Police .uk domain takedowns dive in 2023

The number of .uk domain names taken down as a result of requests from law enforcement shrank substantially last year, according to the latest stats from Nominet.

The registry said today that it suspended 1,193 domains in the 12 months to October 31, down from 2,106 in the previous period. It’s a record low since Nominet started tracking the data, for the second year in a row.

As usual, alleged intellectual property violations were the biggest cause of action. The Police Intellectual Property Crime Unit had 717 names taken down, with the National Fraud Intelligence Bureau suspending 321 and the Financial Conduct Authority 116.

While police takedowns were low, domains suspended by Nominet’s proactive Domain Watch anti-phishing technology were up about 20%, from 5,005 to 5,911. Nominet said this is because the tech, which flags possible phishing domains for human review at point of registration, is getting better.

The number of domains suspended because they appeared on threat feeds doubled, from 1,108 in the 2022 period to 2,230 last year, the company said.

Cybersquatting cases in .uk have also been declining, Nominet reported earlier this month.

While correlation does not equal causation, it might be worth noting that .uk registrations overall have been on the decline for some time. There were 10.68 million .uk domains at the end of January, down from 11.04 million a year earlier.

Bosnian government to sue US domain firm that cut it off

One of Bosnia and Herzegovina’s two governments has said it will sue a US domain name company — probably Verisign — for turning off the domain it was using for official government business.

“The Government of the Republic of Srpska will hire legal experts to prepare a lawsuit against the company that disabled the use of the website of the Government of the Republic Srpska without prior notice,” the government said in a statement on its new web site.

It did not name the company in question, but we can narrow it down to a few.

Its old domain, vladars.net, was registered via Dotster, a reseller for Domain.com, part of Newfold Digital. The .net registry is of course Verisign. These are all American companies subject to US legal jurisdiction.

The domain still exists in Whois, but has been removed from the .net zone file and does not resolve.

The Republika Srpska, or Serb Republic, is part of Bosnia and Herzegovina that doesn’t particularly want to be a part of Bosnia and Herzegovina. As such, its new domain is in .rs, the ccTLD for neighboring Serbia, rather than Bosnia’s .ba.

The old .net domain was reportedly deleted due to US sanctions against the Republic, which were expanded October 20 to include members of President Milorad Dodik’s family and several corporate entities.

The US accuses the Dodik family of widespread “graft, bribery, and other forms of corruption” and engaging in “divisive ethno-nationalistic rhetoric” to divert attention from their activities. It additionally accuses them of violating the Dayton Peace Agreement, which ended the war in the region in the 1990s.

Worried about governments seizing .com domains? Too late

Language proposed for Verisign’s .net registry contract that some say would give governments the ability to arbitrarily seize domains is already present in the company’s .com contract.

As I reported earlier this month, the .net Registry Agreement is up for renewal and ICANN has opened up some largely uncontroversial proposed changes for public comment.

ICANN has received two comments so far, both of which refer to what one commenter called the “outrageous and dangerous” proposed changes to Verisign’s .net Registry-Registrar Agreement.

The RRA is the contract all accredited registrars must agree to when they sign up to sell domains in a given TLD. For ICANN, it’s a way to vicariously enforce policy on registrants via registrars via registries.

Unsimply put, the RA instructs Verisign to have an RRA with its registrars that tells them what rules their registrants have to agree to when they buy a domain name.

The new language causing the consternation is:

Verisign reserves the right to deny, cancel, redirect or transfer any registration or transaction, or place any domain name(s) on registry lock, hold or similar status, as it deems necessary, in its unlimited and sole discretion:

…

to ensure compliance with applicable law, government rules or regulations, or pursuant to any legal order or subpoena of any government, administrative or governmental authority, or court of competent jurisdiction

One commenter states “this proposed agreement would allow any government in the world to cancel, redirect or transfer to their control applicable domain names”, adding “presumably ICANN staff and Verisign would want to also apply it to other extensions like .COM as those contracts come up for renewal”.

In fact, it’s the other way around. The exact same language has been present in Verisign’s .com contract for over three years, a change to Appendix 8a (pdf) that went largely unnoticed when thousands of commenters were instead complaining about the removal of price caps and fretting about the rise of Covid-19 around the world.

For those worried about the new .net language making it into the .com contract one day — worry not! It’s already there.

Gun nut site crashes at Epik after GoDaddy shoots it down

A site for American gun enthusiasts has switched registrars, moving its domain to Epik — apparently with the consent of CEO Rob Monster — after GoDaddy turfed it out for allegedly inciting violence.

According to a GoDaddy statement at the weekend, the registrar had received complaints about content on AR15.com — that’s the name of a gun popular with spree killers — and determined it “incited violence”.

It informed the domain’s owner the same day, January 8, two days after the Capitol Hill riots, giving him 24 hours to remove the offending content.

It’s not clear what the content in question was, but given the timing and the fact that the site is a scarily popular forum with largely user-generated content, it’s not difficult to imagine.

AR15.com’s owner, identified in a video as GoatBoy, claims that by the time he received the email from GoDaddy, the forum’s moderators had already removed the posts on the grounds that the site also has a policy against incitement to violence.

But GoDaddy disagrees, saying the content could still be found after its supposed removal. It took down the domain on January 11. It said in a statement:

We do not take action on complaints that would constitute censorship of content that represents the exercise of freedom of speech and expression on the Internet. In instances where a site goes beyond the mere exercise of these freedoms, however, and crosses over to promoting, encouraging, or otherwise engaging in violence, as was the case with AR15.com, we will take action.

The AR15.com domain is now hosted by Epik, which has in recent years made a name for itself as a refuge for sites frequented by those with far-right views, such as 8chan, Gab and Parler.

GoatBoy says in the video embedded below: “I had the privilege of speaking with some of the guys on the executive staff, including the owner of Epik. Their views really align well with ours. They’re very pro First Amendment and very pro Second Amendment.”

“Criminal” domain suspensions drop again in .uk but thousands of pandemic domains frozen

Nominet suspended thousands fewer suspected criminal domains in 2020 than last year, according to the registry’s latest annual update.

For the 12 months to the end of October, Nominet took down 22,158 domains, is down from 28,937 in the year-ago period.

As usual, suspected intellectual property crime made up almost all the takedowns — the Police Intellectual Property Crime Unit was behind 21,632 requests, down from 28,606.

Notably, despite the reported uptick in scams related to the coronavirus pandemic, the Medicines and Healthcare Products Regulatory Agency made just 13 takedown requests, down from 31.

This is perhaps due to Nominet taking a proactive approach, putting domains containing certain related keywords on hold at the point of registration. It froze 3,811 such domains this year, later releasing 1,568.

Eight domains were suspended for criminal activity related to Covid-19, the company said.

There were no suspensions related to banned “rape” domains, despite over a thousand new registrations being flagged for manual review. Nor were there any takedowns of domains hosting child sexual abuse material.

It’s the second year in a row that suspensions have been down. In the 2017/18 period Nominet took down 32,813 domains.

US officials gunning for coronavirus domains

US state and federal law enforcement are pursuing domain names being used to push bogus products and misinformation related to coronavirus Covid-19.
In separate actions, the US Department of Justice forced Namecheap to take down a scam site that was allegedly using fear of coronivirus to hoodwink visitors out of their cash, while the New York Attorney General has written to registrars to demand they take action against similar domains.
The DoJ filed suit (pdf) against the anonymous “John Doe” registrant of coronavirusmedicalkit.com on Saturday and on Sunday obtained a temporary restraining order obliging Namecheap to remove the DNS from the domain and lock it down, which Namecheap seems to have done.
Namecheap is not named as a defendant, but the complaint notes that the DoJ had requested the domain be taken down on March 19 and no action had been taken by the evening of March 21.
The web site in question allegedly informed visitors that the World Health Organization was giving away free coronavirus vaccines to anyone prepared to pay a $4.95 shipping fee by handing over their credit card details.
This is an identity theft scam and wire fraud, the complaint says.
Meanwhile, NYAG Letitia James has sent letters, signed by IT chief Kim Berger, to several large US registrar groups — including GoDaddy, Dynadot, Name.com, Namecheap, Register.com, and Endurance — to ask them to “stop the registration and use of internet domain names by individuals trying to unlawfully and fraudulently profit off consumers’ fears around the coronavirus disease”.
In the letter to GoDaddy (pdf), Berger asks for a “dialogue” on the following preventative measures:

• The use of automated and human review of domain name registration and traffic patterns to identify fraud;
• Human review of complaints from the public and law enforcement about fraudulent or illegal use of coronavirus domains, including creating special channels for such complaints;
• Revising your terms of service to reserve aggressive enforcement for the illegal use of coronavirus domains; and
• De-registration of the domains cited in the articles identified above that were registered at GoDaddy, and any holds in place on registering new domains related to coronavirus, or similar blockers that prevent rapid registration of coronavirus-related domains.

In other words: try to stop these domains being registered, and take them down if they are.
No specific malicious sites are listed in the letter. Rather, Berger cites a study by Check Point Software that estimates that something like 3% of the more than 4,000 coronavirus-related domains registered between January and March 5 are “malicious” in nature.

EasyDNS changes take-down policy after man dies

Canadian registrar EasyDNS has amended its take-down policy after a customer of one of its registrants died of an overdose.
In a frank blog post today, CEO Mark Jeftovic said that the man had died using a “controlled substance” ordered online. The web site in question used a domain registered via EasyDNS.
As a result of the death, and conversations with ICANN and the US Food and Drug Administration, EasyDNS has changed its policy.
It will now turn off any domain used for a pharmacy web site unless the registrant can produce a license permitting it to sell pharmaceuticals in the territories it sells to.
Previously, the company would only turn off a pharmacy-related domain with a court order.
It’s a notable U-turn for the company because Jeftovic is an outspoken critic of unilateral take-down notices.
In January, he referred to the National Association of Boards of Pharmacy as a “batch of clowns” for demanding that EasyDNS and other registrars take down unlicensed pharmacies without court orders.
He also has an ongoing beef with the UK police over its repeated requests for file-sharing and counterfeiting-related domains to be taken down without judicial review.
Jeftovic blogged today:

[I]n one case we have people allegedly pirating Honey Boo Boo reruns and on the other we have people dying. We don’t know where exactly, but the line goes somewhere in between there.
We have always done summary takedowns on net abuse issues, spam, botnets, malware etc. It seems reasonable that a threat to public health or safety that has been credibly vetted fits in the same bucket.
As a private company we feel within our rights to set limits and boundaries on what kinds of business risk we are willing to take on and under what circumstances. Would we tell the US State Department to go to hell if they wanted us to take down ZeroHedge? Absolutely. Do we want to risk criminally indicted by the FDA because of unregulated vicodin imports? Not so much.

You can read his full blog post here.