Domainer asks court to block Epik sell-off

The customer suing Epik and its management over a fumbled $327,000 domain deal has asked a US court to prevent the company from selling off its assets and “absconding”.

Matthew Adkisson has amended his fraud complaint, first filed in March, to demand an injunction:

enjoining Defendants from transferring, liquidating, converting, encumbering, pledging, loaning, selling, concealing, dissipating, disbursing, assigning, withdrawing, granting a lien or security interest or other interest in, or otherwise disposing of Adkisson’s Escrow Funds and any other amounts owed to Adkisson, including but not limited to by transferring, liquidating, converting, encumbering, pledging, loaning, selling, concealing, dissipating, disbursing, assigning, withdrawing, granting a lien or security interest or other interest in, or otherwise disposing of any of Defendants’ assets or companies that Adkisson’s Escrow Funds were used in connection with

The amendment follows tweets from current Epik CEO Brian Royce which strongly suggested the company is in the process of selling off its assets. The complaint quotes former CEO and majority shareholder Rob Monster as confirming a sale was being “finalized”.

“If Royce, Monster, and Epik are allowed to sell Epik or its assets, consumers like Adkisson are highly unlikely to be repaid for the funds that Royce, Monster, and Epik and misappropriated,” the complaint says.

Adkisson attempted to buy the domain nourish.com via Epik and its “escrow” service last year, but after the sale fell through the company did not return his money. He now claims Epik was illegally mingling its escrow funds with its general operations fund.

The amended complaint now includes several citations from TrustPilot — other customers who says they bought domains only to see Epik take their cash and not hand over the domain.

While Epik has admitted that it owes Adkisson money, it has otherwise denied any wrongdoing. After the amendment, Royce withdrew his motion to dismiss the case.

Fraud checks coming to .ch as SWITCH renews contract

Swiss ccTLD registry SWITCH has agreed to implement new security measures as part of its contract renewal with the government.

The company said Friday that it has extended its contract to run .ch names with the telecoms regulator OFCOM for five more years, bring it up to December 2026.

But as part of the renewal, SWITCH has agreed to “speed up the adoption and implementation of technical security standards”.

This will involved financial incentives for registrars to adopt DNSSEC, the registry said.

It will also introduce measures to combat fraud at the point of registration, with SWITCH saying “in the event of suspected fraudulent intent, newly registered domain names can be used only after an identity check.”

The policy appears similar to those at other ccTLDs, including .uk, where new regs are flagged under certain circumstances (such as containing coronavirus-related terms) and cannot resolve until further checks are carried out.

GoDaddy has a secret weapon in its push into corporate domains

While GoDaddy has been focused for the last two decades on small and microbusiness customers, its entry this year into the corporate domains management space should not be dismissed — the company has one huge advantage.

Earlier this week, the company announced the launch of GoDaddy Corporate Domains, really just a rebranding of the company Brandsight, which it acquired back in February.

The move pits GoDaddy against industry leaders such as MarkMonitor, CSC, Com Laude, Safenames et al.

But the company has one huge advantage that its new competitors do not have: cybersquatters and criminals.

Buried at the bottom of this week’s press release is the announcement of a new service, the Verified Intellectual Property program, which “provides pre-vetted, well-known and famous brands an escalation path to address IP abuse”.

It sounds basically like a trusted notifier service not unlike those offered at the registry level by the likes of Donuts and Radix.

VIP clients will be able to get sites and domains hosted on GoDaddy taken down much quicker, via a special escalation email address, a spokesperson said. Takedown requests will still be subject to manual review, he said.

VIP is currently invitation-only, but I assume being a Corporate Domains customer would help expedite an invitation.

This kind of service is something GoDaddy’s new rivals cannot offer — they generally have no retail channel or hosting, so have no cyberquatters, pirates or counterfeiters as customers. If they want to take down a domain or web site, it’s not a simple matter of flipping a switch.

They also don’t have tens of millions of domains under management, many of which, through no fault of GoDaddy, will be maliciously registered.

This is potentially a pretty cool USP for GoDaddy, which could have rivals worried.

Three big changes could be coming to .uk

Nominet wants to know what you thinking about three significant policy changes that could be implemented in the next year or so.
The .uk registry today published a consultation document covering two security-related changes and one related to expired domains.
First, Nominet wants to know if it should be allowed to preemptively block resolution on newly registered domains where it has “identified a high risk the domain will be used for phishing”.
It looks like more of a cosmetic policy change, given that the company is already blocking suspected phishing domains where the registrant fails to adequately verify their identity.
About 1,500 domains were blocked like this in the 12 months ending July 2019, Nominet says, on the basis of its Domain Watch program, which combines technical and manual oversight to identify phishy-looking names.
Second, Nominet want to know if it should display an standard informational web page when it blocks a domain on the basis of fraud, copyright infringement, and counterfeiting.
Currently, the company takes down tens of thousands of names every year on this basis, but the names are simply removed from the zone file and refuse to resolve.
Nominet’s friends in law enforcement reckon that allowing the the domains to instead resolve to a standard web page instead could help victims of fraudulent sites help with police investigations, and Nominet wants to know if you agree.
A side-effect of this would be that the names would remain in the zone, so we’d be able to see for the first time which names get suspended for fraud.
Third, Nominet wants to know whether it should start openly publishing drop-lists, the list of domains that have expired registrations and are about to become available.
This appears to be bad news for those registrars currently “excessively” pinging the registry to compile their own lists and get the jump on competitors when it comes to drop-catching valuable names for resale.
Nominet seems to want to see fewer dropped domains winding up in the hands of domainers, saying currently “not all dropping domains are registered and actively used by the new registrant, reducing the vibrancy of .UK domains”.
It’s proposing to give drop-lists just to registrars, or to publish them openly.
All three questions are open for comment until December 15.

Belgium to crack down on fraud domains

DNS Belgium says it will shortly implement a new policy that will see it take down .be domains associated with fraud within 24 hours of discovering them.
The new scheme, which comes into effect December 1, essentially grants the Belgian government’s ministry of the economy — FPS Economy or Federal Public Service Economy in local parlance — a trusted notifier status when it comes to takedowns.
Previously, requests had to go through public prosecutors and took about two weeks, giving attackers a longer window to milk their victims.
Under the old regime, FPS Economy could only request a suspension in cases where the Whois data was inaccurate.
The registry said it will only suspend domains that are involved in “serious crimes”, including phishing and fraudulent web stores.
Registrants will have two weeks to appeal their suspensions. After six months, the domains will be deleted.
Several hundred .be domains per year are expected to be affected.

Cybersquatter jailed for seven years after prison break

Fraudster Neil Moore, who escaped from prison by cybersquatting, has reportedly been handed a seven-year sentence by a British court.
As we reported last month, Moore escaped from Wandsworth prison merely by sending an email ordering his release from an hmcts-gsi-gov.org.uk email address.
He’d registered the name, a typo of the genuine hmcts.gsi.gov.uk used by the UK court service, on a smuggled smartphone.
He was being held on remand for an unrelated fraud at the time.
Today’s sentencing follows Moore pleading guilty to eight counts of fraud (it doesn’t seem those were related to cybersquatting) and one count of wrongful escape from custody.

New domain scam? ICANN issues vague warning

ICANN has warned internet users about a domain name scam that exploits the ICANN name and logo.
Not giving away much information, ICANN said in a statement:

It has been brought to ICANN’s attention that some online entities have attempted to sell fraudulent “certificates”, which they claim are required to protect generic top-level domain names. The perpetuators of this scam threaten registrants on the protection service with the objective of securing a fee from the registrant. The “certificates” look official and include an unauthorized use of the ICANN logo.
Please note that ICANN does not issue certificates to registrants and does not collect fees from registrants directly.

It’s not clear whether the scam is related to the “ICANN certificates” fraudsters sometimes demand as part of domain appraisal scams, which have been well-documented online.
The reference to a “protection service” and new gTLDs suggest this might be something new.
I asked ICANN for a sample of the scam in question yesterday but haven’t heard back yet.
UPDATE: The certificates look like this:

and this:

Will new gTLDs really increase phishing?

The US Federal Trade Commission has come out swinging against ICANN’s new generic top-level domains program, saying it will increase online fraud and should be scaled back.
In an open letter to ICANN’s top brass yesterday, the FTC’s four commissioners claimed that “the dramatic introduction of new gTLDs poses significant risks to consumers”.
Saying that more gTLDs will make it easier for scammers to acquire domain names confusingly similar to existing brands, the commissioners said the program should be rolled out as a limited pilot.
The FTC commissioners wrote (pdf):

A rapid, exponential expansion of gTLDs has the potential to magnify both the abuse of the domain name system and the corresponding challenges we encounter in tracking down Internet fraudsters. In particular, the proliferation of existing scams, such as phishing, is likely to become a serious challenge given the infinite opportunities that scam artists will now have at their fingertips. Fraudsters will be able to register misspellings of businesses, including financial institutions, in each of the new gTLDs, create copycat websites, and obtain sensitive consumer data with relative ease before shutting down the site and launching a new one.

The letter demands better Whois accuracy enforcement, better ICANN compliance programs, and a cap on approved new gTLDs in the first round perhaps as low as a couple dozen.
The FTC’s claims that new gTLDs will increase phishing may not be supported by reality, however.
The latest data (pdf) from the Anti-Phishing Working Group shows that in the first half of the year only 18% of domain names used in phishing attacks were registered by the attacker.
That was down from 28% in the second half of 2010. Phishers are much more likely to compromise a domain belonging to somebody else – by hacking a web server, for example.
Of the 14,650 maliciously registered domains 10,444 (70%) were used to phish Chinese targets, “overwhelmingly” the e-commerce site Taobao.com, the APWG found.
Furthermore, only 2% of these domains – just 1,816 over six months – were judged to have been registered due to their confusing similarity with the brands they target.
The APWG said (emphasis in the original):

These are the lowest numbers we have observed in the last past four years, and show that using domain names containing brand strings has fallen further out of favor among phishers.
…
the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do. Instead, phishers almost always place brand names in subdomains or subdirectories

The APWG found only one gTLD that ICANN has introduced – .info, with 4.5% – in its top ten phishing TLDs. The .com space accounts for 48.9% of all phishing domains.
Will the increase in the number of gTLDs reverse these trends? The FTC seems to think so, but the claims in its letter appear to be based largely on guesswork and fear rather than data.
I suspect that the FTC’s letter is more concerned with ICANN’s ongoing bilateral talks with registrars over law enforcement-demanded amendments to the Registrar Accreditation Agreement.
These talks are completely separate and distinct from the new gTLDs program policies, but in the last few weeks we’ve seen them being repeatedly conflated by US lawmakers, and now the FTC.
This may be ignorance, but it could just as well be an attempt to apply political pressure on ICANN to make sure the RAA talks produce the results law enforcement agencies want to see.
ICANN does not want to be forced into an embarrassing retreat on its hard-fought gTLD expansion. By producing a strong RAA, it could deflect some of the concerns about the program.

Another 2,000 .uk fraud domains taken down

Nominet has suspended over 2,000 .uk domain names allegedly being used to sell counterfeit goods on the instruction of the Metropolitan Police.
The Met said in a statement today that the crackdown was designed to protect online shoppers in the run-up to Christmas. It did something similar last year and the year before.
The sites were allegedly selling bootleg products purportedly from brands such as Ugg, Nike and Tiffany.
Nominet said that it worked with is registrars to coordinate the suspensions, and that the registrants were all informed before their domains were taken down.
All the registrants were in breach of terms and conditions, it said.
A Nominet working group is currently in the final stages of creating a policy that will streamline the process of law enforcement domain suspensions, as I reported for The Register today.