Hacking claims resurface as .hotel losers force ICANN to lawyer up again

The fight over .hotel has been escalated, with four unsuccessful applicants for the gTLD whacking ICANN with a second Independent Review Process appeal.
The complaint resurrects old claims that a former lead on the successful application, now belonging to Afilias, stole trade secrets from competing applicants via a glitched ICANN web site.
It also revives allegations that ICANN improperly colluded with the consultant hired to carry out reviews of “community” applications and then whitewashed an “independent” investigation into the same.
The four companies filing the complaint are new gTLD portfolio applicants MMX (Minds + Machines), Radix, Fegistry, and Domain Venture Partners (what we used to call Famous Four).
The IRP was filed November 18 and published by ICANN December 16, but I did not spot it until more recently. Sorry.
There’s a lot of back-story to the complaint, and it’s been a few years since I got into any depth on this topic, so I’m going to get into a loooong, repetitive, soporific, borderline unreadable recap here.
This post could quite easily be subtitled “How ICANN takes a decade to decide a gTLD’s fate”.
There were seven applicants for .hotel back in 2012, but only one of them purported to represent the “hotel community”. That applicant, HOTEL Top Level Domain, was mostly owned by Afilias.
HTLD had managed to get letters of support from a large number of hotel chains and trade groups, to create a semblance of a community that could help it win a Community Priority Evaluation, enabling it to skip to the finish line and avoid a potentially costly auction against its rival applicants.
CPEs were carried out by the Economist Intelligence Unit, an independent ICANN contractor.
Surprisingly to some (including yours truly), back in 2014 it actually managed to win its CPE, scoring 15 out of the 16 available points, surpassing the 14-point winning threshold and consigning its competing bidders’ applications to the scrap heap.
There would be no auction, and no redistribution of wealth between applicants that customarily follows a new gTLD auction.
Naturally, the remaining applicants were not happy about this, and started to fight back.
The first port of call was a Request for Reconsideration, which all six losers filed jointly in June 2014. It accused the EIU of failing to follow proper procedure when it evaluated the HTLD community application.
That RfR was rejected by ICANN, so a request for information under ICANN’s Documentary Information Disclosure Policy followed. The losing applicants reckoned the EIU evaluator had screwed up, perhaps due to poor training, and they wanted to see all the communications between ICANN and the EIU panel.
The DIDP was also rejected by ICANN on commercial confidentiality grounds, so the group of six filed another RfR, asking for the DIDP to be reconsidered.
Guess what? That got rejected too.
So the applicants then filed an IRP case, known as Despegar v ICANN, in March 2015. Despegar is one of the .hotel applicants, and the only one that directly plays in the hotel reservation space already.
The IRP claimed that ICANN shirked its duties by failing to properly oversee and verify the work of the EIU, failing to ensure the CPE criteria were being consistently applied between contention sets, and failing in its transparency obligations by failing to hand over information related to the CPE process.
While this IRP was in its very early stages, it emerged that one of HTLD’s principals and owners, Dirk Krischenowski, had accessed confidential information about the other applicants via an ICANN web site.
ICANN had misconfigured its applicant portal in such a way that any user could very access any attachment on any application belonging to any applicant. This meant sensitive corporate information, such as worst-case-scenario financial planning, was easily viewable via a simple search for over a year.
Krischenowski appears to have been the only person to have noticed this glitch and used it in earnest. ICANN told applicants in May 2015 that he had carried out 60 searches and accessed 200 records using the glitch.
Krischenowski has always denied any wrongdoing and told DI in 2016 that he had always “relied on the proper functioning of ICANN’s technical infrastructure while working with ICANN’s CSC portal.”
The applicants filed another DIDP, but no additional information about the data glitch was forthcoming.
When the first IRP concluded, in February 2016, ICANN prevailed, but the three-person IRP panel expressed concern that neither the EIU nor ICANN had any process in place to ensure that community evaluations carried out by different evaluators were consistently applying the CPE rules.
The IRP panel also expressed concern about the “very serious issues” raised by the ICANN portal glitch and Krischenowski’s data access.
But the loss of the IRP did not stop the six losing applicants from ploughing on. Their lawyer wrote to ICANN in March 2016 to denounce Krischenowski’s actions as “criminal acts” amounting to “HTLD stealing trade secrets of competing applicants”, and as such HTLD’s application for .hotel should be thrown out.
Again, to the best of my knowledge, Krischenowski has never been charged with, let alone convicted of, any criminal act.
Afilias wrote to ICANN not many weeks later, April 2016, to say that it had bought out Krischenowski’s 48.8% stake in HTLD and that he was no longer involved in the company or its .hotel application.
And ICANN’s board of directors decided in August 2016 that Krischenowski may well have accessed documents he was not supposed to, but that it would have happened after the .hotel CPE had been concluded, so there was no real advantage to HTLD.
A second, parallel battle against ICANN by an unrelated new gTLD applicant had been unfolding over the same period.
A company called Dot Registry had failed in its CPE efforts for the strings .llc, .llp and .inc, and in 2014 had filed its own IRP against ICANN, claiming that the EIU had “bungled” the community evaluations, applying “inconsistent” scoring criteria and “harassing” its supporters.
In July 2016, almost two years later, the IRP panel in that case ruled that Dot Registry had prevailed, and launched a withering attack on the transparency and fairness of the ICANN process.
The panel found that, far from being independent, the EIU had actually incorporated notes from ICANN staff into its CPE evaluations during drafting.
It was as a result of this IRP decision, and the ICANN board’s decision that Krischenowski’s actions could not have benefited HTLD, that the losing .hotel applicants filed yet another RfR.
This one lasted two and a half years before being resolved, because in the meantime ICANN launched a review of the CPE process.
It hired a company called FTI Consulting to dig through EIU and ICANN documentation, including thousands of emails that passed between the two, to see if there was any evidence of impropriety. It covered .hotel, .music, .gay and other gTLD contention sets, all of which were put on hold while FTI did its work.
FTI eventually concluded, at the end of 2017, that there was “no evidence that ICANN organization had any undue influence on the CPE reports or engaged in any impropriety in the CPE process”, which affected applicants promptly dismissed as a “whitewash”.
They began lobbying for more information, unsuccessfully, and hit ICANN with yet another RfR in April 2018. Guess what? That one was rejected too.
The .hotel applicants then entered into a Cooperative Engagement Process — basically pre-IRP talks — from October 2018 to November 2019, before this latest IRP was filed.
It’s tempting to characterize it as a bit of a fishing expedition, albeit not a baseless one — any allegations of ICANN’s wrongdoing pertaining the .hotel CPE are dwarfed by the applicants’ outraged claims that ICANN appears to be covering up both its interactions with the EIU and its probe of the Krischenowski incident, partly out of embarrassment.
The claimants want ICANN to be forced to hand over documentation refused them on previous occasions, relating to: “ICANN subversion of the .HOTEL CPE and first IRP (Despegar), ICANN subversion of FTI’s CPE Process Review, ICANN subversion of investigation into HTLD theft of trade secrets, and ICANN allowing a domain registry conglomerate to takeover the ‘community-based’ applicant HTLD.”
“The falsely ‘independent’ CPE processes were in fact subverted by ICANN in violation of Bylaws, HTLD stole trade secrets from at least one competing applicant, and Afilias is not a representative of the purported community,” the IRP states.
“HTLD’s application should be denied, or at least its purported Community Priority relinquished, as a consequence not only for HTLD’s spying on its competitors’ secret information, but also because HTLD is no longer the same company that applied for the .HOTEL TLD. It is now just a registry conglomerate with no ties to the purported, contrived ‘Community’ that it claims entitled to serve,” it goes on.
ICANN is yet to file its response to the complaint.
Whether the IRP will be successful is anyone’s guess, but what’s beyond doubt is that if it runs its course it’s going to add at least a year, probably closer to two, to the delay that .hotel has been languishing under since the applications were filed in 2012.
Potentially lengthening the duration of the case is the claimants’ demand that ICANN “appoint and train” a “Standing Panel” of at least seven IRP panelists from which each three-person IRP panel would be selected.
The standing panel is something that’s been talked about in ICANN’s bylaws for at least six or seven years, but ICANN has never quite got around to creating it.
ICANN pinged the community for comments on how it should go about creating this panel last year, but doesn’t seemed to have provided a progress report for the last nine months.
The .hotel applicants do not appear to be in any hurry to get this issue resolved. The goal is clearly to force the contention set to auction, which presumably could happen at Afilias’ unilateral whim. Time-to-market is only a relevant consideration for the winner.
With .hotel, and Afilias’ lawsuit attempting to block the .web sale to Verisign, the last round of new gTLD program, it seems, is going to take at least a decade from beginning to end.

Radix acquires another gTLD

Radix has added the 10th new gTLD to its portfolio with an acquisition last month, bringing its total TLD stable to 11.
The company has acquired .uno from Missouri-based Dot Latin LLC for an undisclosed amount.
.uno, which of course means “one” in Spanish, has been around for over five years but has struggled to grow.
It’s current ranked as the 131st largest new gTLD, with 16,271 domains in its zone file. It peaked at about 22,000 about three years ago.
That said, it appears to have rather strong renewals, at least by Radix standards, with no evidence of relying on discounts or throwaway one-year registrations for growth.
.uno names can currently be obtained for roughly $12 to $20 per year.
Radix said its expects to migrate the TLD off its current Neustar back-end onto long-time registry partner CentralNic by “early 2020”.
The company appears to be excited that its only the second three-letter TLD in its portfolio.
It already runs .fun, along with the likes of .website, .tech and .online. It also runs .pw, the repurposed ccTLD for Palau.
.uno was Dot Latin’s only gTLD, though affiliated entity Dot Registry LLC signed its ICANN registry agreement for .llp (for “Limited Liability Partnership”) in August. That TLD has yet to launch.

.tech gTLD startups “raise $2 billion”

Tech startups using domain names in the .tech gTLD have raised $2 billion in venture capital financing over the last two years, according to Radix.
The registry looked at startups listed on Crunchbase as of June and found 650 companies using .tech domains. Of these, 170 of them had raised $2 billion in funding.
About 250 TLDs are in use by Crunchbase-listed startups, according to Radix.
According to a list provided by the company, funding amounts range from a modest $50,000 (obtained by the likes of the VR firm at virtualspaces.tech) to $620 million (obtained by the self-driving car company at aurora.tech).
Not every company on the list is still in business (if name resolution is any guide), and some of the .tech names bounce visitors to longer .com domains.
Meanwhile, domainer Morgan Linton has done a bit of similar research and discovered that 43% of the “top pick” startups appearing at Disrupt, the conference that like Crunchbase is owned by TechCrunch, are not using .com domains.
It’s a smaller sample size, but according to Linton, 18% of them use .io names. Most of the non-coms are on ccTLDs, in fact. The only new gTLD on his list is Google’s .app.
Disrupt made headlines in the domain world in 2010 when it launched its first conference web site on a .co domain, to coincide with the international launch of Colombia’s ccTLD by .CO Internet.
But that marketing deal lapsed after a year. Disrupt is back on techcrunch.com and disrupt.co is back in registry hands as a “premium” reserved name.
.co still appears on Linton’s list, however, so the initial partnership may still be bearing fruit.

Radix releases huge amount of premium domain data

Radix made $1,360,865 from premium domain names in its portfolio of new gTLDs in the first half of the year, according to the company’s latest report.
The company said that $522,365 of that came from new registrations — there were 619 in total — with the balance of $838,500 coming from renewals.
Radix is one of the registries that charges a premium fee every year over the life of the registration.
Because of this, its first-year renewal rates for premiums are not fantastic — just 54% of names registered in the first half of 2018 were renewed a year later.
But older premiums renewed at a more-than-respectable 78%, comparable to peak-.com, according to the Radix report.
.store and .online accounted for about half of renewal revenue.
.online and .tech accounted for more than half of new registration revenue.
GoDaddy sold 41.6% of all the names moved in the half.
For Radix, a premium domain is anything priced at $100 or above. That’s lower than some gTLDs’ base non-premium fee.
It sold three names at $10,000 during the period.

Cloudflare “bug” reveals hundreds of secret domain prices

The secret wholesale prices for hundreds of TLDs have been leaked, due to an alleged “bug” at a registrar.
The registry fees for some 259 TLDs, including those managed by Donuts, Verisign and Afilias, are currently publicly available online, after a programmer used what they called a “bug” in Cloudflare’s API to scrape together price lists without actually buying anything.
Cloudflare famously busted into the domain registrar market last September by announcing that it would sell domains at cost, thumbing its nose at other registrars by suggesting that all they’re doing is “pinging an API”.
But because most TLD registries have confidentiality clauses in their Registry-Registrar Agreements, accredited registrars are not actually allowed to reveal the wholesale prices.
That’s kind of a problem if you’re a registrar that has announced that you will never charge a markup, ever.
Cloudflare has tried to get around this by not listing its prices publicly.
Currently, it does not sell new registrations, instead only accepting inbound transfers from other registrars. Registry transaction reports reveal that it has had tens of thousands of names transferred in, but has not created a significant number of new domains.
(As an aside, it’s difficult to see how it could ever sell a new reg without first revealing its price and therefore breaking its NDAs.).
It appears that the only way to manually ascertain the wholesale prices of all of the TLDs it supports would be to buy one of each at a different registrar, then transfer them to Cloudflare, thereby revealing the “at cost” price.
This would cost over $9,500, at Cloudflare’s prices, and it’s difficult to see what the ROI would be.
However, one enterprising individual discovered via the Cloudflare API that the registrar was not actually checking whether they owned a domain before revealing its price.
They were therefore able to compile a list of Cloudflare’s prices and therefore the wholesale prices registries charge.
The list, and the script used to compile it, are both currently available on code repository Github.
The bulk of the list comprises Donuts’ vast portfolio, but most TLDs belonging to Afilias (including the ccTLD .io), XYZ.com and Radix are also on there.
It’s not possible for me to verify that all of the prices are correct, but the ones that are comparable to already public information (such as .com and .net) match, and the rest are all in the ballpark of what I’ve always assumed or have been privately told they were.
The data was last refreshed in April, so without updates its shelf life is likely limited. Donuts, for example, is introducing price increases across most of its portfolio this year.

After $30 million deal, is a .voice gTLD now inevitable?

Do big second-level domain sales translate into new gTLD success, and does the record-breaking $30 million sale of voice.com this week make a .voice gTLD inevitable?
The answers, I believe, are no and maybe.
Before the 2012 new gTLD application round, one way applicants picked their strings was by combing through the .com zone file to find frequently-occurring words that terminated the second level string.
This is where we get the likes of .site and .online from Radix and much of Donuts’ portfolio.
But applicants also looked at lists of high-priced secondary market sales for inspiration.
This is where we get the likes of .vodka, from MMX.
The latter strategy has seen mixed-to-poor results.
Five of the top domain sales, as compiled by Domain Name Journal, were not eligible for gTLD status are they are too short.
Of the remaining 15 strings, “sex” (which occurs twice), “fund”, “porn”, “toys” and “vodka” were all applied for in 2012 and are currently on sale.
The strings “clothes” and “diamond” do not appear as gTLDs, but Donuts runs both .clothing and .diamonds.
Not delegated in any fashion are “porno” (unless you count it as a derivative of “porn”), “slots”, “tesla”, “whisky” and “california”. A company called IntercontinentalExchange runs .ice as a dot-brand.
As well as .clothing and .diamonds, .fund and .toys are both also Donuts TLDs. None of them are doing spectacularly well.
At the lower end, .diamonds currently has fewer than 3,000 domain under management, but has a relatively high price compared to the the higher-volume TLDs in Donuts’ stable.
At the high-volume end, .fund has just shy of 16,000 names and .clothing has about 12,000.
Judging by their retail prices, and the fact that Donuts benefits from the economies of scale of a 240-strong TLD portfolio, I’m going to guess these domains are profitable, but not hugely so.
If we turn our attention to .vodka, with its roughly 1,500 domains, it seems clear that MMX is barely covering the cost of its annual ICANN fees. Yet vodka.com sold for $3 million.
So will anyone be tempted to apply for .voice in the next gTLD application round? I’d say it’s very possible.
First, “voice” is a nice enough string. It could apply to telephony services, but also to general publishing platforms that give their customers a “voice”. I’d say it could gather up enough registrations to fit profitably into a large portfolio, but would not break any records in terms of volume.
But perhaps the existence of voice.com buyer Block.one as a possible applicant will raise some other applicants out of the woodwork.
Block.one, which uses a new gTLD and an alt-ccTLD (.io) for its primary web sites, is certainly not out-of-touch when it come to alternative domain names.
Could it apply for .voice, and if it does how much would it be willing to spend to pay off rival applicants? It still apparently has billions of dollars from its internet coin offering in the bank.
How much of that would it be prepared to pay for .voice at private auction?
That prospect alone might be enough to stir the interest of some would-be applicants, but it has to be said that it’s by no means certain that the highly gameable application process ICANN deployed in 2012 is going to look the same next time around.

Did Roussos pull off the impossible? Google, Donuts, Radix all drop out of .music race

Google won’t be the registry for the .music gTLD.
The company, along with pure-play registries Donuts and Radix, late last week withdrew their respective applications from the .music contention set, leaving just three possible winners in the running.
Those are Amazon, MMX, and DotMusic, the company run by long-time .music fanboy Constantinos Roussos.
As I blogged last week, applications from Domain Venture Partners and Far Further have also been withdrawn.
I suspect, but do not know for a fact, that the contention was settled with a private deal, likely an auction, recently.
The logical guess for a winner would be Amazon, if only because of the nexus of its business to the music industry and the amount of money it could throw at an auction.
But I’m beginning to suspect that DotMusic might have prevailed.
The company appears to have recently revamped its web site, almost as if it’s gearing up for a launch.
Comparing the current version of music.us to versions in Google’s cache, it appears that the site has been recently given a new look, new copy and even a new logo.
It’s even added a prominent header link inviting prospective resellers to sign up, using a form that also appears to have been added in the last few weeks.
These changes all seem to have been made after the crucial ICANN vote that threw out the last of DotMusic’s appeals, March 14.
Are those the actions of an applicant resigned to defeat, or has Roussos pulled off the apparently impossible, defeating two of the internet’s biggest companies to one of the industry’s most coveted and controversial strings?
Participants in gTLD auctions typically sign NDAs, so we’re going to have to wait a bit longer (probably no more than a few days) to find out which of the remaining three applicants actually won.

Radix sees revenue up 30%

New gTLD registry Radix said today that its revenue increased by 30% in 2018, largely due to an end-of-year boost.
The company, which runs nine gTLDs including .online and .site, said that gross revenue was $16.95 million last year.
It added that net profit was up 45.6%, but the privately held company does not actually disclose the dollar value of its bottom line.
Radix said that the fourth quarter of the year, which presumably saw the benefits of Operation September Thrust, was its strongest quarter.
The company said that 27% of its revenue came from standard-price new registrations and 60% from renewals.
Its premiums brought in $1.9 million, 56% of which were premium renewals.

Operation September Thrust leads to another million-domain Radix gTLD

Radix has become the first new gTLD portfolio registry to hit over one million domains in more than one TLD.
It said today that .site has crossed the seven-digit threshold, joining .online, which hit a million names in 2018.
It’s huge recent growth for .site, which had around 561,000 domains under management at the end of September.
Radix CEO Sandeep Ramchandani told DI today that the rapid uptick comes as a result of a marketing program internally code-named “September Thrust”.
This involved promotional pricing — Ramchandani said the cheapest a .site could have been obtained would be about $0.99 — and joint-marketing efforts with multiple registrars.
This mostly involved plugs on registrar home pages, email shots, and promotion in the “check availability” part of registrar storefronts, he said.
The latest transaction reports filed with ICANN show .site grew by about 120,000 DUM in October, with West.cn, NameCheap and Network Solutions (Web.com) the biggest beneficiaries.
NetSol’s .site DUM actually grew by about 10x in the month.
The $1 retail pricing was apparently available at some registrars prior to September, and continues to exist on storefronts today.

Radix now has China approval for whole TLD stable

Radix’s entire portfolio of new gTLDs is now approved for sale and use in China, according to the company.

The company said today that .host, .press, .space and .website recently received the nod from the Ministry of Industry and Information Technology, which regulates the domain name space in China.

.fun, .site, .online, .tech and .store have all previously received approval.

Across the three-million-domain portfolio, over 700,000 are registered in China, according to Radix.

It saw growth in China over over 30% in 2018 in terms of new domain adds, the company said in a press release.

CEO Sandeep Ramchandani said that Radix has partnered with local registrar Xinnet to give free domains to university students to “host their academic projects and business prototypes.”