Latest news of the domain name industry

Recent Posts

This is how stupid the GAC’s new gTLDs advice is (part two)

Kevin Murphy, July 15, 2013, Domain Policy

When Donuts and ICANN signed a new gTLD contract for .游戏, on a stage in front of hundreds of people at ICANN 47 this morning, it made a mockery of the relationship between ICANN and the GAC.

游戏 is the Chinese for “game” or “games”. It was an uncontested application with no objections and, importantly, no Governmental Advisory Committee advice standing in its way.

Donuts got lucky. The six companies that have applied for .game or .games in English are all currently prohibited from entering into contract negotiations with ICANN because they did receive GAC advice.

When the GAC drafted its “Advice on New gTLDs” in Beijing three months ago, it included a long but “non-exhaustive” set of strings that it said needed extra “safeguards” on security and community support.

ICANN has called these strings the “Category 1” list. It’s already been the subject of some strong discussion with the GAC at the meeting in Durban, which kicked off over the weekend.

So was it the GAC’s intention with Category 1 to introduce a language bias into the new gTLD program? Did it intend to give Chinese-script strings special privileges over ASCII-based languages?

If there was a sensible rationale for including .game/.games on the Category 1 list, why didn’t it apply to .游戏?

Or did the GAC simply not give its Beijing advice the care and attention it deserved?

Based on sessions in Durban over the weekend, the latter explanation appears to be closer to the truth.

“Vague and unimplementable”

At session between the GAC and ICANN’s board-level New gTLD Program Committee yesterday, the GAC heard in the strongest terms (within the bounds of polite discourse) how silly its Beijing advice was.

The session kicked off with NGPC member Chris Disspain delivering a witheringly but necessarily blunt assessment of the “Category 1” list and the associated safeguards.

He first noted that ICANN already rejected the GAC’s advice to make certain strings mandatory “community” gTLDs — something that would have had the same effect as the Beijing advice — back in 2011.

The GAC Early Warning system was introduced instead, he said, to give governments the ability to work with or object to applicants for specific strings that they were worried about.

Disspain continued with a catalog of criticisms against the Category 1 advice:

The difficulties we see at the moment are that the categories of strings are broad and undefined. There’s no principled basis for distinguishing certain categories and strings.

Generic terms are in the same category as highly regulated industries. Some strings have segments that are both licensed and unlicensed.

It’s difficult to determine relevant regulatory agencies and self-regulatory organizations. Some strings refer to industries that may be sensitive or regulated in a single or a few jurisdictions only.

The safeguard advice items three to eight create obligations that are vague and unimplementable.

And these are the outcomes that we sought to avoid when we rejected the advice in the first place. And we agreed to put in place the Early Warning system so that governments could deal directly with applicants if they had issues with the string.

He received some push-back from GAC members, some of whom — insisting that the Beijing communique was well-considered and easily understood — appear to be in denial.

“In the end, you should come with us, trying to implement,” the member for Italy said. “Because I’m sure that you well understood the meaning of this Annex 1.”

In response, Disspain reiterated that the NGPC really doesn’t understand what the GAC wants and really doesn’t understand how it came up with the Category 1 list in the first place.

“We’re unclear how we could implement at all some pieces of the advice,” he said. “The issue for us is not so much that there could be other names that could be added to the list but rather there are names that appear on the list that we don’t understand why they’re there in the first place.”

Now what?

Impasse thus reached, much of the discussion during the hour-long session focused on ways to potentially move the process forward, with participants acknowledging they’re in “uncharted territory”.

Switzerland suggested — contrary to what is plainly spelled out in the Applicant Guidebook, which asks the GAC to comment on specific applications — that the GAC didn’t think that its job was to come up with a definitive list of worrying strings. He said:

Initially, we did not think that it’s the task of the GAC to put together a finite list of sensitive strings, but we have been informed that it would be helpful to come up with concrete names.

So don’t take this list as a list that has been worked out over months and years and every TLD has been tested. These are examples, as we identified it in a rather short time.

There might be a few names that are not on the list that you could easily also add. There are some inconsistencies in that sense. But this is not meant to be a finite, absolute list.

The UK rep said he was disappointed with the “negative” tone of the NGPC’s response to the safeguard advice, but also suggested that the next step might be to come up with a proper list of strings.

“I think the next step forward is for the committee to try and prepare a first draft list for consultation with the whole community,” he said. “And we, the governments, we could obviously seize the opportunity to contribute to that consultation.”

The European Commission provided a statement that its representative said represented the views of EU states on the GAC. The statement said that the Beijing list should be an “at-minimum” list.

European GAC members consider the role of the GAC in this discussion is to provide high-level clarifications regarding the Beijing GAC advice rather than precise implementation means.

We would also like to note that the list of sensitive strings provided in the Beijing communique is a non-exhaustive one… meaning the list should be considered an at-minimum list.

What does this all mean for applicants?

Based on yesterday’s hour-long discussion, ICANN can surely be no closer to understanding which applications are affected by the GAC advice and presumably still doesn’t have a clue what some of it means.

This afternoon, during another session in Durban, program manager Christine Willett said that ICANN is using the Category 1 list published in Beijing when deciding which applicants can be contracted with.

“The NGPC is still considering the Category 1 advice and we have no direction or indication from them yet that a definitive list will be created,” she said.

I can’t see it being resolved this week, and inter-sessional meetings are very rare, so we could now be looking at Buenos Aires — November — before any of this gets sorted out.

For applicants who were — it now seems — selected at random to appear on the Beijing list, they’re facing months more delay while applicants that were not included are free to sign registry contracts today.

Is this fair?

Is it fair to allow applicants that were inexplicably excluded from the GAC’s Beijing list to go ahead and contract with ICANN, while others that were inexplicably included are delayed by many more months?

Is it fair that some applications will get bumped up the queue to delegation just because the GAC didn’t spend enough time thinking about its task?

How can ICANN be certain at contracting that any application is free of GAC advice, when the GAC has made it clear that it expects its list of strings to grow?

I asked ICANN CEO Fadi Chehade some of these questions during a press conference this afternoon and he pointed out that there are mechanisms in place in the Registry Agreement to allow future GAC advice to be addressed.

If it indeed the case that Donuts, for example, might have to add some safeguard commitments to its already signed .游戏 contract, why prevent the .game and .games applicants from signing contracts too?

Wouldn’t it be fairer to delay all new gTLD applications, or none at all, rather than relying on a list of strings we now know definitively to be ad hoc and unreliable?

Report names and shames most-abused TLDs

Kevin Murphy, July 11, 2013, Domain Services

Newish gTLDs .tel and .xxx are among the most secure top-level domains, while .cn and .pw are the most risky.

That’s according to new gTLD services provider Architelos, which today published a report analyzing the prevalence of abuse in each TLD.

Assigning an “abuse per million domains” score to each TLD, the company found .tel the safest with 0 and .cn the riskiest, with a score of 30,406.

Recently relaunched .pw, which has had serious problems with spammers, came in just behind .cn, with a score of 30,151.

Generally, the results seem to confirm that the more tightly controlled the registration process and the more expensive the domain, the less likely it is to see abuse.

Norway’s .no and ICM Registry’s .xxx scored 17 and 27, for example.

Surprisingly, the free ccTLD for Tokelau, .tk, which is now the second-largest TLD in the world, had only 224 abusive domains per million under management, according to the report..

Today’s report ranked TLDs with over 100,000 names under management. Over 90% of the abusive domains used to calculate the scores were related to spam, rather than anything more nefarious.

The data was compiled from Architelos’ NameSentry service, which aggregates abusive URLs from numerous third-party sources and tallies up the number of times each TLD appears.

The methodology is very similar to the one DI PRO uses in TLD Health Check, but Architelos uses more data sources. NameSentry is also designed to automate the remediation workflow for registries.

Plural gTLDs not confusing, says ICANN (and two gotchas proving it wrong)

Dozens of new gTLD applicants will be breathing a sigh of relief this morning as ICANN said it will allow single and plural versions of the same gTLD to co-exist after all.

The decision, made Tuesday by ICANN’s New gTLD Program Committee, affects at least 98 applications. It said:

NGPC has determined that no changes are needed to the existing mechanisms in the Applicant Guidebook to address potential consumer confusion resulting from allowing singular and plural versions of the same string.

It was in response to the Governmental Advisory Committee, which had advised ICANN to “reconsider its decision to allow singular and plural versions of the same strings.”

Because of the wording of the advice, ICANN is able to disagree with the the GAC’s opinion that “singular and plural versions of the string as a TLD could lead to potential consumer confusion” without triggering its bylaws provision that forces it into time-consuming GAC negotiations.

By “reconsidering” plural/singular coexistence and not doing anything, it has stuck to the letter of the advice.

In its reconsideration it reconsiderated whether it should overturn the findings of its independent String Similarity Panel, which did not believe any plural/singular pairs were confusingly visually similar.

It also used the coexistence of second-level plural and singular domains, registered to different people, as evidence that users would not find similar coexistence at the top level confusing.

The decision has potentially far-reaching consequences on the new gTLD program.

First, it could mean that some plural/singular pairs will be allowed to exist while others will not.

There are a handful of formal String Confusion Objections filed by applicants for gTLDs that have singular or plural competitors in the current round.

These string pairs are not currently in contention sets, but if the objectors prevail only one of the strings will survive to delegation.

Other string pairs have no objections and will be allowed to coexist. This may be fair in a sense, but it’s not uniform nor predictable.

(One wonders if the String Confusion Objection arbitration panels will use ICANN’s ruling this week in their own decision-making process, which could open a can of worms.)

Second, I think the decision might encourage bad business practices by registries.

My beef with coexistence

I don’t think coexistence is a wholly terrible idea, but I do think it will have some negative effects, as I’ve expressed in the past.

First, I think it’s going to lead to millions of unnecessary defensive registrations.

And by “defensive” I’m not talking about companies protecting their trademarks. Whether you think they’re adequate or not, trademark owners already have protections in new gTLDs.

I’m talking about regular domain registrants, small businesses, entrepreneurs and so on. These people are going to find themselves buying two domains when they only need one.

Let’s say you’re Mad John’s Autos, and you’re registering madjohn.auto. You get to the checkout and Go Daddy offers you the matching .autos domain. Assuming similar pricing, you’d definitely register it, right?

You’ve always got to assume a certain subset of users will get confused and either wind up at a dead URL or a competitor’s site. It’s simpler just to defensively register both.

What if one was priced a little higher than the other? Maybe you’d still register it. How big would the price differential have to be before you decided not to buy the plural duplicate?

Buying two domains instead of one may not be a huge financial burden to individual registrants, but it’s going to lead to situations where gTLDs exist in symbiotic — or parasitic — pairs.

If you run the .auto registry, you may find that your plural competitor is spending so much on marketing .autos that you don’t need to lift a finger in order to sell millions of domain names.

Just make sure you’re partnered with the same registrars and bingo: you’re up-sell.

Attractive business plan, right? You may disagree, but when ICANN opens the floodgates for the second round of new gTLD applications in a couple years, we’ll find out for sure.

Two gotchas

Defenses of plural/singular gTLD coexistence often come from, unsurprisingly, the portfolio applicants that have applied for them and, presumably, may apply for them in future rounds.

“Singulars and plurals live together now on the [second-level domain] side,” Uniregistry said. “They create healthy competition and do not unduly confuse consumers to the point of annoyance.”

I wouldn’t disagree with that statement. Plural/singular coexistence may not confuse internet users to the point of danger or annoyance. But, I would argue, they do make people buy more domain names than they need to.

If you were buying autos.com today you’d definitely definitely buy auto.com as well and redirect it to autos.com. You’d be an idiot not too.

When I put this to Uniregistry execs privately several weeks ago, they disagreed with me. Nobody would bother with such duplicative/defensive domains, they said.

In response, I asked, cheekily: so why do you own uniregistries.com, redirecting it to uniregistry.com?

Another portfolio applicant, Donuts, also didn’t like the idea of plurals and singulars being mutually exclusive, according to this CircleID article. It doesn’t think they’re confusingly similar.

Yet a press release put out by the company last month accidentally said it planned to put its application for .apartment to auction.

The problem is that Donuts hasn’t applied for .apartment, it has applied for .apartments.

I feel rotten for highlighting a simple typo by a fellow media professional (I make enough of those) but isn’t that what we’re often talking about when discussing confusing similarity? Typos?

If the registry can get confused by its own applied-for strings, doesn’t that mean internet users will as well?

Oh, I’m a cybersquatter

Interestingly, ICANN’s belief that plurals are not confusing appears to be institutional.

At least, I discovered this morning that icanns.org, the plural of its primary domain, was available for registration.

So I bought it.

Let’s see how much traffic it gets.

If I get hit by a UDRP, that could be interesting too.

ICANN offers to split the cost of GAC “safeguards” with new gTLD registries

Kevin Murphy, June 28, 2013, Domain Policy

All new gTLD applicants will have to abide by stricter rules on security and Whois accuracy under government-mandated changes to their contracts approved by the ICANN board.

At least one of the new obligations is likely to laden new gTLDs registries with additional ongoing costs. In another case, ICANN appears ready to shoulder the financial burden instead.

The changes are coming as a result of ICANN’s New gTLD Program Committee, which on on Tuesday voted to adopt six more pieces of the Governmental Advisory Committee’s advice from March.

This chunk of advice, which deals exclusively with security-related issues, was found in the GAC’s Beijing communique (pdf) under the heading “Safeguards Applicable to all New gTLDs”.

Here’s what ICANN has decided to do about it.

Mandatory Whois checks

The GAC wanted all registries to conduct mandatory checks of Whois data at least twice a year, notifying registrars about any “inaccurate or incomplete records” found.

Many new gTLD applicants already offered to do something similar in their applications.

But ICANN, in response to the GAC advice, has volunteered to do these checks itself. The NGPC said:

ICANN is concluding its development of a WHOIS tool that gives it the ability to check false, incomplete or inaccurate WHOIS data

Given these ongoing activities, ICANN (instead of Registry Operators) is well positioned to implement the GAC’s advice that checks identifying registrations in a gTLD with deliberately false, inaccurate or incomplete WHOIS data be conducted at least twice a year. To achieve this, ICANN will perform a periodic sampling of WHOIS data across registries in an effort to identify potentially inaccurate records.

While the resolution is light on detail, it appears that new gTLD registries may well be taken out of the loop completely, with ICANN notifying their registrars instead about inaccurate Whois records.

It’s not the first time ICANN has offered to shoulder potentially costly burdens that would otherwise encumber registry operators. It doesn’t get nearly enough credit from new gTLD applicants for this.

Contractually banning abuse

The GAC wanted new gTLD registrants contractually forbidden from doing bad stuff like phishing, pharming, operating botnets, distributing malware and from infringing intellectual property rights.

These obligations should be passed to the registrants by the registries via their contracts with registrars, the GAC said.

ICANN’s NGPC has agreed with this bit of advice entirely. The base new gTLD Registry Agreement is therefore going to be amended to include a new mandatory Public Interest Commitment reading:

Registry Operator will include a provision in its Registry-Registrar Agreement that requires Registrars to include in their Registration Agreements a provision prohibiting Registered Name Holders from distributing malware, abusively operating botnets, phishing, piracy, trademark or copyright infringement, fraudulent or deceptive practices, counterfeiting or otherwise engaging in activity contrary to applicable law, and providing (consistent with applicable law and any related procedures) consequences for such activities including suspension of the domain name.

The decision to include it as a Public Interest Commitment, rather than building it into the contract proper, is noteworthy.

PICs will be subject to a Public Interest Commitment Dispute Resolution Process (PICDRP) which allows basically anyone to file a complaint about a registry suspected of breaking its commitments.

ICANN would act as the enforcer of the ruling, rather than the complainant. Registries that lose PICDRP cases face consequences up to an including the termination of their contracts.

In theory, by including the GAC’s advice as a PIC, ICANN is handing a loaded gun to anyone who might want to shoot down a new gTLD registry in future.

However, the proposed PIC language seems to be worded in such a way that the registry would only have to include the anti-abuse provisions in its contract in order to be in compliance.

Right now, the way the PIC is worded, I can’t see a registry getting terminated or otherwise sanctioned due to a dispute about an instance of copyright infringement by a registrant, for example.

I don’t think there’s much else to get excited about here. Every registry or registrar worth a damn already prohibits its customers from doing bad stuff, if only to cover their own asses legally and keep their networks clean; ICANN merely wants to formalize these provisions in its chain of contracts.

Actually fighting abuse

The third through sixth pieces of GAC advice approved by ICANN this week are the ones that will almost certainly add to the cost of running a new gTLD registry.

The GAC wants registries to “periodically conduct a technical analysis to assess whether domains in its gTLD are being used to perpetrate security threats such as pharming, phishing, malware, and botnets.”

It also wants registries to keep records of what they find in these analyses, to maintain a complaints mechanism, and to shut down any domains found to be perpetrating abusive behavior.

ICANN has again gone the route of adding a new mandatory PIC to the base Registry Agreement. It reads:

Registry Operator will periodically conduct a technical analysis to assess whether domains in the TLD are being used to perpetrate security threats, such as pharming, phishing, malware, and botnets. Registry Operator will maintain statistical reports on the number of security threats identified and the actions taken as a result of the periodic security checks. Registry Operator will maintain these reports for the term of the Agreement unless a shorter period is required by law or approved by ICANN, and will provide them to ICANN upon request.

You’ll notice that the language is purposefully vague on how registries should carry out these checks.

ICANN said it will convene a task force or GNSO policy development process to figure out the precise details, enabling new gTLD applicants to enter into contracts as soon as possible.

It means, of course, that applicants could wind up signing contracts without being fully apprised of the cost implications. Fighting abuse costs money.

There are dozens of ways to scan TLDs for abusive behavior, but the most comprehensive ones are commercial services.

ICM Registry, for example, decided to pay Intel/McAfee millions of dollars — a dollar or two per domain, I believe — for it to run daily malware scans of the entire .xxx zone.

More recently, Directi’s .PW Registry chose to sign up to Architelos’ NameSentry service to monitor abuse in its newly relaunched ccTLD.

There’s going to be a fight about the implementation details, but one way or the other the PIC would make registries scan their zones for abuse.

What the PIC does not state, and where it may face queries from the GAC as a result, is what registries must do when they find abusive behavior in their gTLDs. There’s no mention of mandatory domain name suspension, for example.

But in an annex to Tuesday’s resolution, ICANN’s NGPC said the “consequences” part of the GAC advice would be addressed as part of the same future technical implementation discussions.

In summary, the NGPC wants registries to be contractually obliged to contractually oblige their registrars to contractually oblige their registrants to not do bad stuff, but there are not yet any obligations relating to the consequences, to registrants, of ignoring these rules.

This week’s resolutions are the second big batch of decisions ICANN has taken regarding the GAC’s Beijing communique.

Earlier this month, it accepted some of the GAC’s direct advice related to certain specific gTLDs it has a problem with, the RAA and intergovernmental organizations and pretended to accept other advice related to community objections.

The NGPC has yet to address the egregiously incompetent “Category 1” GAC advice, which was the subject of a public comment period.

Directi launches pre-reg site for .host gTLD

Directi is to offer preregistration for its uncontested gTLD applications, and it’s starting with .host.

The company will accept expressions of interest from potential registrants from June 17, where it has a booth at the HostingCon show in Austin, Texas, according to business head Sandeep Ramchandani.

Directi’s other two uncontested bids — .press and .space — will also get preregistration pages.

It’s the usual pre-reg deal: free and no-obligation.

While .host has not yet passed its Initial Evaluation, the company’s other applications have has a smooth ride so far so it’s a pretty reasonable assumption that this one will also pass.

The bid also has no objections and no special Governmental Advisory Committee advice.

While preregistration services have proved controversial in the past, they’re becoming increasingly common as new gTLDs start thinking about what a crowded market they’re walking into.

China pushes .pw to over 250,000 names

Directi’s .PW Registry has taken over 250,000 domain registrations in the two and a half months since it launched, largely thanks to growth in China.

According to recent DomainTools research, Chinese registrars such as DNSPod and Xin Net lead .pw sales, and .PW business head Sandeep Ramchandani told DI today that this trend is now even more noticeable.

The frankly surprising volume seems to be due largely to its low pricing and some aggressive registrar promotion. Xin Net, for example, sells .pw names for about $6 each, compared to $9 for .com.

While Chinese-script domains are available, most registrations are for Latin strings, Ramchandani said.

The 250,000 number excludes domains that have been deleted for abuse, of which there have been quite a lot.

Ramchandani said that the registry’s abuse department is staffed around the clock.

Directi is using NameSentry from Architelos to track abusive names and has made deals with the most-abused registrars to take down names at the registry level when they pop up, he said.

Today’s new gTLD withdrawals: .play and .design

Two new gTLD applications have been withdrawn today: Directi’s .play and Starting Dot’s .design.

They’re the second application to be withdrawn by Directi after .movie, which it pulled last month for undisclosed reasons, and the first of Starting Dot’s five bids to die.

Starting Dot said that it has bowed out of the .design fight because there were “simply too many” other applicants in the contention set: eight including itself.

“It is now setting its focus and energy supporting and helping to grow its four other domains, and especially the two which are single applicant, .ARCHI and .BIO,” the company said.

I don’t believe either string was the subject of the private auctions that are happening this week. At least, they weren’t on the lists published by Demand Media or Donuts.

Directi’s .play bid, the first of the four-way contention set to be withdrawn, faces competition from Amazon and Google — both with “closed generic” models — as well as Famous Four Media.

The gTLD deadpool now comprises 71 withdrawals.

Directi’s t.co? Single-letter .pw sold to Upworthy

Directi has sold u.pw to social media linking service Upworthy for what is likely to be a five-figure sum.

Upworthy will use the domain for its custom link-shorteners.

It’s the third announced single-character .pw sale to be announced. The first two, w.pw and p.pw were sold to a hosting company for $8,000 each.

I expect u.pw sold for a little more, judging by the catalog of single-letter names listed on PremiumDomains.pw, which have buy-it-now prices of $10,000 to $12,000.

It’s potentially a nicer deal in terms of visibility for the recently relaunched ccTLD too.

Year-old Upworthy, which has been funded to the tune of $4 million, is a viral video site for “worthy” content, meaning its main purpose is to have its links spread far and wide.

Another recently relaunched ccTLD, had a similar — if much more high-profile — anchor tenant in Twitter, which bought t.co for its in-house URL shortening service.

At one point, single-character .co domains were said to be selling for $1.5 million a pop, which just goes to show how far a nice TLD string can impact prices.

Go Daddy IPO “not off the table”

Go Daddy may be on the IPO track with its new investors and management.

Speaking to the Wall Street Journal about the possibility of going public, CEO Blake Irving said:

It’s not off the table. We’re growing at double digits [in terms of percentage] on the customer side, on revenue, on earnings, so the opportunity for us to have an IPO is quite good. The board is quite supportive of taking that direction, if that’s what we want to do.

Go Daddy famously yanked its planned IPO in 2006 just weeks before it was set to execute, apparently at the whim of then-CEO and majority owner Bob Parsons.

Since then, Parsons has taken a lower profile role at the company, and his shareholding was diluted to reportedly lower than 35% by an investment from KKR and Silver Lake Partners reportedly worth over $2 billion.

The short WSJ interview also reveals a few other interesting tidbits, such as the fact that Irving commutes to Go Daddy’s Arizona headquarters by plane once a week.

Directi gets into the subdomain game

Directi, fresh from relaunching .pw, will shortly start selling third-level domain names under .in.net, mimicking the pseudo-TLD business model most often associated with CentralNic.

The sub-domains will be targeted at the Indian market, with prices expected to be in the sub-$10 range.

Directi is set to launch June 17 with a 42 day “landrush & TM claims service”, apparently merging “premium” name registration with the trademark protection sunrise period.

General availability will begin August 1.

India’s ccTLD is of course .in, and .in.net looks a little bit like it.