Latest news of the domain name industry

Recent Posts

Architelos: shadiest new gTLD is only 10% shady

Kevin Murphy, September 4, 2015, Domain Registries

Disputing the recent Blue Coat report into “shady” new gTLDs, domain security firm Architelos says that the shadiest namespace is just under 10% shady.

That’s a far cry from Blue Coat’s claim earlier this week that nine new gTLDs are 95% to 100% abusive.

Architelos shared with DI a few data points from its NameSentry service today.

NameSentry uses a metric the company calls NQI, for Namespace Quality Index, to rank TLDs by their abuse levels. NQI is basically a normalized count of abusive domains per million registered names.

According to Architelos CEO Alexa Raad, the new gTLD with the highest NQI at the end of June was .work.

Today’s NameSentry data shows that .work has a tad under 6,900 abusive domains — almost all domains found in spam, garnished with just one suspected malware site — which works out to just under 10% of the total number of domains in its zone file.

That number is pretty high — one in 10 is not a figure you want haunting your registry — but it’s a far cry from the 98.2% that Blue Coat published earlier this week.

Looking at the numbers for .science, which has over 324,000 names in its zone and 15,671 dodgy domains in NameSentry, you get a shadiness factor of 4.8%. Again, that’s a light year away from the 99.35% number published by Blue Coat.

Raad also shared data showing that hundreds of .work and .science domains are delisted from abuse feeds every day, suggesting that the registries are engaged in long games of whack-a-mole with spammers.

Blue Coat based its numbers on a sampling of 75 million attempted domain visits by its customers — whether or not they were valid domains.

Architelos, on the other hand, takes raw data feeds from numerous sources (such as SpamHaus and SURBL) and validates that the domains do actually appear in the TLD’s zone. There’s no requirement for the domain to have been visited by a customer.

In my view, that makes the NameSentry numbers a more realistic measurement of how dirty some of these new gTLDs are.

Blue Coat explains .zip screw-up

Kevin Murphy, September 4, 2015, Domain Tech

Security vendor Blue Coat apparently doesn’t check whether domains are actually domains before it advises customers to block them.

The company yesterday published a blog post that sought to explain why it denounced Google’s unlaunched .zip gTLD as “100% shady” even though the only .zip domain in existence leads to google.com.

Unrepentant, Blue Coat continued to insist that businesses should consider blocking .zip domains, while acknowledging there aren’t any.

It said that its censorware treats anything entered into a browser’s address bar as a URL, so it has been treating file names that end in .zip — the common format for compressed archive files — as if they are .zip domain names. The blog states:

when one of those URLs shows up out on the public Internet, as a real Web request, we in turn treat it as a URL. Funny-looking URLs that don’t resolve tend to get treated as Suspicious — after all, we don’t see any counter-balancing legitimate traffic there.

Further, if a legal domain name gets enough shady-looking traffic — with no counter-evidence of legitimate Web traffic — it’s possible for one of our AI systems to conclude that the behavior isn’t changing, and that it deserves a Suspicious rating in the database. So it gets one.

In other words, Blue Coat has been categorizing Zip file names that somehow find their way into a browser address bar as .zip domain names.

That may sound like a software bug that Blue Coat needs to fix, but it’s still telling people to block Google’s gTLD anyway, writing:

In conclusion, none of the .zip “domains” we see in our traffic logs are requests to registered sites. Nevertheless, we recommend that people block these requests, until valid .zip domains start showing up.

That’s a slight change of position from its original “Businesses should consider blocking traffic that leads to the riskiest TLDs”, but it still strikes me as irresponsible.

The company has still not disclosed the real numbers behind any of the percentages in its report, so we still have no idea whether it was fair to label, for example, Famous Four’s .review as “100% shady”.

Laughable security report labels Google Registry “shady”

Kevin Murphy, September 1, 2015, Domain Registries

A report by security company Blue Coat Systems today denounced new gTLDs as “shady” and recommended organizations think about blocking the “shadiest” ones entirely.

The study classified “tens of millions” of domains requested by users of its censorware service according to whether they had content that posed a security risk.

It found that nine new gTLDs and one ccTLD scored over 95% — that is, 95% of the domains in those TLDs requested by its customers were potentially unsafe.

But its numbers, I believe, are bollocks.

My main reason for this belief? Blue Coat has ranked .zip as “100% shady”.

This means that, according to the company, every single .zip domain its customers have visited is either spam, malware, a scam, a botnet, suspicious, phishing or potentially unwanted software.

The problem is that the entire .zip zone file currently consists of precisely one (1) domain.

That domain is nic.zip, and it belongs to Google Registry. This is a pre-launch TLD.

As far as I can tell, Google Registry is not involved in distributing malware, spam, phishing, etc.

Nevertheless, Blue Coat said network administrators should “consider blocking traffic” to .zip and other “shady” TLDs.

The top 10 list of the worst TLDs includes .country, .kim, .cricket, .science, .work, .party, .gq (Equatorial Guinea) and .link.

That’s a mixture of Afilias, Minds + Machines, Famous Four and Uniregistry. The common factor is the low cost of registration.

The full Blue Coat report, which can be downloaded here, does not give any of the real underlying numbers for its assertions.

For example, it ranks .review, one of Famous Four Media’s portfolio, as “100% shady” but does not reveal how many domains that relates to.

If its customers have only visited 10 .review domains, and all of those were dodgy, that would equate to a 100% score, even though .review has over 45,000 domains in its zone.

At the other end of the table, .london’s score of 1.85% could have been positively affected by Blue Coat customers visiting a broader selection of .london domains.

The company claims that the report is based on “tens of millions” of domains, but I’d hazard a guess that most of those are in .com and other more established TLDs.

That’s not to say that there’s no truth in Blue Coat’s broader assertion that a lot of new gTLDs are full of garbage — do a Google search for .review sites and see if you can find anything worth looking at — but I don’t think its numbers are worth the pixels they’re written with.

Afilias wins $10m judgment in Architelos “trade secrets” case

Kevin Murphy, August 25, 2015, Domain Services

Afilias has won a $10 million verdict against domain security startup Architelos, over claims its flagship NameSentry abuse monitoring service was created using stolen trade secrets.

A jury in Virginia today handed Afilias $5 million for “misappropriation of trade secrets”, $2.5 million for “conversion” and another $2.5 million for “civil conspiracy”.

The jury found (pdf) in favor of Architelos on claims of business conspiracy and tortious interference with contractual relations, however.

Ten million dollars is a hell of a lot of cash for Architelos, which reportedly said in court that it has only made $300,000 from NameSentry.

If that’s true, I seriously doubt the four-year-old, three-person company has even made $10 million in revenue to date, never mind having enough cash in the bank to cover the judgment.

“We’re disappointed in the jury’s verdict and we plan to address it in some post-trial motions,” CEO Alexa Raad told DI.

The lawsuit was filed in January, but it has not been widely reported on and I only found out about its existence today.

The original complaint (pdf) alleged that three Architelos employees/contractors, including CTO Michael Young, were previously employees or contractors of Afilias and worked on the company’s own abuse tools.

It claimed that these employees took trade secrets with them when they joined Architelos, and used them to build NameSentry, which enables TLD registries to monitor and remediate abuse in their zones.

Architelos denied the claims, saying in its March answer (pdf) that Afilias was simply trying to disrupt its business by casting doubt over the ownership of its IP.

That doubt has certainly been cast, though the jury verdict says nothing about transferring Architelos’ patents to Afilias.

The $5 million portion of the verdict deals with Afilias’ claim that Architelos misappropriated trade secrets — ie that Young and others took work they did for Afilias and used it to build a product that could compete with something Afilias had been building.

The other two counts that went against Architelos basically cover the same actions by Architelos employees.

The company may be able to get the amount of the judgment lowered in post-trial, or even get the jury verdict overturned, so it’s not necessarily curtains yet. But Architelos certainly has a mountain to climb.

Web.com hacked, 93,000 cards stolen

Kevin Murphy, August 19, 2015, Domain Registrars

The credit card details of 93,000 Web.com customers have been stolen by hackers.

The name, address and credit card number of the affected customers were accessed. The verification numbers (from the back of the cards) were not stolen.

Web.com said the attack was discovered August 13 and has been reported to the proper authorities.

Network Solutions and Register.com, its leading registrar businesses, were not affected, the company said.

It has 3.3 million customers. Those whose details were stolen have been emailed and will receive a letter in the mail.

The company said it will provide affected customers with a year of free credit monitoring.

World’s fourth-largest bank dumping old domains in switch to dot-brand gTLD

A French bank appears to be the first major company to commence a permanent switch from a legacy TLD to a new dot-brand.

BNP Paribas, the fourth-largest bank in the world, is dumping its .fr and .net domains in favor of .bnpparibas for customers in its domestic market, where it serves close to eight million retail banking customers.

Visitors to the .fr and .net domains are directed to a landing page that informs them that mabanque.bnpparibas (“mybank.bnpparibas”) is the company’s new domain.

BNP Paribas

The new dot-brand site appears to be a fully functional online banking service, not just brochureware.

It’s the ninth most-visited new gTLD domain name, with an Alexa rank today of 6,005, climbing the ranks every day.

As it’s a redesigned web site, customers are able to switch back to the familiar .net site (Alexa rank: 2,543) if they wish.

The domain was registered in January and BNP Paribas began a transition campaign in April. The transition away from the .net and .fr domains appears to have started at some point over the last month, but there hasn’t been a great deal of media coverage.

The .com domain is still live, serving Anglophone customers.

The mabanque.bnpparibas site leaves little doubt about the reason for the transition (translated with Google’s assistance):

BIZARRE, THIS ADDRESS WITHOUT .FR OR .NET? IS IT SECURE?

YES, A 100% SECURE SITE!

Any address ending with .bnpparibas is managed by BNP Paribas and has an advanced security certificate. Even more reliable, this new extension now acts as a signature.

Of course the architecture https and the padlock are still on your URL bar, confirming that the connection is secure.

So you can browse and view your accounts in all serenity!

BNP Paribas is a bit of a big deal, the fourth-largest bank in the world, managing assets of $2.5 trillion.

It’s bigger than Barclays, which earlier this year said it intends to transition away from .com and .co.uk to .barclays. The .barclays and .barclaycard sites are still just brochureware, however, with no transactional features.

Other dot-brands have launched sites at their new gTLDs, but .bnpparibas is the first transfer of a fully transactional web site from a legacy TLD to a dot-brand I’ve seen.

The Chinese conglomerate CITIC dumped its .com for .citic last September, but soon switched back.

Donuts: glitch revealed price we would pay for gTLDs

The recently discovered security vulnerability in one of ICANN’s web sites revealed how much Donuts was willing to pay for contested gTLDs at auction.

This worrying claim emerged during a meeting between registries and the ICANN board of directors at ICANN 53 in Buenos Aires yesterday.

“We were probably the largest victim of the data breach,” Donuts veep Jon Nevett told the board. “We had our financial data reviewed numerous times, dozens of times. We had our relative net worth of our TLDs reviewed, so it was very damaging information.”

He was referring to the misconfiguration in the new gTLD applicants’ portal, which allowed any user to view confidential application attachments belonging to any applicant.

ICANN discovered the problem in February, two years after the portal launched. The results of a security audit were revealed in late April.

But it was not until late May that it emerged that only one person, dotBerlin CEO Dirk Krischenowski, was suspected by ICANN of having deliberately viewed data belonging to others.

Nevett said communication should have been faster.

“We were in the dark for a number of weeks about who saw the data,” he told the board. “That was troubling, as we were going to auctions in that interim period as well.”

Donuts, which applied for over 300 new gTLDs, is known to have taken a strictly numbers-driven approach to string selection and auction strategy.

If a rival in a contention set had known how much Donuts was prepared to pay for a string, it would have had a significant advantage in an auction.

In response to Nevett’s concerns, ICANN CEO Fadi Chehade said that ICANN had to do a thorough investigation before it could be sure who saw what when.

XYZ buys .security and .protection from Symantec

XYZ.com has added .security and .protection to its portfolio of new gTLDs under a private deal with security software maker Symantec.

Symantec originally applied for both as closed generics, but changed its plans when ICANN changed its tune about exclusive access gTLDs.

The company won .security in an auction against Donuts and Defender Security late last year; .protection was uncontested. It lost auctions for .cloud and .antivirus.

Symantec’s .symantec and .norton, both dot-brands, are currently in pre-delegation testing.

XYZ already owns .college, .rent and of course .xyz.

In other news, Afilias has acquired .promo, which was in PDT with applicant Play.Promo Oy, in a private auction.

UPDATE: A couple of hours after this post was published, XYZ announced it has also acquired .theatre, which will compete with Donuts’ .theater, from KBE gTLD Holding Inc.

.berlin CEO prime suspect in ICANN data breach

dotBerlin CEO Dirk Krischenowski is suspected of using a bug in ICANN’s new gTLD portal to access hundreds of confidential documents, some containing sensitive financial planning data, belonging to competing gTLD applicants.

That’s according to ICANN documents sent by a source to DI today.

Krischenowski, who has through his lawyer “denied acting improperly or unlawfully”, seems to be the only person ICANN thinks abused its portal’s misconfigured search feature to deliberately access rivals’ secret data.

ICANN said last night that “over 60 searches, resulting in the unauthorized access of more than 200 records, were conducted using a limited set of user credentials”.

But ICANN, in private letters to victims, has been pinning all 60 searches and all 200 access incidents on Krischenowski’s user credentials.

Some of the incidents of unauthorized access were against applicants Krischenowski-run companies were competing against in new gTLD contention sets.

The search terms used to find the private documents included the name of the rival applicant on more than one occasion.

In more than once instance, the data accessed using his credentials was a confidential portion of a rival application explaining the applicant’s “worst case scenario” financial planning, the ICANN letters show.

I’ve reached out to Krischenowski for comment, but ICANN said in its letters to victims:

[Krischenowski] has responded through legal counsel and has denied acting improperly or unlawfully. The user has stated that he is unable to confirm whether he performed the searches or whether the user’s account was used by unauthorized person(s). The user stated that he did not record any information pertaining to other users and that he has not used and will not use the information for any purpose.

Krischenowski is a long-time proponent of the new gTLD program who founded dotBerlin in 2005, many years before it was possible to apply.

Since .berlin launched last year it has added 151,000 domains to its zone file, making it the seventh-largest new gTLD.

The bug in the ICANN portal was discovered in February.

The results on an audit completed last month showed that over the last two years, 19 users used the glitch to access data belonging to 96 applicants and 21 registry operators.

There were 330 incidents of unauthorized access in total, but ICANN seems to have dismissed the non-“Krischenowski” ones as inadvertent.

An ICANN spokesperson declined to confirm or deny Krischenowski is the prime suspect.

Its investigation continues…

ICANN fingers perps in new gTLD breach

Kevin Murphy, May 28, 2015, Domain Services

A small number of new gTLD registries and/or applicants deliberately exploited ICANN’s new gTLD portal to obtain information on competitors.

That’s my take on ICANN’s latest update about the exploitation of an error in its portal that laid confidential financial and technical data bare for two years.

ICANN said last night:

Based on the information that ICANN has collected to date our investigation leads us to believe that over 60 searches, resulting in the unauthorized access of more than 200 records, were conducted using a limited set of user credentials.

The remaining user credentials, representing the majority of users who viewed data, were either used to:

Access information pertaining to another user through mere inadvertence and the users do not appear to have acted intentionally to obtain such information. Access information pertaining to another user through mere inadvertence and the users do not appear to have acted intentionally to obtain such information. These users have all confirmed that they either did not use or were not aware of having access to the information. Also, they have all confirmed that they will not use any such information for any purpose or convey it to any third party; or

Access information of an organization with which they were affiliated. At the time of the access, they may not have been designated by that organization as an authorized user to access the information.

We can infer from this that the 60 searches, exposing 200 records, were carried out deliberately.

I asked ICANN to put a number on “limited set of user credentials” but it declined.

The breach resulted from a misconfiguration in the portal that allowed new gTLD applicants to view attachments to applications that were not their own.

ICANN knows who exploited the bug — inadvertently or otherwise — and it has told the companies whose data was exposed, but it’s not yet public.

The information may come out in future, as ICANN says the investigation is not yet over.

Was your data exposed? Do you know who accessed it? You know what to do.