Latest news of the domain name industry

Recent Posts

Beginning of the end for DomainTools? Court orders it to scrub Whois records

Kevin Murphy, September 13, 2018, Domain Registries

DomainTools has been temporarily banned from collecting and publishing the Whois records of all .nz domains.

A Washington court yesterday handed down a preliminary injunction against the company, after New Zealand’s Domain Name Commission sued it in July for scraping and republishing its Whois in violation of its terms of service.

Notably — especially if you’re involved in the ongoing Whois reform debate — Judge Robert Lasnik’s scathing order (pdf) rubbished DomainTools’ claims that its historical Whois service provides a public interest benefit that outweighs the privacy interests of .nz registrants.

The ruling by its own admission also potentially opens the floodgates for other registries and registrars to obtain injunctions against DomainTools for the own customers.

DomainTools has been “enjoined from accessing the .nz register while DomainTools’ limited license remains revoked and/or publishing any .nz register data DomainTools had stored or compiled in its own databases”.

DNC, the policy body that oversees .nz registry InternetNZ, had alleged that DomainTools had created a “secondary or shadow register” by bulk-downloading Whois records.

Since mid-2016, each .nz Whois record has contained a notice that such behavior is prohibited, and Lasnik agreed that DomainTools must surely have been aware of this.

Lasnik further agreed with DNC that DomainTools’ service is “sabotaging” its efforts to bring more privacy protection to .nz customers; since November last year it has offered individuals the ability to opt out of having their private data published, an offer 23,000 people have taken up.

That was enough for the judge to conclude that DNC’s case had met the “irreparable harm” test required for an injunction.

He was less impressed with DomainTools’ argument that implementing the injunction would take many months and cost it up to $3.5 million.

“Defendant can presumably filter the .nz data using relatively simple database tools,” he wrote, ordering DNC to post a “nominal” $1,000 bond to cover DT’s potential losses.

Lasnik also said the public interest would be better served by permitting registrant privacy than by serving the interests of DomainTools’ cybsecurity and law enforcement customers:

defendant argues that the products it creates from its meticulously collected register data are critical cybersecurity resources and that the public interest would be harmed if the reports provided to government, financial, and law enforcement entities were incomplete because the .nz data were excised. The .nz register is comparatively small, however (approximately 710,000 domains compared with over 135,000,000 .com domains), and the defendant and its customers can access the registration information directly through plaintiff’s website if it appears that a bad actor is using an .nz domain. On the other hand, the .nz registrants’ privacy and security interests are compromised as long as defendant is publishing non-current or historical .nz information out of its database. The Court finds that the public has an interest in the issuance of an injunction.

While arguably limited to historical Whois records, it’s a rare example of judicial commentary on the privacy rights of registrants and may well play into the ongoing debate about Whois in the post-GDPR world.

Even if it turns out not to have wider policy implications, the legal implications for DomainTools are potentially devastating.

While .nz has only about 710,000 domains under management, and is but one of over 1,500 TLDs, DomainTools, DNC and Judge Lasnik all seem to agree that the floodgates for further litigation may have now opened. Lasnik wrote:

defendant argues that a preliminary injunction in this case could start an avalanche of litigation as other registers attempt to protect the privacy of their registrants. If defendant built a business by downloading, storing, and using data from other registers in violation of the terms that governed its access to that data, defendant may be correct — other registers may be encouraged to pursue a breach of contract claim if plaintiff is successful here. It would be ironic, however, if a plaintiff who has shown a likelihood of success and irreparable injury were deprived of preliminary relief simply because defendant may have acted wrongfully toward others as well

DNC said in a statement: “Managers of other countries domain name systems across the world will want to pay attention to the judgment. This may raise confidence to fight their own cases should DomainTools be breaching their terms of use.”

The case has yet to go to court, but the fact that DNC won the injunction indicates that the judge believes it has a likelihood of winning.

Empty Whois a threat to the US elections?

Kevin Murphy, September 5, 2018, Domain Policy

Could a lack of Whois records thwart the fight against attempts to interfere in this year’s US elections?

That’s the threat raised by DomainTools CEO Tim Chen in a blog post, and others, this week.

Chen points to recent research by Facebook, based on an investigation by security company FireEye, that linked a large network of bogus news sites and social media accounts to the Iranian state media.

FireEye’s investigation used “historical Whois records”, presumably provided by DomainTools, to connect the dots between various domains and registrants associated with “Liberty Front Press”, a purportedly independent media organization and prolific social media user.

Facebook subsequently found that 652 accounts, pages and groups associated with the network, and removed them from its platform.

The accounts and sites in question were several years old but had been focusing primarily on politics in the UK and US since last year, Facebook said.

Based on screenshots shared by Facebook, the accounts had been used to spread political messages bashing US president Donald Trump and supporting the UK’s staunchly pro-Palestinian opposition leader Jeremy Corbyn.

Google’s research, also inspired by FireEye’s findings and Whois data, linked the network to the state-run Islamic Republic of Iran Broadcasting.

The actions by Google and Facebook come as part of their crackdown on fake news ahead of the US mid-term Congressional elections, this November, which are are largely being seen as a referendum on the Trump presidency.

Because the domains in question predate the General Data Protection Regulation and ICANN’s response to it, DomainTools was able to capture Whois records before they went dark in May.

While the records often use bogus data, registrant email addresses common to multiple domains could be used to establish common ownership.

Historical Whois data for domains registered after May 2018 is not available, which will likely degrade the utility of DomainTools’ service over time.

Chen concluded his blog post, which appeared to be written partly in response to data suggesting that GDPR has not led to a growth in spam, with this:

Domain name Whois data isn’t going to solve the world’s cyberattack problems all on its own, but these investigations, centering on an issue of global importance that threatens our very democracy, likely get severely impaired without it. And this is just the tip of the iceberg, a few uniquely important investigations among the hundreds of thousands of cyberattacks going on all day every day all over the globe by people and organizations that can now hide behind the anonymity inherent in today’s internet. It’s reasonable that domain names used for certain commercial or functional purposes should require transparent registration information. Whois is not a crime.

DomainTools is one of the founders of the new Coalition for a Secure and Transparent Internet, a lobby group devoted to encouraging legislatures to keep Whois open.

Representatives of Facebook and Iran’s government are among the members of the Expedited Policy Development Process on Whois, an emergency ICANN working group that is currently trying to write a permanent GDPR-compliant Whois policy for ICANN.

DomainTools tracks its one billionth domain

Kevin Murphy, August 10, 2018, Domain Services

DomainTools now has records of over a billion domain names in its database, according to the company.

The billionth name was added last month, according to a blog post.

The company notes that there are only about 350 million domains in existence today, meaning that twice as many domains have been deleted and never re-registered as are currently online.

For .com, DomainTools knows of 434 million domains that no longer exist, compared to the over 130 million registered today.

Even DomainTools, which has been collecting data for 17 years, knows its records are incomplete, but it reckons its number is probably within 10% of the total number of domains ever registered.

For new gTLDs, the one with the most deleted names is .realty (97% deleted) and the best is .boston (0.3% deleted), the company said.

More data here.

Tech giants gunning for AlpNames over new gTLD “abuse”

A small group of large technology companies including Microsoft and Facebook have demanded that ICANN Compliance take a closer look at AlpNames, the budget registrar regularly singled out as a spammers’ favorite.

The ad hoc coalition, calling itself the Independent Compliance Working Party, wrote to ICANN last week to ask why the organization is not making better use of statistical data to bring compliance actions against the small number of companies that see the most abuse.

AlpNames, the Gibraltar-based registrar under common ownership with new gTLD portfolio registry Famous Four Media, is specifically singled out in the group’s letter.

The letter, sourcing the August 2017 Statistical Analysis of DNS Abuse in gTLDs (pdf), says there “is a clear problem with one particular contracted party”.

AlpNames was the registrar behind over half of the new gTLD domains blacklisted by SpamHaus over the study period, for example, the letter states.

The tiny territory of Gibraltar also frequently ranks unusually highly on abuse lists due to AlpNames presence there, the letter and report say.

The ICWP letter also says that the four gTLDs .win, .loan, .top, and .link were used by over three quarters of abusive domains over the SADAG study period.

The letter calls the abuse rates “troublesome” and says:

We are alarmed at the levels of DNS abuse among a few contracted parties, and would appreciate further information about how ICANN Compliance is using available data to proactively address the abusive activity amongst this subset of contracted parties in order to improve the situation before it further deteriorates.

It goes on to wonder whether high levels of unaddressed abuse could amount to violations of new gTLD Registry Agreements and Registrar Accreditation Agreements, and to ask whether there any barriers to ICANN Compliance pursuing breach claims against such potential violations.

The ICWP comprises Adobe, DomainTools, eBay, Facebook, Microsoft and Time Warner. It’s represented by Fabricio Vayra of Perkins Coie.

Other than the letter (pdf), the Independent Compliance Working Party does not appear to have any web presence, and a spokesperson has not yet responded to DI’s request for more information.

The SADAG report also singled out Chinese registrar Nanjing Imperiosus Technology Co, aka DomainersChoice.com, as having particularly egregious levels of abuse, but noted that this abuse disappeared after ICANN terminated its RAA last year.

AlpNames has not to date had any public breach notices issued against it, but this is certainly not the first time it’s been singled out for public censure.

In November last year, ICANN’s Competition, Consumer Trust, and Consumer Choice Review Team (CCT) named it in a report that claimed: “Certain registries and registrars appear to either positively encourage or at the very least willfully ignore DNS abuse.”

AlpNames seems to have been used often by abusers due to its bargain-basement, often sub-$1 prices — making disposable domains more cost effective — and its tool that allowed up to 2,000 domains to be registered simultaneously.

If not actively soliciting abusive behavior, these factors certainly don’t make abuse any more difficult.

Bur will ICANN Compliance take action in response to the criticism leveled by CCT and now ICWP?

The main problem with the ICWP letter, and the SADAG report it is based upon, is that the data it uses is now rather old.

The SADAG report sourced abuse databases only up to January 2017, a time when AlpNames’ total gTLD domains under management was at its peak of around three million names.

Since then, the company has been hemorrhaging DUM, losing hundreds of thousands of domains every month. At the end of November 2017, the most recent data compiled by DI shows that it was down to around 838,000 domains.

It’s quite possible that AlpNames’ customer base is no longer the den of abuse it once was, whether due to natural attrition or a proactive purge of bad actors.

A month ago, in a press release connected with a $5.4 million buy-out of an co-founder, AlpNames chairman Iain Roache said he has a “10-year strategic plan” to turn AlpNames into a “Tier-1” registrar and “bring the competition to the incumbents”.

DomainTools scraps apps and APIs in war on spam

Kevin Murphy, January 22, 2018, Domain Services

DomainTools is to scrap at least five of its services as it tries to crack down spam.

It’s getting rids of its mobile apps, its APIs, and is to stop showing registrants’ personal information to unauthenticated users.

CEO Tim Chen told us in an email at the weekend:

The Android app is no longer supported.

The iOS app will no longer be supported after February 20th.

The Developer API is no longer supported.

On February 20th, the Bulk Parsed Whois tool available to Personal Members will no longer be supported.

On February 20th, our production Whois API will no longer be available to individual membership levels, an Enterprise relationships will be required.

It’s all part of an effort to make sure DomainTools services are not being abused by spammers, which has lead to a dispute with GoDaddy over bulk access to its registrants’ Whois data.

The longstanding problem of new registrants getting spammed with calls and emails offering web hosting and such has escalated over the last few years. Domain Name Wire detailed the scale of the abuse registrants can experience in a post last week.

While to my knowledge nobody has directly accused DomainTools of facilitating such abuse, the scrapped services are the ones that would be most useful to these spammers.

The company is also going to scale back what guest users can see when they do a Whois lookup, and is to make automated scraping of Whois records more difficult for paying members.

In a blog post, Chen wrote last week:

As of today, unauthenticated users of the DomainTools Whois Lookup tool will not see personally identifiable information for the registrant parsed out in the results, and will be required to submit a CAPTCHA to see the full raw domain name Whois record. Phone numbers in the parsed results have been replaced with image files, much the same way emails have always been rendered

As well as hoping to ease relations with GoDaddy — the source of a very heavy chunk of DomainTools’ data — the moves are also part of the company’s strategy for dealing with the incoming General Data Protection Regulation.

This is the EU law that gives registrants more control over the privacy of their personal data.

Chen told us earlier this month that DomainTools is keen to ensure its enterprise-level suite of security products, which he said are vital for security and intellectual property investigations, continue to operatie under the new regime.

About 80% of DomainTools’ revenue comes from its enterprise-level customers, over 500 companies.