Net4’s “complete breakdown” is bringing India to a screeching halt, and ICANN could have prevented it

Domains belonging to hospitals, power grids, public transit services, banks, and other critical services have gone offline due to the collapse of a major local registrar whose troubles ICANN has been aware of for years.

Net 4 India, which has been slowly imploding over the last year, saw a number of its name servers stop functioning last week, leading to customers’ web sites and email services ceasing to work.

Affected customers are not only domainers, web developers, mom-n-pop stores, and small businesses. We’re talking about major players in India’s physical infrastructure, some with billions of dollars of annual revenue.

Power Grid Corporation of India, for example, has complained to ICANN that its primary web site, at powergridindia.com, has gone down, and that its email at that domain is no longer working.

That’s a government-owned company that according to Wikipedia takes in $5.4 billion per year and is responsible for transmitting 50% of the electricity generated in India, a nation of almost 1.4 billion people.

“We are facing problems with DNS of Net4India and due to non availability of email service our operations would affect badly,” a Power Grid employee told ICANN, according to papers filed with Net4’s insolvency court at the weekend.

Others to inform ICANN of outages include:

• The Delhi Metro Rail Corporation, which with over four million passengers per day is India’s largest mass transit rail network.
• Multi-billion-dollar conglomerate Bharti Group, which has its fingers in pies such as telecoms, insurance and food, said its “email and other essential business services have been rendered defunct”.
• The Punjab National Bank, which had revenue of over $9 billion last year, named eight domains, seven of which were in gTLDs, that were with Net4 but no longer work.
• Global Hospitals India, a private healthcare provider that sees to 18,000 transplant surgeries per year, has seen its .com domain stop working and has been unable to secure an auth code for a transfer out.

I’ve not seen any reports of these internet-based problems spilling over into actual life-threatening issues such as power outages or failures of critical hospital functions, but one can only assume that not having functional email represents a risk of this kind of thing happening.

The customer testimonies cited above were part of a second batch (pdf) sent to the insolvency court handling Net4’s case by ICANN’s head of compliance, Jamie Hedlund, on Sunday.

And those are just a sampling of the over 2,400 complaints about Net4 that ICANN said it received between April 14 and April 16 last week.

Net4’s own web site appears to have been dark for most or all of this month.

And this is all happening as India’s struggle with the coronavirus pandemic hits a low point. Not only have many heavily-populated areas of the country been forced into lockdown in recent days, but the country seems to have spawned its own virus variant, which is raising concerns among scientists worldwide.

A major internet infrastructure crisis couldn’t come at a worse time, but ICANN not only could fix it now but could have prevented it years ago.

ICANN on February 26 told Net4 it would terminate the company’s Registrar Accreditation Agreement, after the company did not get its act together to fix three previous breach notices detailing its customers’ woes, the first of which was issued December 10.

That meant — or should have meant — that after March 13 ICANN would kick off its process of transferring Net4’s domains and customers to a third-party registrar, where none of this downtime nonsense would have occurred.

But the “resolution professional” trying to keep Net4 alive long enough to service its corporate creditors asked the insolvency court to ask ICANN to halt the termination, and the court complied.

Even though neither ICANN nor the court seems to be claiming that the court has any jurisdiction over a California non-profit and an RAA governed by California law, ICANN has nevertheless spent the last five weeks noticeably NOT terminating Net4 and saving its customers as promised.

Hedlund told the court (pdf) at the weekend:

Unfortunately, ICANN currently is not in a position to assist these individuals, businesses and organizations in transferring their domain names from Net 4 to another registrar because ICANN has no access to AuthInfo codes or the technical ability to generate them the way that registry operators, like the National Internet Exchange of India (NIXI), and registrars, like Net 4, can. Rather, ICANN can only assist these registrants by transitioning all of Net 4’s registrations to a functioning registrar through a bulk transfer in connection with ICANN’s termination of Net 4’s RAA, which ICANN has been prevented from doing as a result of this Hon’ble Tribunal’s Ad Interim Order of 16 March 2021

It’s not at all clear from the record why ICANN’s lawyers are allowing Net4’s customers to suffer — and its own compliance department to turn into a de facto replacement for Net4’s absentee customer service department — to abide by the suggestion of a court they claim has no power over it.

In fact, it’s not even clear why ICANN has been playing softball with Net4 since it first issued a breach notice against the firm in June 2019.

At that time, ICANN threatened to suspend Net4 for going into insolvency proceedings — the RAA gives it the right to do so unilaterally when “proceedings are instituted by or against Registrar under any bankruptcy, insolvency, reorganization or other laws relating to the relief of debtors”.

If it had wanted to, ICANN could have terminated Net4 and transferred its domains to a safe registrar in 2019, a year before its troubles (arguably exacerbated by the pandemic) started to cause serious problems for the registrar’s customers.

But ICANN did not act at that time. Instead, court filings and other documents suggest, it chose to cooperate with Net4 and the resolution professional, allowing Net4 to continue to market itself to new customers as an accredited registrar.

Hindsight is a wonderful thing, and it’s something ICANN didn’t have in June 2019.

But now that we do have that luxury, surely we can say that the Net4 debacle is going to have to go down as one of ICANN’s all-time most humiliating and potentially dangerous failures.

ICANN threatens to seize gTLD after Whois downtime

Are we about to see our next gTLD registry implosion?

ICANN has whacked the company behind .gdn with a breach notice and a threat that it may seize the TLD, after its Whois systems allegedly suffered days of downtime.

According to ICANN, .gdn exceeded its weekly and monthly downtime limits in late March and early April, in both months triggering the threshold whereby ICANN is allowed to transition the TLD to an Emergency Back-End Registry Operator.

gTLD registries are allowed to have 864 minutes (about 14 hours) of unplanned Whois downtime per month. Downtime exceeding 24 hours per week is enough to trigger ICANN’s EBERO powers.

It appears to be the third time .gdn’s Whois has gone on the blink for longer than the permitted period — ICANN says it happened in April 2018 and August 2019 too. Those incidents were not publicized.

It seems the Russian registry, Joint Stock Company “Navigation-information systems”, managed to fix the problem on April 2, and ICANN is not invoking the EBERO transition, something it has done just a couple times before, just yet.

But it does want NIS to present it with a plan showing how it intends to avoid another spell of excessive downtime in future. It has until May 8, or ICANN may escalate.

.gdn is by most measures a bullshit TLD.

While it was originally intended to address some kind of satellite navigation niche, it eventually launched as a pure generic with the backronym “Global Domain Name” in 2016.

It managed to rack up over 300,000 registrations in the space of a year, almost all via disgraced and now-defunct registrar AlpNames, and was highlighted by SpamHaus as being one of the most spam-friendly of the new gTLDs.

After AlpNames went out of business two years ago, ICANN transferred some 350,000 .gdn names to CentralNic-owned registrar Key-Systems.

Today, Key-Systems has fewer than 300 .gdn domains. The TLD’s zone file dropped by about 290,000 domains in a single day last December.

.gdn had fewer than 11,000 domains under management at the end of 2020, 90% of which were registered through a Dubai-based registrar called Intracom Middle East FZE.

Intracom pretty much only sells .gdn domains, suggesting an affiliation with the registry.

Web searches for live sites using .gdn return not much more than what looks like porn spam.

A busted Whois looks like the least of its problems, to be honest.

As Net4 goes dark, NIXI says customers won’t lose their expired domains

Indian ccTLD registry NIXI has thrown a life vest to the owners of some 73,000 .in domain names, giving them a way to transfer out of slowly sinking registrar Net 4 India.

NIXI also said that it will not cancel expired domains that registrants have been unable to renew due to Net4’s ongoing problems.

“NIXI has decided not to discontinue the .IN Services for those .IN domain end users whose renewal is due,” the company said in a statement (pdf).

It sounds rather like registrants will be able to renew directly with the registry. They’ll also be able to transfer to a new registrar by emailing NIXI from the address in the Whois or mailing proof of company identity.

Why NIXI has chosen to act now, when Net4’s troubles have been known for almost year, is not clear.

“In the recent days, NIXI was informed that Net 4 India, who is one of the registrars of NIXI for Country code domain “.IN” has some issues in maintaining domains,” its statement says.

Net4’s web site isn’t resolving right now, at least for me, which probably has something to do with it.

The company has been in insolvency proceedings since 2017, a fact ICANN discovered when it started missing payments two years ago, but it was not until mid-2020 that Net4’s customers started complaining en masse about problems renewing and transferring their domains.

ICANN has processed thousands of complaints since then.

The registrar was told last month that ICANN was terminating its accreditation to sell gTLDs. Registrants of names in .com for example should be pretty safe, with their names automatically transferred to a new registrar, should ICANN follow through on its threat.

The termination was challenged in the insolvency court shortly before it would have become effective two weeks ago.

While ICANN does not believe it is subject to the court’s jurisdiction, it has decided to wait for an official ruling on the matter.

ICANN finally cans Net 4 India

iCANN has terminated Net 4 India’s registrar accreditation, after many months of criticism and foot-dragging and a recent sharp uptick in customer complaints.

The move comes after an unprecedented four concurrent public breach notices over 20 months, almost four years after the company entered insolvency proceedings — grounds for termination which ICANN became aware of almost two years ago.

ICANN has received over 2,600 customer complaints over the last year, and almost 1,000 of these were submitted in February alone, according to the organization.

“The termination of the RAA is due to Net 4 India’s repeated and consistent breaches of the RAA and failure to cure such breaches despite multiple notices from ICANN and opportunity to cure,” ICANN said in its ginormous 59-page execution warrant (pdf).

Among the charges ICANN levels at Net4 is its failure to operate a functioning Whois service, something it’s warned the company about 30 times since November.

This hindered ICANN’s ability to investigate the more serious charges — that Net4 transferred some of its customers’ domains to a different registrar, OpenProvider, without their knowledge or consent, in violation of ICANN transfer policies.

The registrar also failed to enable its customers to renew their expired domains or transfer them to other registrars, also in violation of binding policy, ICANN said.

ICANN said:

Currently, more than 400 cases remain unresolved; and hundreds of complaints are still under review, which, once vetted, will become more new cases. In addition, ICANN Contractual Compliance continues to receive more than 20 new complaints each day. And it is not known how many more complaints are pending with Net 4 India that have not yet been brought to ICANN’s attention.

The termination notice contains 10 pages of complaints from Net4 customers, saying their domains could not be renewed or transferred. Some came from non-profits and hospitals. One registrant said he was contemplating suicide.

Net4’s customer service was non-responsive in each of these cases, the complainants said.

While some of Net4’s problems could be chalked down to coronavirus-related restrictions, the company has been in trouble for much longer.

It entered insolvency proceedings in 2017 after a debt recovery company called Edelweiss bought roughly $28 million of unpaid debt from the State Bank of India and took Net4 to court.

ICANN did not find out about this until April 2019 — it’s probably not a coincidence that this was the same month Net4 was late paying its first ICANN invoice — and it issued its first public breach notice in June that year.

Insolvency is grounds for termination in itself under the Registrar Accreditation Agreement.

It’s never been clearly stated why ICANN did not escalate at that time. Had it done so, it could have saved Net4’s customers from a world of hurt.

The Indian insolvency court admitted last month that it had no jurisdiction over ICANN or the Registrar Accreditation Agreement, both of which are governed primarily by California law.

Nevertheless, the court asked ICANN to not terminate Net4’s contract until after April 25, to give the company time to get its house in order.

But the termination notice, issued on Friday, will see the RAA cut off March 13. ICANN notes that it hasn’t heard from the court-appointed resolution professional, to whom previous breach notices were addressed, since mid-January.

Affected domains — there are still thousands under Net4’s accreditation — will be moved to another registrar under ICANN’s De-Accredited Registrar Transition Procedure.

Net4 could have a say in where its domains wind up. It’s already an OpenProvider reseller so that’s a possibility. Otherwise, ICANN will pick a beneficiary from a queue of qualified candidates.

153 registrars fingered for ICANN security probe

Registrars will be asked to account for abusive domain names found on their services, under a new ICANN security audit.

ICANN says it will soon send requests for information to 153 registrars, asking them to provide documentation showing how they dealt with domains used for distribution of malware or spam.

Registrars will get audited if more than five domains under their sponsorship showed up on a number of block-lists ICANN uses (SpamHaus and the like) during November 2020.

ICANN is spinning the number of affected registrars as a very small percentage of the accredited base, but it really isn’t.

It said that “only” 153 out of 2,380 accredited registrars are affected, apparently willfully ignoring the fact that well over 1,700 of these registrars are shell accreditations used for drop-catching and belonging to just two companies: Web.com and NameBright.

Domains never stick around at drop-catch shells for long, and abusive registrants typically aren’t buying expensive names on the aftermarket, they’re prowling the budget registrars for sub-dollar bargains and bulk-reg tools.

Up to a couple hundred or other accredited registrars have no or negligible domains under management. Several more are corporate registrars with no retail front-end.

So we’re really looking at “only” 153 out of 500 to 600 active retail registrars that saw the required level of abuse, a much higher percentage than would be ideal.

The audit is part of ICANN’s regular Contractual Compliance Audit Program, which seeks to determine whether any registrars or registries are in breach of their contractual obligations.

Under the 2013 Registrar Accreditation Agreement, registrars are obliged to document their responses to abuse reports, keep the data for two years, and hand it over to ICANN on demand.

ICANN hopes to finish the audit by the third quarter this year.

Net 4 India gets unwelcome Christmas gift from ICANN

Struggling Indian registrar Net 4 India has been hit by its third notice of contract breach by ICANN, in a letter delivered Christmas Eve.

Net4 is on ICANN’s naughty list this time due to its alleged violations of ICANN’s transfer and expired domains policies. The breach notice is very similar to that delivered just two weeks earlier, concerning different domains.

ICANN reckons Net4, once India’s largest independent registrar, has in some cases been transferring domains to a partner registrar, OpenProvider, without the consent or knowledge of the registrant.

It’s been asking the company for records proving compliance, which Net4 has apparently not been providing. Therein lies the alleged breach.

Net4 has been persona non grata among many of its customers for several months, with complaints about billing and renewal failures, expirations, and a general lack of customer service availability compounded by the coronavirus pandemic.

The company has also been fighting an insolvency proceeding over millions of dollars in allegedly unpaid debts for years, which has been the subject of an ICANN breach notice for about 18 months.

The Christmas Eve breach notice gives Net4 until January 14 to turn over the relevant records or possibly face termination.

But that might prove moot — the December 10 notice had a deadline of December 31, so the wheels may already be in motion.

ICANN throws the book at Net4 over dodgy transfer claims

Struggling Indian registrar Net 4 India has been slammed with a massive breach notice by ICANN, following claims of domain transfers failing or happening without the consent of the registrant.

ICANN also accuses the company, which is or was India’s largest independent registrar, of trying to bullshit its compliance staff about whether expired domains had been renewed or not.

According to ICANN, Net4 is in breach of the Registrar Accreditation Agreement on four counts, three of which relate to domain ownership records.

ICANN says the company isn’t operating a Whois service on the web or port 43, has failed to escrow its registration data on two recent occasions, and has failed to hand over registrant information upon ICANN’s request.

It’s also past due with its fees, ICANN says.

ICANN’s been dealing with complaints about Net4 for months, after the company’s customer service system appeared to break down in the wake of the coronavirus pandemic. Hundreds of customers have said their domains were unrenewable and that they were unable to transfer to another registrar.

In the latest breach notice — the first published breach notice against any registrar since February — ICANN names almost 200 domain names that have allegedly been held hostage at Net4, despite the registrant’s efforts to transfer out.

ICANN wants proof that registrants were given transfer authorization codes and that their domains were unlocked.

In a smaller number of cases, ICANN wants proof that domains were transferred to Net4 partner Openprovider, for which it acts as a reseller, with the consent of the registrants.

It also claims that Net4 has more than once tried to prove that a registrant renewed their expired name by supplying the registry’s expiration date instead of its own, to blag its way out of accusations that registrants were unable to renew.

ICANN also accuses the registrar of dragging its feet to address complaints:

Over the past few months, the number of complaints ICANN Contractual Compliance has received from [registered name holders], and authorized representatives, asserting that Net 4 India is exhibiting a pattern of non-response to domain transfer and renewal requests has steadily increased. While addressing the relevant compliance cases, Net 4 India’s responses to ICANN Contractual Compliance have also regularly been untimely and incomplete.

Net4 is now in the unprecedented position of being subject to two different breach notices simultaneously.

ICANN actually issued a suspension notice in June 2019, after noticing that Net4 had been in insolvency proceedings for two years — a debt recovery agency is trying to recover $28 million in unpaid debts.

But that suspension deadline was paused after talks with the “resolution professional” handling the insolvency case, for reasons ICANN’s been rather quiet about, and it remains on pause to this date.

The newest breach notice has a December 31 deadline on it. Unless Net4 turns on its Whois and hands over the reams of requested data by then, ICANN could terminate its contract.

Assuming the insolvency court allows it to, presumably.

ICANN finally addresses Net 4 India meltdown, but mysteries remain

ICANN today made an effort to publicly address the hundreds of complaints that have recently been made about Net 4 India, India’s largest registrar, which has been in insolvency proceedings for over three years and recently started losing its customers’ domains.

In a lengthy blog post, ICANN confirmed that it received roughly 300 complaints about Net4 in August and September, when India was in coronavirus lockdown and the registrar’s customer service department was unable to cope with demand.

Many customers reported on social media and elsewhere that domains were expiring and transfers to third-party registrars were not possible.

ICANN said it had received over 400 complaints since it filed its first notice of suspension against Net4, which came about after ICANN learned of the insolvency proceedings, in June 2019. It says 74% have been resolved and it’s working on the remainder.

The post sets out customers’ options when it comes to filing complaints, which is complicated by the fact that Net4 also acts as a reseller for OpenProvider, which is not in the same financial difficulty.

ICANN’s says that it is closely monitoring Net4’s compliance with its Registrar Accreditation Agreement and has regular contact with the insolvency court where the company’s case is being heard.

What’s unclear is why the company has been permitted to continue to operate as an accredited registrar, despite its insolvency proceeding being a direct violation of the RAA. ICANN filed a suspension notice in June last year, but has postponed its effective date ever since.

While ICANN says it has not ruled out terminating Net4 and transferring its domains to another registrar, the reality may be that it is unable to do so.

In today’s post, ICANN says it “postponed the start date of the Suspension Period after considering information regarding the insolvency proceedings” provided by the court-appointed resolution professional.

Last month, during the ICANN 69 public forum, the org was asked by an Indian registrant what it was doing about Net4, and compliance chief Jamie Hedlund responded:

When they initially filed for insolvency, we attempted to suspend them and prevent them from being able to register new names. But unfortunately due to the insolvency, we were not able to do that.

It seems that a resolution professional appointed by a quasi-judicial Indian court has managed to trump ICANN’s powers under its Californian-law registrar contract.

Net4’s latest registry transaction reports show that it had 90,000 gTLD domains under management at the end of July. It’s bleeding thousands of domains every month. The company claims to have 400,000 customers in total.

The insolvency proceedings were initiated in 2017 by a debt-recovery agency called Edelweiss, which had acquired $28 million of debts Net4 owed the State Bank of India.

Is India’s largest registrar about to go titsup? And where the hell is ICANN?

India’s largest independent domain name registrar appears to be “doing an AlpNames”, with many customers complaining about domains going dark, transfer codes not being issued, and customer support being unavailable for weeks.

Net 4 India, which claims to have 400,000 customers, has been in insolvency proceeds for over two years, but it’s only in the last couple months that the complaints have started piling up by the scores from disgruntled customers.

A major complaint is that renewals are not processed even after they are paid for, that transfer authcodes never arrive, that customer support never picks up the phone or replies to emails, and (occasionally) that the Net4 web site itself is down.

As we saw with AlpNames last year and RegisterFly back in the mists of time, These are all the warning signs of a registrar in trouble.

On its web site, Net4 prominently warns customers that its call centers are operating on a skeleton staff due to India’s coronavirus lockdown measures, which may account for the lack of support.

But there are reports that customers have visited the company’s offices in person to find them closed.

There’s been radio silence from the registrar. Even its Twitter account is private.

Many local commentators are pointing to the fact that Net4 is in protracted insolvency proceedings as the true underlying issue.

There have been calls for government intervention, action by .in registry NIXI, ICANN enforcement, and even the Indian equivalent of a class action lawsuit. This local cyber law blogger is all over it.

But what is ICANN doing about it?

Net4 was taken to a quasi-judicial insolvency court in 2017 by a debt-recovery company called Edelweiss over the rupee equivalent of about $28 million of unpaid loans from the State Bank of India.

ICANN has been aware of this fact since at least April 2019, when it started calling the registrar for an explanation.

Under the standard Registrar Accreditation Agreement, being in insolvency for over 30 days is grounds for unilateral termination by ICANN.

ICANN could terminate the agreement and transfer all of Net4’s gTLD domain names to a different registrar pretty much at will — all the registrant data is in escrow. This would not protect Net4’s many thousands of .in registrants of course.

ICANN suspended Net4’s RAA in June last year, but Net4 somehow managed to talk its way out of it. ICANN later rescinded the suspension on the proviso that the registrar provide monthly updates regarding its insolvency.

Net4’s cure period has been extended three times by ICANN. The latest expired July 31 this year.

At least one ICANN staffer is on the case, however. ICANN’s head of India Samiran Gupta has recently been reaching out to customers on Twitter, offering his email address and assistance getting in contact with Net4 staff, apparently with some success.

But Net4 had 95,000 gTLD names under management at the last count (though it’s been hemorrhaging thousands per month) so this individual approach won’t go very far.

Free domains registrar gets FOURTH breach notice

OpenTLD, the company that offers free and at-cost domain names under the Freenom brand, has received its fourth public breach of contract notice from ICANN.

The alleged violation concerns a specific expired domain — tensportslive.net — which was until its expiration last November hosting a Pakistani cricket blog.

ICANN claims OpenTLD failed to hand over copies of expiration notices it sent to the former registrant of the name, which expired November 12, despite repeated requests.

The blogger seems to have been royally screwed over by this situation.

ICANN first started badgering OpenTLD for its records on December 23, presumably alerting the company to the fact that its customer had a problem, when the domain had expired but was still recoverable.

ICANN contacted the registrar four more times about the domain before February 1, when it dropped and was promptly snapped up by DropCatch.com.

The public breach notice (pdf) was published February 27. OpenTLD has apparently since provided ICANN with data, which is being reviewed.

But it’s the fourth time the registrar has found itself in serious trouble with ICANN.

It got a breach notice in March 2015 after failing to file compliance paperwork.

Later that year, ICANN summarily suspended its accreditation — freezing its ability to sell domains — after the Dutch company was found to have been cybersquatting rival registrars including Key-Systems and NetEarth in order to poach business away from them.

That suspension was fought in an unprecedented arbitration case, but ICANN won and suspended the accreditation again that August.

It got another breach notice in 2017 for failing to investigate Whois accuracy complaints, which ICANN refers to in its current complaint.

OpenTLD/Freenom is perhaps best known as the registry for a handful of African ccTLD and Tokelau’s .tk, which is the second-largest TLD after .com by volume of registered domains.

Its business model is to give the names away for free and then monetize them after they expire or are deleted for abuse. In the gTLD space, it says it offers domains at the wholesale cost.

According to SpamHaus, over a third of .tk domains it sees are abusive.