Afilias’ .kim has become the latest victim (beneficiary?) of adware, as robo-registrations boost the gTLD’s zone file and apparent popularity.
It’s the latest new gTLD, after .xyz and .country, to see its rankings soar after hundreds of gibberish, bulk-registered domains started being used to serve ads by potentially unwanted software.
.kim is today the 4th most-popular new gTLD, with 85 domains in the top 100,000 on the internet and 264 in the top one million.
A month ago, it had a rank of 223, with just 16 domains in the top one million.
The domain names involved — gems such as oatmealsmoke.kim, vegetableladybug.kim and tubhaircut.kim — have seen a boat-load of traffic and rocketing Alexa rank.
The reason for the boost seems to be a one-off bulk registration of about 1,000 meaningless .kim domain names in early February, which now appear to be being used to serve ads via adware.
In this chart (click to enlarge), we see .kim’s zone file growth since the start of 2015.
The spike on February 5, which represents over 1,000 names, is the date almost all of the .kim names with Alexa rank were first registered.
They all appear to be using Uniregistry as the registrar and its free privacy service to mask their Whois details.
These domains often do not resolve if you type them into your browser. They’re also using robots.txt to hide themselves from search engines.
But they’ve been leaving traces of their activity elsewhere on the web, strongly suggesting their involvement in adware campaigns.
It seems that the current (ab?)use of .kim domains is merely the latest in a series of possibly linked campaigns.
I noted in January that gibberish .country domains — at the time priced at just $1 at Uniregistry — were suddenly taking over from .xyz in the popularity charts.
The following three charts, captured from DI PRO’s TLD Health Check, show how the three TLDs’ Alexa popularity rose and fell during what I suspect were related adware campaigns..
First, .xyz, which was the first new gTLD to show evidence of having robo-registrations used in adware campaigns, saw its popularity spike at the end of 2014 and start of 2015:
Next, Minds + Machines’ .country, which saw its zone file spike by 1,500 names around January 6, starts to see its Alexa-ranked total rocket almost immediately.
.country peaks around February 9, just a few days after the .kim robo-registrations were made.
Finally, as .country’s use declines, .kim takes over. Its popularity has been growing day by day since around February 13.
I think what we’re looking at here is one shadowy outfit cycling through bulk-registered, throwaway domain names to serve ads via unwanted adware programs.
It seems possible that domains are retired when they become sufficiently blocked by security countermeasures, and other domains in other TLDs are then brought online to take over.
None of this necessarily reflects badly on any of the new gTLDs in question, or even new gTLDs as a whole, of course.
For starters, I’ve reason to believe that TLDs such as .eu and .biz have previously been targeted by the same people.
The “attacks”, for want of a better word, are only really noticeable because the new gTLDs being targeted are young and still quite small.
It takes much longer to build up genuine popularity for a newly launched web site than it does to merely redirect exist captive traffic to a newly registered domain.
What it may mean, however, is that .kim and .country are going to be in for statistically significant junk drops about a year from now, when the first-year registrations expire.
For .kim, 1,000 names is about 14% of its current zone file. For .country, it’s more like a quarter.
Minds + Machines made $4.4 million losing three recent new gTLD auctions, according to a company press release.
It’s withdrawn bids for .latino, .school and a third string it said it could not disclose due to the rules of the private auction.
M+M now says it has $45 million cash on hand.
So far, the company has withdrawn 31 new gTLD applications, almost half of its original 70. Not all of those were lost at auction.
It has 17 contested applications left and expects those contention sets to be resolved one way or the other by the end of June 2015.
A sport-related new gTLD is going to an official sporting body.
FIBA, the Fédération Internationale de Basketball, won the right to .basketball after an auction shoot-out with Donuts and Famous Four Media.
While FIBA is the official world organizing body for the sport, there’s no plan to place strict restrictions on the gTLD — the application states that .basketball will be open to all.
FIBA had filed Community Objections to its two rival bids, arguing that they would allow gambling web sites that would harm the reputation of the sport, but the objection panels rejected both complaints in January this year.
FIBA’s bid is supported by Minds + Machines, its registry back-end provider.
Continuing its strategy of getting well-known anchor tenants involved in its new gTLD launches, Minds + Machines has recruited the Brewers Association to back its just-launched .beer.
The BA represents over 2,300 independent breweries in the US, according to its web site.
.beer hit general availability yesterday. Due to delays with ICANN’s zone file publishing system this morning I can’t yet bring you the first-day figures for the TLD.
The launch was timed to coincide with the Great American Beer Festival in Denver, Colorado.
Two weeks ago, M+M launched .country with backing from music legend Dolly Parton, who claimed dolly.country, dollyparton.country, queenof.country, dollywood.country and 9to5.country.
If nothing else, the endorsement reminded non-Americans that .country is supposed to relate to music, not geography.
Minds + Machines posted an operating profit of almost £3 million ($4.9 million) for the first half of the year, almost entirely driven by the proceeds of losing new gTLD auctions.
The registry record a profit to June 30 of £2.9 million on revenue of $68,000.
The “profit on gTLD auctions” line item that permitted that seemingly impossible profit number was £7.1 million ($11.6 million), based on M+M losing eight out of 12 private auctions.
The company had £22 million ($36 million) in cash and other current assets on its balance sheet at the end of the period.
None of M+M’s big TLDs had launched in the first half, hence the low revenue. Since the half ended, .london has proven successful and several more new gTLDs wholly or partially owned by M+M have also launched.
In his statement to the market, chair Fred Krueger said:
A key variable in our financial position is the dynamic of private auctions, which we have embraced, and which has worked tremendously to our advantage. We believe that our current still contested strings represent significant assets which we have the potential to monetize either to further our existing new TLDs or to purchase additional new TLDs at auction.
He also reiterated CEO Antony Van Couvering’s call for a new metric to track gTLD registry health that is based on revenue-per-domain rather than simple volumes.
His outlook for new gTLDs was arguably less cautious than his counterpart at CentralNic, which reported its half-year numbers yesterday and talked of demand “falling short of industry expectations”.
Name registration data available to-date indicates a strong opening for a variety of new products/domains, and also shows that we are still very early in the adoption curve for new TLDs. We expect that the growth of almost all new TLDs will likely follow an “S curve”, as it historically has for newly launched TLDs, rather than a straight line.
He also reconfirmed that M+M plans to aggressively pursue its new integrated registrar business as a means to drive growth in its gTLDs, rather than simply relying on the channel.