Israeli registrar denies “arms dealer” claims

Israeli registrar GalComm has denied being involved in a widespread malware distribution scheme after being fingered by a security outfit.

Last month Awake Security accused the registrar, officially Communigal Communication Ltd, of being “at best complicit in malicious activity”.

The firm published a report entitled “The Internet’s New Arms Dealers: Malicious Domain Registrars” which linked GalComm to a network of malicious Chrome browser extensions the firm said can steal sensitive data from users who have them installed.

It identified 111 such plug-ins, which it said have been downloaded 33 million times, using over 15,000 domains registered via GalComm.

GalComm has around 48,000 domains registered in gTLDs at the last count, so that’s a sizable percentage of the registrar’s business.

Awake came to the conclusion that GalComm was well-aware of what its customers were up to.

Now, the registrar has sent a cease-and-desist notice to Awake, CC’d to ICANN (pdf), in which it denies all knowledge and responsibility for the malware.

GalComm’s line, to summarize, is that it’s just a registrar, and that it has no obligation to monitor how its customers use their domains.

It adds that the domains in question amount to 10% of its DUM. Still a pretty big chunk.

The company wants Awake to retract its report by today, which it has not yet done, or it will call in the lawyers.

CSC becomes first foreign registrar to get the China nod

It’s probably not the best time, politically, to be bragging about doing business in China, but CSC has nevertheless just announced that it’s been given the nod to act as a registrar in China.

The company claims to be the first non-Chinese registrar to be given an official government license to operate in the country, though many registries have obtained one over the last few years since harsh new regulations came into power.

Under the Chinese rules, web site owners need a license to operate, and they can only register domains from approved registrars in approved TLDs.

It’s basically a great big censorship tool, but it doesn’t seem to have stopped every Chinese citizen from registering domains via foreign-owed registrars.

CSC has a corporate client base, so it’s got more incentive than most to follow the rules to the letter.

“CSC’s success in becoming licensed as a foreign-owned registrar positions the company as a go-to resource for global organizations doing business in China,” the company said in a press release.

Endurance also got a lockdown bump in Q2

Endurance International Group added its name to the list of registrars to see a lift from the coronavirus pandemic in the second quarter.

The company, which counts brands including Domain.com, BuyDomains and ResellerClub in its stable, this week upgraded its guidance for Q2.

Endurance said it added roughly 97,000 net subscribers in the quarter, compared to a loss of 13,000 in Q2 2019.

It expects revenue to be $274 million compared to an analyst consensus of $271.25 million, and adjusted EBITDA of about $84 million compared to the $76.3 million reported a year ago.

Cash bookings, perhaps a better indicator of actual sales during the quarter were up 5% year over year at $281.6 million.

Unlike other registrars and registries that have reported a lockdown bump, Endurance suggested that it performed well in spite of, rather than because of, the pandemic. In a statement, CEO Jeffrey Fox said:

As we entered the second quarter, the healthcare and economic uncertainties brought on by COVID-19 were impacting global businesses, including the millions of small businesses we serve. Despite these challenges, we remain focused on delivering value to our customers as they navigate this complex environment.

Endurance will report its Q2 results July 30.

One.com takes big chunk of Danish market with third acquisition this year

European registrar One.com says it is now the biggest player in the Danish market after acquiring rival Larsen Data, which does business as GratisDNS, for an undisclosed sum.

One.com says that the deal means it now sponsors over 400,000 of the 1.3 million extant .dk domains, making it the largest local registrar.

GratisDNS has been around since 2001. It’s not a big player in gTLDs, with only 550 names under management at the last count.

It’s the third announced acquisition by One.com this year. It also bought Dutch hosting provider Hostnet and Norwegian registrar SYSE.

The company also recently said that, like so many other registrars, business has been booming during the coronavirus pandemic as bricks-and-mortar businesses relocate online.

Interestingly, sales were up 55% year-on-year in locked-down Denmark, but only up 7% in quarantine-free Sweden.

One.com also runs the .one gTLD, which has almost 78,000 names in its zone file right now. The registrar has been offering first-year regs for free recently.

GratisDNS had planned to apply for a city gTLD for Copenhagen back in 2012, but failed to secure governmental interest.

Web.com acquires another of the original five registrars

Consolidation in the domain industry continues apace, with Web.com bringing one of the remaining original five competitive registrars into its stable for AUD 12.2 million ($8.3 million) in cash.

It’s acquiring an Australian company called Webcentral Group, which until last month was known as ARQ Group and before that as Melbourne IT.

Webcentral also runs the retail registrars Netregistry and, in New Zealand, Domainz. It has about 330,000 customers, though not all are registrants.

Web.com says the deal gives it a deeper footprint in the Aussie, Kiwi and Southeast Asian markets.

My records show that Webcentral had about 130,000 domains under management at the end of March on its Melbourne IT tag, down by about 6,000 year over year. That’s not counting regs in ccTLDs such as .au.

Netregistry had another 113,000 gTLD domains, down from 129,000 a year earlier.

After the deal closes, Web.com will own the three oldest active registrars as measured by IANA ID — Network Solutions, Register.com and now Melbourne IT. The latter two were among the first five to go live after ICANN introduced competition at the registrar level in 1999.

For Webcentral, the deal marks the conclusion of a three-stage sell-off that started over a year ago when it sold its TPP Wholesale business to UK consolidator CentralNic.

Then, this February, it announced the sale of its enterprise unit to private equity for AUD 36 million ($25 million). It had been publicly looking for a buyer for its remaining SMB registrar business for many months.

The root cause of the sell-offs appears to be the company’s crippling debt.

Webcentral had expected to be hit unfavorably by the coronavirus pandemic, but that was largely due to its exposure to the digital marketing market, via its WME brand, rather than dwindling domain sales.

GoDaddy blamed the same problem for its recently announced layoffs.

Webcentral is currently listed on the Australian Stock Exchange. Web.com itself fell into private equity hands in a $2 billion deal in 2018.

GoDaddy domains doing just fine during pandemic, lays off hundreds anyway

GoDaddy has announced hundreds of lay-offs as part of a restructuring made necessary by the coronavirus pandemic, but it says its domain name business is still doing pretty well.

The market-leading registrar late last week announced changes that will affect 814 of its US-based employees.

Hundreds will be laid off. Others will be offered jobs in states a thousand miles away from home.

But at the same time, GoDaddy increased its estimates for second-quarter revenue, saying its domain business is doing okay.

The main victims of the restructuring are those in outbound sales, employees who cold-call customers to up-sell them on high-margin products such as GoDaddy Social, a social media management service.

Because GoDaddy Social isn’t selling well any more, apparently due to the pandemic, 331 staff are losing their jobs.

There are another 213 employees, currently based in GoDaddy’s native Arizona, that will be moved into customer support roles — which for GoDaddy is also a up-sell role — instead.

Another 135 sales staff based in Iowa will be told to move to Arizona — well over 1,000 miles away — or lose their jobs.

GoDaddy will be closing both of its two offices in Austin, Texas.

Despite the carnage, the company seems to be treating its affected employees quite well by American standards.

They’ll all get paid until at least September 1, and get healthcare benefits (because this is America, where healthcare is a privilege that has to be earned by phone-jockeying) up to the end of the year.

GoDaddy had previously promised it staff that there would be no layoffs in Q2.

The company also said last week that it will make 1% more revenue that it had previously expected.

It now expects $790 million in Q2, up 1% on its previous guidance.

That increase is, according to GoDaddy, due to sales of domains and web sites.

This coincides with other industry evidence that domain sales are doing okay right now.

I was wrong, rejected “racist” web site didn’t go to Epik

Vdare.com, the domain for a US-based right-wing news blog that was jettisoned from Network Solutions last week under a cloud of racism allegations, did not, as expected, wind up at Epik.

Rather, Whois records reveal that the domain is now under the wing of PublicDomainRegistry.com, a unit of Endurance, having been transferred at the weekend.

Perhaps ironically, PDR is based in India, where white supremacy has been out of style for many decades. How very patriotic.

Unlike NetSol, PDR does not have an explicit ban on racist content in its acceptable use policy.

But Vdare’s editors think there’s a risk they’ll be moved on again, regardless, writing:

The number of ICANN accredited registrars has shrunk significantly in recent years as a result of consolidation. Many consumer-level registrars are not independent, but repackage services from larger companies. These larger companies are increasingly Woke. So while an individual registrar retailer may claim a freedom of speech mission-oriented corporate value, they operate solely at the pleasure of their supply chain.

In other words, we don’t know how long we’ll be tolerated by the new registrar either.

NetSol ejected Vdare earlier this month under pressure from civil rights groups in the wake of the reemergence of the Black Lives Matter movement and worldwide anti-racism protests.

Vdare in unapologetically anti-immigration and has described its role as to “defend the interests of American whites”, which has led to allegations of a white supremacist agenda.

I’d predicted that its domain would be welcomed by Epik, which has built up a bit of a reputation for working with domains kicked out of other registrars.

But when you’re wrong, you’re wrong, and I was wrong, at least for now.

Web.com is kicking out a racist web site. How long before it winds up at Epik?

An American news site for white nationalists says it’s been given its goose-stepping orders by Web.com unit Network Solutions, and it’s looking for a new registrar.

VDare, named after Virginia Dare, a semi-mythological American folk hero, has been publishing anti-immigration material on vdare.com under NetSol’s wing for 20 years, but the site claims the registrar has given it 10 days, until June 25, to GTFO.

According to the site, NetSol told VDare that it was in violation of its acceptable use policy and “we consider your continued use of our services a serious issue and risk to our business and corporate reputation”.

That seems plausible, given how corporate America is currently bending over backwards to prove that they support the Black Lives Matter movement.

The move seems to have come due to pressure from the Lawyers’ Committee for Civil Rights Under Law, a campaigning group that persuaded NetSol to dump racist forum Stormfront as a customer a few years ago (it found its new home at Tucows).

The Committee has reportedly written to NetSol twice recently, urging the company to cut Vdare loose.

Vdare says it’s looking for a new registrar, but has also obtained a .onion domain in case it needs to retreat to the “Dark Web”. The .onion space is only accessible to users of the Tor browser.

Anyone care to place a bet on how long it will be before vdare.com winds up at Epik?

Over 660,000 “coronavirus” domains registered

There have been hundreds of thousands of domains that appear to refer to coronavirus registered since the start of the outbreak, but the domain industry reckons only a tiny portion of them have been used maliciously.

Speaking on a recent webinar, ICANN security specialist Sion Lloyd said that up until the end of May, ICANN had found 662,111 domains that at first glance appeared to be related to the pandemic.

ICANN had cast a wide net, parsing the zone files for all of the gTLDs and a handful of ccTLDs for strings such as “covid”, “corona”, “mask”, “quarantine” and “lockdown” in multiple languages.

But it also searched for homoglyph variants, such as replacing the O in Covid with a 0, and this brought in hundreds of thousands of false positives.

The actual number of domains that appear to refer to the virus and its impact is more like 170,000, Lloyd said.

The word “mask” was more commonly found than “corona”, but less frequently than “covid”.

The research was done as part of ICANN’s attempt to provide registries and registrars with data they could use to mitigate abuse, such as the sale of fake vaccines, fraud or phishing attacks.

But ICANN said that after it ran thousands of daily registrations through various public threat lists, it found a few hundred per day were potentially suspicious. At the peak, roughly 10 per day were considered serious enough to refer to registrars. That’s now down to three or four a day, Lloyd said.

His research was backed up by similar studies, albeit using slightly different methodologies and different-sized nets, by registries and registrars.

Tucows’ Graeme Bunton showed data reflecting that the registrar was seeing about 300 coronavirus-related regs per day at its peak in March.

The company had its compliance team manually check each domain, and found that only 0.5% were being used for clearly malicious purposes. The large majority — around 70% — were parked or not resolving, he said.

Jim Galvin from Afilias said that at the March peak the registry was seeing almost 900 coronavirus domains across its 25 gTLDs every week. That had dropped to under 100 by the end of March.

Brian Cimbolic of Public Interest Registry said that there had been 14,700 total registrations by the end of May, with the early April peak seeing over 500 in a single day.

While all this work is an example of ICANN and the industry getting involved to some extent in content regulation, Tucows’ Bunton said that it was an “exceptional” circumstance that was unsustainable and of limited use.

More data and the webinar recording can be found here.

Should Epik be banned from NamesCon as racism debate spills over into domain industry?

Should GoDaddy-owned domain conference NamesCon ban the controversial registrar Epik from its conferences, after a day in which the domaining fraternity descended into a race row?

The fight kicked off last night when Epik director and noted domain investor Braden Pollock announced he was quitting the board over ideological differences with CEO Rob Monster.

Since @robmonster and I don't share the same ideology it's time he and I part company. I don't agree with the direction of @EpikDotCom so I've decided to resign my Board seat, effective immediately.

— Braden Pollock (@BradenPollock) June 10, 2020

Pollock did not explain his exact reasons for quitting, but the assumption among domainers on Twitter and elsewhere, perhaps due to heightened race awareness during the ongoing Black Lives Matter protests, was that it was race-related.

Pollock’s wife is the civil rights attorney Lisa Bloom, who is currently representing victims of police violence during the BLM protests.

Monster is a conspiracy theorist and Bible-bashing Christian who has been accused over the years of racism, antisemitism, and worse.

Even if Monster is not a racist (and plenty of his associates, even his critics, believe he is not), Epik is certainly friendly to racist registrants.

It caused controversy in March last year by publicly offering to host gab.com, the Twitter clone most often used by right-wing refugees escaping Twitter’s ban hammer.

It also took the domain business of 8chan, a forum site frequented by racists, though it refused to actually host the site.

The registrar is also very popular with domainers, due to its low price and domainer-friendly services.

Before long, Pollock’s tweet had spawned a thread of domainers expressing support for either Pollock or Monster, as well as casually throwing accusations of racism at each other.

Pretty much the same thing was going on over on NamePros and Facebook.

Epik all but confirmed that race was at the center of the disagreement by tweeting out the names of a couple dozen employees, whom I can only assume are not white, with the hashtag #diversity.

Monster himself posted a short video in which he appeared to denounce racism.

The rising tide of polarity is a false construct. Current events are a learning laboratory for all of us. For those with #EyesToSee there is unity in compassion, empowerment and love. #Wisdom pic.twitter.com/SnUjqX61ch

— Rob Monster – CEO Epik.com (@robmonster) June 10, 2020

Later today, Epik posted a screenshot of a Facebook comment by NamesCon CEO Soeren von Varchmin, in which he suggested Epik had been banned from the conference, which the company has previously sponsored.

The tweet tagged both GoDaddy and the US Federal Trade Commission.

Who owns @NamesCon? Post winning Best Registrar 2020, @EpikDotCom is in accelerated growth due to the love for our customers, diversity, innovation & the truth of how we maintain business. These attacks are #anticompetitive and hateful, and far from accurate or deserved. pic.twitter.com/RtC0Ygj5HZ

— Epik.com (@EpikDotCom) June 10, 2020

While the von Varchmin comment is genuine, I’m told that he was speaking in a personal capacity and it’s not current GoDaddy policy to ban Epik.

But should it?