Latest news of the domain name industry

Recent Posts

Verisign launches name-spinner tool for if you really, really need a .com

Kevin Murphy, November 20, 2017, Domain Registries

Verisign has launched a new name-spinning tool, designed to help new businesses find relevant domain names in Verisign-managed TLDs.

It’s called NameStudio. Verisign said:

NameStudio can deliver relevant .com and .net domain name suggestions based on popular keywords, trending news topics and semantic relevance. Pulling from multiple and diverse data sources, the service can identify the context of a word, break search terms apart into logical combinations and quickly return results. It can also distinguish personal names from other keywords and use machine-learning algorithms that get smarter over time.

The machine-learning component may come in handy, based on my non-scientific, purely subjective messing around at the weekend.

I searched for “london pubs”, a subject close to my heart. Naturally enough, londonpubs.com is not available, but the suggestions were not what you’d call helpful.

NameStudio

As you can see, the closest match to London it could find was “Falkirk”, a town 400 miles away in Scotland. The column is filled with the names of British towns and cities, so the tool clearly knows what London is, even if its suggestions are not particularly useful for a London-oriented web site.

The closest match to “pubs” was “cichlids”, which Google reliably informs me is a type of fish. “ComicCon” (a famous trademark), “barbarians” and a bunch of sports, dog breeds and so on feature highly on its list of suggestions.

NameStudio obviously does not know what a “pub” is, but it’s not a particularly common word in most of Verisign’s native USA, so I tried “london bars” instead. The results there were a little more encouraging.

NameStudio

Again, Falkirk topped the list of London alternatives, a list that this time also prominently included the names of Australian cities.

On the “bars” column, suggestions such as “parties”, “stags” and “nights” suggests that NameStudio has a notion what I’m looking for, but the top suggestion is still “birthdays”.

I should note that the service also suggests prefixes such as “my” and “free” and suffixes such as “online” or “inc”, so if you have your heart set on a .com domain you’ll probably be able to find something containing your chosen keywords.

The domains alllondonpubs.com and alllondonbars.com were probably the best available alternatives I could find. For my hypothetical London-based pub directory/blog web site, they’re not terrible choices.

I also searched NameStudio for “domain blog”, another subject close to my heart.

The top three suggestions in the “domain” column were “pagerank”, “websites” and “query”. Potentially relevant. Certainly some are in the right ball-park. Let’s ignore that “pagerank” is a Google trademark that nobody really talks about much any more.

The top suggestions to replace “blog” were “infographic”, “snippets” and “rumor”. Again, right ball-park, but my best bet still appears to be adding a prefix or suffix to my original keywords.

I tried a few more super-premium one-word keywords too.

The best suggestion for “vodka” was “dogvodka.com”. For “attorney”, it was “funattorney.com”. For “insurance”, there were literally no available suggestions.

Currently — and to be fair the tool just launched last week — you’re probably better off looking at other name suggestion tools.

NameStudio does not appear to currently suggest domains that are listed for sale on the aftermarket. I expect that’s a feature addition that could come in future.

But possibly the main problem with the tool appears to be that it currently only looks for available names in .com, .net, .tv or .cc.

Repeating my “london pubs” search with GoDaddy and DomainsBot, which each support hundreds more TLDs, produced arguably superior results.

NameStudio

They’re only superior, of course, if you consider your chosen keywords, and the brevity of your domain, more important than your choice of TLD. For some people, a .com at the end of the domain will always be the primary consideration, and perhaps those people are Verisign’s target market.

Verisign and Afilias testing Whois killer

Kevin Murphy, October 25, 2017, Domain Tech

Verisign and Afilias have become the first two gTLD registries to start publicly testing a replacement for Whois.

Both companies have this week started piloting implementations of RDAP, the Registration Data Access Protocol, which is expected to usurp the decades-old Whois protocol before long.

Both pilots are in their very early stages and designed for a technical audience, so don’t expect your socks to be blown off.

The Verisign pilot offers a web-based, URL-based or command-line interface for querying registration records.

The output, by design, is in JSON format. This makes it easier for software to parse but it’s not currently very easy on the human eye.

To make it slightly more legible, you can install a JSON formatter browser extension, which are freely available for Chrome.

Afilias’ pilot is similar but does not currently have a friendly web interface.

Both pilots have rudimentary support for searching using wildcards, albeit with truncated result sets.

The two new pilots only currently cover Verisign’s .com and .net registries and Afilias’ .info.

While two other companies have notified ICANN that they intend to run RDAP pilots, these are the first two to go live.

It’s pretty much inevitable at this point that RDAP is going to replace Whois relatively soon.

Not only has ICANN has been practically champing at the bit to get RDAP compliance into its registry/registrar contracts, but it seems like the protocol could simplify the process of complying with incoming European Union privacy legislation.

RDAP helps standardize access control, meaning certain data fields might be restricted to certain classes of user. Cops and IP enforcers could get access to more Whois data than the average blogger or domainer, in other words.

As it happens, it’s highly possible that this kind of stratified Whois is something that will be legally mandated by the EU General Data Protection Regulation, which comes into effect next May.

Forget emojis, you can buy Egyptian hieroglyph .com domains

Call them the Emojis of the Ancient World.

Egyptian hieroglyphs were once the cutting edge of written communication, and it turns out Verisign lets you register .com domains using them.

Internationalized domain names expert Andre Schapp discovered a couple months ago that the Unicode code points for the ancient script have been approved in 16 Verisign gTLDs, and apparently no others.

This means that domains such as hieroglyph should resolve.

Unfortunately, DI’s database does not support these characters, so I’m having to use images.

But at least one domain investor seems have snapped up a few dozen single-pictograph Egyptian hieroglyph names about a month ago, and his page has clickable links.

Whether you see the hieroglyph or the Punycode, prefixed “xn--“, seems to depend on your browser configuration.

Ancient Egyptian is apparently not the only dead script that Verisign supports.

According to IANA, you can also get .com domains in Sumero-Akkadian cuneiform, which went out of fashion in the second century CE, as well Phoenician, the world’s oldest known script.

Then there’s Imperial Aramaic, Meitei, Kharosthi, ‘Phags-pa, Sylheti Nagari and goodness knows how many other extinct writing systems.

It seems .com has been approved for 237 IDN scripts, in total. Let it not be said that Verisign does not offer domainers ample opportunity to spunk their cash on gibberish.

No Klingon, though.

How .com became a restricted TLD

Verisign has been given approval to start restricting who can and cannot register .com and .net domain names in various countries.

Customers of Chinese registrars are the first to be affected by the change to the registry’s back-end system, which was made last year.

ICANN last week gave Verisign a “free to deploy” notice for a new “Verification Code Extension” system that enables the company to stop domains registered via selected registrars from resolving unless the registrant’s identity has been verified and the name is not on China’s banned list.

It appears to be the system Verisign deployed in order to receive its Chinese government license to operate in China.

Under Verification Code Extension, Verisign uses ICANN records to identify which registrars are based in countries that have governmental restrictions. I believe China is currently the only affected country.

Those registrars are able to register domains normally, but Verisign will prevent the names from resolving (placing them in serverHold status and keeping them out of the zone file) unless the registration is accompanied by a verification code.

These codes are distributed to the affected registrars by at least two verification service providers. Verisign, in response to DI questions, declined to name them.

Under its “free to deploy” agreement with ICANN (pdf), Verisign is unable to offer verification services itself. It must use third parties.

The company added the functionality to its .com and .net registry as an option in February 2016, according to ICANN records. It seems to have been implemented last July.

A Verisign spokesperson said the company “has implemented” the system.

The Verification Code Extension — technically, it’s an extension to the EPP protocol pretty much all registries use — was outlined in a Registry Services Evaluation Process request (pdf) last May, and approved by ICANN not long after.

Verisign was approved to operate in China last August in the first wave of gTLD registries to obtain government licenses.

Under Chinese regulations, domain names registered in TLDs not approved by the government may not resolve. Registrars are obliged to verify the identities of their registrants and names containing certain sensitive terms are not permitted.

Other gTLDs, including .vip, .club, .xyz .site and .shop have been granted approval over the last few months.

Some have chosen to work with registration gateway providers in China to comply with the local rules.

Apart from XYZ.com and Verisign, no registry has sought ICANN approval for their particular implementation of Chinese law.

Because Chinese influence over ICANN is a politically sensitive issue right now, it should be pointed out that the Verification Code Extension is not something that ICANN came up with in response to Chinese demands.

Rather, it’s something Verisign came up with in response to Chinese market realities. ICANN has merely rubber-stamped a service requested by Verisign.

This, in other words, is a case of China flexing market muscle, not political muscle. Verisign, like many other gTLD registries, is over-exposed to the Chinese market.

It should also be pointed out for avoidance of doubt that the Chinese restrictions do not apply to customers of non-Chinese registrars.

However, it appears that Verisign now has a mechanism baked into its .com and .net registries that would make it much easier to implement .com restrictions that other governments might choose to put into their own legislation in future.

Phishing in new gTLDs up 1,000% but .com still the worst

Kevin Murphy, February 20, 2017, Domain Registries

The .com domain is still the runaway leader TLD for phishing, with new gTLDs still being used for a tiny minority of attacks, according to new research.

.com domains accounted for 51% of all phishing in 2016, despite only having 48% of the domains in the “general population”, according to the 2017 Phishing Trends & Intelligence Report
from security outfit PhishLabs.

But new gTLDs accounted for just 2% of attacks, despite separate research showing they have about 8% of the market.

New gTLDs saw a 1,000% increase in attacks on 2015, the report states.

The statistics are based on PhishLabs’ analysis of nearly one million phishing sites discovered over the course of the year and include domains that have been compromised, rather than registered, by attackers.

The company said:

Although the .COM top-level domain (TLD) was associated with more than half of all phishing sites in 2016, new generic TLDs are becoming a more popular option for phishing because they are low cost and can be used to create convincing phishing domains.

There are a few reasons new gTLDs are gaining traction in the phishing ecosystem. For one, some new gTLDs are incredibly cheap to register and may be an inexpensive option for phishers who want to have more control over their infrastructure than they would with a compromised website. Secondly, phishers can use some of the newly developed gTLDs to create websites that appear to be more legitimate to potential victims.

Indeed, the cheapest new gTLDs are among the worst for phishing — .top, .xyz, .online, .club, .website, .link, .space, .site, .win and .support — according to the report.

But the numbers show that new gTLDs are significantly under-represented in phishing attacks.

According to separate research from CENTR, there were 309.4 million domains in existence at the end of 2016, of which about 25 million (8%) were new gTLDs.

Yet PhishLabs reports that new gTLD domains were used for only about 2% of attacks.

CENTR statistics have .com with a 40% share of the global domain market, with PhishLabs saying that .com is used in 51% of attacks.

The difference in the market share statistics between the two sets of research is likely due to the fact that CENTR excludes .tk from its numbers.

Again, because PhishLabs counts hacked sites — in fact it says the “vast majority” were hacked — we should probably exercise caution before attributing blame to registries.

But PhishLabs said in its report:

When we see a TLD that is over-represented among phishing sites compared to the general population, it may be an indication that it is more apt to being used by phishers to maliciously register domains for the purposes of hosting phishing content. Some TLDs that met these criteria in 2016 included .COM, .BR, .CL, .TK, .CF, .ML, and .VE.

By far the worst ccTLD for phishing was Brazil’s .br, with 6% of the total, according to the report.

Also notable were .uk, .ru, .au, .pl, and .in, each with about 2% of the total, PhishLabs said.