that its customers can start using their names.
It kicked off a process to get ICANN approval for its Chinese gateway, operated by ZDNS, a year ago, and set up the mandatory Wholly Owned Foreign Enterprise in January.
The company said in a blog post that it expects to get its Chinese accreditation “very soon”.
Zhang’s former employer, .top, is second only to .xyz in terms of new gTLD registration volume, also due to Chinese sales. It has about 3.7 million names in its zone file, compared to .xyz’s 6.1 million.