Latest news of the domain name industry

Recent Posts

Domain-hopping torrent site seized, founder arrested

Kevin Murphy, July 22, 2016, Domain Policy

A joint US-Polish law enforcement operation has led to the arrest of the alleged owner of the piracy-focused BitTorrent links site KickAssTorrents.

The US Department of Justice announced yesterday that Ukrainian national Artem Vaulin has been arrested in Poland and that it will seek to extradite him to Chicago to face criminal copyright infringement charges.

The site, which has been banned at the ISP level in countries including the UK, provides links to download and share copyrighted works such as movies and music from other BitTorrent users.

But it’s perhaps best known in the domain name industry for regularly jumping from one TLD to another as its domains are terminated by local authorities.

According to the DoJ, it has been seen on kickasstorrents.com, kat.ph (Philippines), kickass.to (Tonga), kickass.so (Somalia) and kat.cr (Costa Rica).

The department said it has seized seven domain names as part of its operation.

According to my records, there are 20 examples of kickasstorrents.example domains in the Alexa one million, all in new gTLDs (though I’ve no idea whether they’re part of the same operation).

The DoJ reckons KAT makes annual revenue of between $12.5 million to $22.3 million from advertising accompanying its links.

Domains seized as part of Liberty Reserve money laundering sting

The US government seized five domain names and is going after dozens more as part of its crackdown on Liberty Reserve, a digital currency provider apparently popular with criminals.

The Department of Justice said yesterday that the company was responsible for laundering $6 billion spread across 55 million transactions, “virtually all of which were illegal”.

The service was being used to facilitate fraud and child pornography, among other nasties, according to Justice.

Seven people have been arrested in the US, Spain and Costa Rica and five domain names were seized: libertyreserve.com, exchangezone.com, swiftexchanger.com, moneycentralmarket.com and asianagold.com.

Three are registered with Go Daddy. The main site, libertyreserve.com, is with Swedish registrar AB NameISP and exchangezone.com is with Internet.bs.

But .com registry Verisign handled the seizures, according to a court order published by Justice (pdf).

While Liberty Reserve was based in Costa Rica, there doesn’t appear to be any reason to believe the company’s activities were any more legal there than in the US.

Justice is also seeking the forfeiture of 35 other domain names, mostly .coms, that were allegedly (pdf) being used as “exchanger” sites, where Liberty Reserve users could exchange real money for virtual currency.

Cops seize 132 domains in Cyber Monday crackdown

Kevin Murphy, November 26, 2012, Domain Policy

Law enforcement agencies in the US and Europe have shut down 132 domain names in order to stop the selling of counterfeit merchandise online.

According to the US Immigration and Customs Enforcement agency, the now-annual Cyber Monday crackdown included domain names in the .eu, .be, .dk, .fr, .ro and .uk ccTLDs.

Law enforcement from those countries were involved, via Europol, in their respective local seizures, while ICE nabbed 101 domains in generic TLDs whose registries are based in the US.

One person was also arrested, and ICE plans to seize $175,000 in ill-gotten gains sent to a PayPal account connected with the sites.

It’s the third year in a row that ICE has led an operation of this kind before “Cyber Monday”, which in recent years has become the most popular day of the year for e-commerce deals.

The operation started when ICE and Europol “received leads from various trademark holders regarding the infringing websites”, ICE said in a press release.

Congressmen quiz ICE over domain seizures

Kevin Murphy, September 3, 2012, Domain Policy

Three US members of Congress have expressed “deep concern” over the alleged lack of due process followed when the Department of Homeland Security seizes domain names.

Rep. Zoe Lofgren, Rep. Jared Polis and Rep. Jason Chaffetz quiz DHS (pdf) about the methods employed by the Immigration and Customs Enforcement agency in its Operation In Our Sites.

The Congressmen’s letter highlights the case of the hip-hop web site Dajaz1.com, which had its .com seized by ICE and then returned.

“Much of Dajaz1’s information was lawful,” the letter reads. “Despite this, DHS and the Department of Justice suppressed this website for more than a year.”

The Congressmen say that “if a website’s domain is seized, it needs to be given meaningful due process that comports to the US Constitution and US law”.

Operation In Our Sites has seen ICE seize hundreds of domains — mainly .coms accused of copyright infringement — from US-based registries including Verisign since late 2010.

Despite the relatively small number of domains seized, there have been a number of controversies.

Notably, the Spanish TV download web site RojaDirecta, which lost its .com and .org domains despite being ruled legal by a court in its home nation, last month had them returned to it by ICE.

Cops seize 36 carder domains

Kevin Murphy, April 26, 2012, Domain Policy

The FBI and UK Serious Organised Crime Agency have seized 36 domain names that were allegedly being used to sell compromised credit card information.

As well as seizing the domains and a number of computers, SOCA said it has arrested two men “suspected of making large scale purchases of compromised data” from the sites.

The sites all used what SOCA calls “automated vending cart” software to process the sale of credit card information. Judging by the video below, some of the operations were fairly professional.

One of the seized domains was cvvplaza.com. SOCA provided the following video which really has to be seen to be believed.

I wonder if the spokesmodel had any idea what she was getting into when she accepted this gig.

While the full list of domains was not released, a SOCA spokesperson said the breakdown by TLD was as follows:

.name – 2
.net – 11
.biz – 4
.us – 5
.com – 11
.org – 3

These are all TLDs whose registries are based in the United States, so I’m guessing the US authorities did the actual seizing.

ICM opens can of worms with .xxx domain seizures

Kevin Murphy, December 14, 2011, Domain Registries

ICM Registry has suspended several dozen .xxx domain names registered by cybersquatters.

It’s believed to be unprecedented for a mainstream registry to unilaterally shut down domains purely on the grounds of alleged cybersquatting, as I reported for The Register earlier today.

ICM took down 70 to 80 domains including washingtonpost.xxx, cnbc.xxx and verizonwireless.xxx because it decided that the domains infringed trademarks and were therefore abusive.

Many belonged to the squatter Domain Name Wire first fingered as the registrant of huffingtonpost.xxx, named in Whois as Justin Crews.

Crews had told MSNBC that he planned to sell the domains at profit.

There was no UDRP arbitration, no court order, just a breach of the .xxx registry-registrant agreement, which gives ICM the right to suspend squatted domains at will.

This is the relevant part of the agreement, which all .xxx registrants must agree to:

You acknowledge and agree that the Registry reserves the right to disqualify you or your agents from making or maintaining any Registrations or Reservations in the .XXX TLD if you are found to have repeatedly engaged in abusive registrations, in its sole discretion.

I blogged back in May about why it might not be necessary to spend a fortune on defensive registrations in .xxx, given the existence of this policy and others.

Nevertheless, while it may take a while for the implications to become clear, I think the suspensions represent a very significant development.

Coming so soon after the end of ICM’s sunrise period, which saw many organizations spend thousands on useless non-resolving defensive registrations, I wouldn’t be surprised if many companies feel like they may have wasted their money.

If you’ve just spent $200 defending your brand, I imagine it would be quite annoying to see the likes of verizonwireless.xxx or businessweek.xxx get the same protection for free.

I would also not be surprised if, from now on, trademark attorneys trying to defend their rights in .xxx first contacted ICM, rather than WIPO or the National Arbitration Forum.

Why spend thousands on a UDRP complaint when you can just send a legal nastygram to ICM?

ICM president Stuart Lawley told DI today that this wave of suspensions was done independently, not in response to any legal demands.

Still, the precedent has been set: ICM will suspend domains for free, under certain circumstances.

What those circumstances are is less clear.

Lawley said that ICM will not get involved in complaints about individual domains – but it will shut down cybersquatters with multiple infringements.

But what constitutes cybersquatting? UDRP has a definition, but I’m not sure ICM does. It may be quite subjective.

It’s also not clear what ICM will do with the suspended domains, not all of which necessarily infringe trademarks. Some may be bona fide, but the ICM policy is to take down the registrant’s entire portfolio.

So will those non-infringing domains be released back into the pool? And if so, how will ICM determine which are squats and which are not?

And what about the ones that are squats? Will they be released?

AOL may be content for huffingtonpost.xxx to remain suspended forever. As long as it’s suspended, the company does not have to worry about defensive registration fees.

But consider gayroom.xxx, which was also suspended.

The owner of gayroom.com owns a trademark on the word “gayroom”. Gayroom.com is a porn site, but one that has chosen not to buy its equivalent .xxx domain.

What if it changes its mind? If gayroom.com wants gayroom.xxx in future, is there a way to take it out of suspension, or is the company stuck without its .xxx forever, just because a cybersquatter got there first?

ICM’s policies do not seem to answer this question and the company has not yet revealed its plans for the suspended domains.

As a post-script, I should note that Huffington Post owner AOL is currently listed as the registrant of huffingtonpost.xxx in the Whois record.

It’s not yet clear why this is the case, but Lawley stated unequivocally today that the apparent transfer is completely unrelated to ICM’s own crackdown.

Go Daddy, the registrar of record for the domain, declined to comment, citing its customer privacy policy.

Did the cybersquatter transfer the domain to AOL before the suspension? Did he sell it to AOL? Or did he just update the Whois with phoney data? Either seems possible at this point.

Another 2,000 .uk fraud domains taken down

Kevin Murphy, November 18, 2011, Domain Policy

Nominet has suspended over 2,000 .uk domain names allegedly being used to sell counterfeit goods on the instruction of the Metropolitan Police.

The Met said in a statement today that the crackdown was designed to protect online shoppers in the run-up to Christmas. It did something similar last year and the year before.

The sites were allegedly selling bootleg products purportedly from brands such as Ugg, Nike and Tiffany.

Nominet said that it worked with is registrars to coordinate the suspensions, and that the registrants were all informed before their domains were taken down.

All the registrants were in breach of terms and conditions, it said.

A Nominet working group is currently in the final stages of creating a policy that will streamline the process of law enforcement domain suspensions, as I reported for The Register today.

GAC slams registrars over “silly” crime domain moves

Kevin Murphy, October 24, 2011, Domain Registrars

ICANN’s Governmental Advisory Committee is seriously annoyed with domain name registrars over what it sees as a failure to take the demands of law enforcement seriously.

The first official day of ICANN’s 42nd public meeting in Dakar, Senegal, was highlighted by a fractious discussion between the GAC and the Generic Names Supporting Organization.

Governments are evidently losing patience with the industry over what they see as incessant foot-dragging and, now, halfhearted bone-throwing.

The US, which is easily the most influential GAC member, was harshly critical of recent efforts by registrars to self-regulate themselves some law enforcement cooperation policies.

US GAC representative Suzanne Radell, saying she was speaking on behalf of the GAC, described a registrar move to start publishing legal service addresses on their web sites at some point in the future as as “paltry”, “mind-boggling” and “silly”.

She heavily implied that if the industry can’t self-regulate, the alternative is governments doing it for them. She was backed up by her counterparts from the UK, Australia and the European Commission.

Registrars have been talking to law enforcement for a few years about how to more effectively work together to prevent crime online.

In October 2009, agencies including the FBI and the UK Serious Organised Crime Agency publish a set of 12 recommendations about how to clean up the industry.

A lot of it was pretty basic stuff like a prohibition on registrar cybersquatting and an obligation to publish an abuse point of contact.

Despite a lot of talking at ICANN meetings, up until a couple of weeks ago there had not been a great deal of tangible progress.

The GNSO passed a resolution, proposed by registrars, to ask for an Issue Report to discuss whether registrars should be forced to post on their sites: a physical address for legal service, the names of key executives, and an abuse contact.

In ICANN’s world, an Issue Report usually precedes a Policy Development Process, which can take a year or more to produce results.

While the GNSO motion passed, it was opposed as inadequate by factions such as the Intellectual Property Constituency, which has close ties to the US government.

As the IPC seemed to correctly predict, the GAC was not amused.

“It is simply impossible for us to write a briefing memo for our political managers to explain why you need a policy to simply put your name on your web site,” Radell told the GNSO Council yesterday. “It is simply mind-boggling that you would require that.”

She pointed out that at a session during the Singapore meeting, registrars had indicated a willingness to address more of the law enforcement demands.

“That’s the context in which we are now coming to you saying this looks pretty paltry and actually it looks a little silly,” she said.

Mason Cole from the registrar constituency denied that they were “roadblocking” law enforcement’s demands, saying that a PDP is the fastest way to create a policy binding on all registrars.

“I think law enforcement was very clear when they made their proposals to us that what they were looking for was binding, enforceable provisions of policy that could be imposed on the registrars,” he said. “A code of conduct or a voluntary method would not arrive at binding, enforceable policy and therefore probably wouldn’t achieve the outcomes that law enforcement representatives were seeking.”

The debate didn’t end yesterday. Radell said she intends to take it up with the ICANN board of directors, presumably at their joint meeting tomorrow.

The implicit threat underlying the GAC’s protest is a legislative one, and Radell and other GAC members made it pretty clear that their governments back home regard domain names as a crucial tool in fighting online crime.

VeriSign yanks domain seizure power request

Kevin Murphy, October 13, 2011, Domain Registries

That was quick.

VeriSign has withdrawn its request for new powers to delete domain names being used for abusive purposes, just a few days after filing it with ICANN.

The company had proposed a policy that would give law enforcement the ability to seize .com and .net names apparently without a court order, and a new malware scanning service.

The former came in for immediate criticism from groups including the American Civil Liberties Union and the Electronic Frontier Foundation, while the latter appeared to have unnerved some registrars.

But now both proposals have been yanked from ICANN’s Registry Services Evaluation Process queue.

This is not without precedent. Last year, VeriSign filed for and then withdrew requests to auction off one-letter .net names and a “Domain Name Exchange” service that looked a bit like domain tasting.

Both came in for criticism, and have not reappeared.

Whether the latest abuse proposals will make a reappearance after VeriSign has had time to work out some of the more controversial kinks remains to be seen.

Registrars not happy with VeriSign abuse plans

Kevin Murphy, October 12, 2011, Domain Registrars

VeriSign has been talking quietly to domain name registrars about its newly revealed anti-abuse policies for several months, but some are still not happy about its plans for .com malware scans.

The company yesterday revealed a two-pronged attack on domain name abuse, designed to counteract a perception that .com is not as secure a space as it should be.

One prong, dealing with law enforcement requests to seize domains, I covered yesterday. It’s already received criticism from the Electronic Frontier Foundation and American Civil Liberties Union.

The other is an attempt to introduce automatic malware scanning into the .com, .net and .name spaces, rather like ICM Registry has said it will do with all .xxx domains.

Unlike the daily ICM/McAfee service, VeriSign’s free scans will be quarterly, but the company intends to also offer a paid-for upgrade that would search domains for malware more frequently.

On the face of it, it doesn’t seem like a bad idea.

But some registrars are worried about the fading line between registrars, which today “own” the customer relationship, and the registries, which for the most part are hidden away in the cloud.

Go Daddy director of network abuse Ben Butler, asked about both of yesterday’s VeriSign proposals, said in a statement that they have “some merit”, but sounded several notes of caution:

This is going to make all registrars responsible for remediation efforts and negative customer-service clean up. The registrar at this point becomes the “middle man,” dealing with customers whose livelihood is being negatively impacted. As mentioned in their report, the majority of sites infected with malware were not created by the “bad guys.”

While there is an appeal process mentioned, it could take some time to get issues resolved, potentially leaving a customer’s website down for an extended period.

This could also create a dangerous situation, allowing registries to gain further control over registrars’ operations – as registrars have the relationship with the registrant, the registrar should be responsible for enforcing policies and facilitating remediation.

It has also emerged that VeriSign unilaterally introduced the malware scanning service as a mandatory feature of .cc and .tv domains – which are not regulated by ICANN – earlier this year.

The changes appear to have been introduced without fanfare, but are clearly reflected in today’s .tv registration policies, which are likely to form the basis of the .com policies.

Some registrars weren’t happy about that either.

Six European registrars wrote to VeriSign last month to complain that they were “extremely displeased” with the way the scanning service was introduced. They told VeriSign:

These changes mark the beginning of a substantive shift in the roles of registries regarding the monitoring and controlling of content and may lead to an increase of responsibility and liability of registries and registrars for content hosted elsewhere. As domain name registrars, we hold the position that the responsibilities for hosted content and the registration of a domain name are substantially different, and this view has been upheld in European court decisions numerous times. In this case, Verisign is assuming an up-front responsibility that surpasses even the responsibilities of a web hoster, and therefore opens the door to added responsibilities and legal liability for any form of abuse.

In the end, the registrar community will have to face the registrant backlash and criticism, waste countless hours of support time to explain this policy to the registrants and again every time they notice downtimes or loss of performance. These changes are entirely for the benefit of Verisign, but the costs are delegated to the registrants, the registrars and the hosting service providers.

The registrars were concerned that scanning could cause hosting performance hits, but VeriSign says the quarterly scan uses a virtual browser and is roughly equivalent to a single user visit.

They were also worried that the scans, which would presumably ignore robots.txt prohibitions on spidering, would be “intrusive” enough to potentially violate European Union data privacy laws.

VeriSign now plans to give all registrars an opt-out, which could enable them to avoid this problem.

It looks like VeriSign’s plans to amend the Registry-Registrar Agreement are heading for ICANN-overseen talks, so registrars may just be digging into a negotiating position, of course.

But it’s clear that there is some unease in the industry about the blurring of the lines between registries and registrars, which is only likely to increase as new gTLDs are introduced.

In the era of new gTLDs, and the liberalization of ICANN’s vertical integration prohibitions, we’re likely to see more registries having hands-on relationships with customers.

  • Page 1 of 2
  • 1
  • 2
  • >