Epik gets acquired again! The plot thickens…

Epik has announced that it has been acquired and has named at least one person responsible for running the troubled registrar, but the new information is unlikely to satisfy critics or quash the conspiracy theories around the company’s new management.

“Registered Agents Inc., the leading registered agent service provider in the United States, has acquired key assets of internet domain registrar Epik,” the company said in a press release this weekend.

Bryce Myrvang, in-house counsel for Registered Agents, is named in the press release, but his position at Epik is not stated. Neither is it stated when the acquisition occurred — whether it was before or after ICANN approved the transfer of disgraced Epik Inc’s accreditation to Epik LLC last week, or after.

Neither the names Registered Agents or Bryce Myrvang are new information. Myrvang had been listed in ICANN’s registrar contact database after the LLC bought the Inc last June, but that changed last month to a job title rather than a named individual.

Because Registered Agents’ entire raison d’être is anonymous company formation and management, Epik’s past and current customers naturally wondered aloud whether it was in fact just a front for company founder Rob Monster, on whose watch the registrar started to descend into financial controversy, or somebody else with an interest in keeping their name secret.

But last week Epik and ICANN simultaneously announced that ICANN had completed its due diligence on the new company and found it completely independent of its former owners and leadership.

“Epik, LLC is a recently formed entity that is completely independent of Epik, Inc., its leadership, and shareholders,” ICANN told us.

“No previous owners, including Epik Inc founder Rob Monster and late stage CEO Brian Royce, are involved in Epik LLC in any capacity, including ownership interest in the business,” Epik said.

The announcement today that Registered Agents has bought Epik LLC will do little to unmuddy these waters.

For starters, if Myrvang is indeed a lawyer at a company that prides itself on its professionalism and discretion, there’s not a chance in hell he’s in charge of Epik’s Twitter account, which went a bit crazy last month.

There are undoubtedly synergies between a firm that deals in anonymous company formations — reportedly sometimes for dodgy clients — and a registrar that specialized in controversial anchor tenants.

But Epik is now confirming that it’s done a full U-turn on its strategy to court and welcome some of the web’s most distasteful sites and is now positioning itself as a regular workaday registrar with a focus on small businesses and entrepreneurs.

“Since the acquisition, and throughout the ICANN accreditation transfer review, Epik updated its terms of service and worked aggressively to rid its platform of violators. Having removed a handful of problematic clients, Epik can focus on rebuilding trust with its small business and entrepreneurial clients,” the company said in its latest press release.

Epik lost hundreds of thousands of domains under management last year, after a financial mismanagement scandal caused customers to lose confidence and flee in droves.

Epik to reveal its owners soon

The new Epik registrar has been asked to reveal the identities of its officers and owners shortly, I’ve learned.

The company last night revealed that it had passed through ICANN’s due diligence process, over six months after Epik LLC bought the assets of Epik Inc following a long financial mismanagement scandal, allowing it to take over its corporate predecessor’s accreditation.

Epik said the ICANN process had confirmed that Epik Inc founder Rob Monster and final CEO Brian Royce were not involved in Epik LLC in any way, but the company did not reveal who the owners or managers of the new company are.

I asked ICANN whether this was kosher under the Registrar Accreditation Agreement, which obliges all registrars to publish the names and positions of their officers, as well as the names of any ultimate parent entity, on their web sites.

“We are reminding them of that obligation and expect it to be addressed shortly,” ICANN vice president Russ Weinstein told us.

Breaches of the RAA can lead to suspension or termination of the contract, but I don’t believe ICANN has ever initiated public Compliance proceedings against a registrar based solely on a relatively minor infraction.

Regardless, it seems that after half a year of mystery, the speculation may very well come to an end soon.

Monster and Royce are NOT involved in Epik?!

Rob Monster and Brian Royce are no longer involved in the management or ownership of the registrar Epik, according to both Epik and ICANN.

Epik announced tonight that ICANN had completed its due diligence on the new company and approved the transfer of Epik Inc’s registrar accreditation to Epik LLC, following an acquisition in June last year.

Not only that, but it added that the two guys in charge of the Inc during its descent into disgrace in late 2022 and early 2023 are no longer involved with the company.

“No previous owners, including Epik Inc founder Rob Monster and late stage CEO Brian Royce, are involved in Epik LLC in any capacity, including ownership interest in the business,” Epik said (emphasis in original).

I’ve received a confirmation from ICANN. Vice president Russ Weinstein said in a statement:

ICANN has completed its thorough review of the assignment request and of the Assignee, and has determined that the new entity (Epik, LLC) meets the established registrar criteria. Epik, LLC is a recently formed entity that is completely independent of Epik, Inc., its leadership, and shareholders.

ICANN has updated its registrar records to remove the name of Bryce Myrvang as Epik’s primary contact to the generic “Domain Support”. Its phone number has changed from one in Idaho to one in Austin, Texas. Its email address has also changed.

Myrvang, who appeared in ICANN records following the June acquisition, works for a company called Registered Agents Inc, which specializes in anonymous company formations. It was not clear before whether Registered Agents had bought Epik LLC or was just a proxy to hide the true owner.

There had been speculation online that Epik founder Monster or subsequent CEO Royce might have been still secretly controlling Epik, exacerbated last week when the person in charge of Epik’s Twitter account appeared to go nuts, in keeping with both former CEOs’ previous social media behavior.

Who is running Epik, and who owns it, is currently unknown.

Epik fell from grace in late 2022 after a financial mismanagement scandal that saw it withhold money from domain buyers for months. It lost hundreds of thousands of domains as a result.

Freenom’s domains land at Gandi after termination

French registrar Gandi will be the beneficiary of Freenom’s ignominious collapse last year, it has emerged.

ICANN records updated today show that Freenom’s gTLD domains will be transferred to Gandi following the termination of Freenom’s Registrar Accreditation Agreement last November.

Freenom, legally OpenTLD, had been ignoring customers transfer and renewal requests, leading to domains being lost, according to ICANN Compliance, which flicked the off switch after three rapid-fire breach notices.

Freenom had just 14,546 gTLD domains under management at the end of September, mostly in .com and .net, down quite a lot from its October 2019 peak of 44,774.

The domains are being moved under ICANN’s De-Accredited Registrar Transition Procedure, which does not apply to any domains registered in any of the ccTLDs Freenom was managing under its much-abused free-to-register model, notably Tokelau’s .tk.

Freenom has not been accepting new registrations in any of these ccTLDs for over a year. It has reportedly lost its contracts to run .ml, .ga, .cf, .gq and .tk is looking for the exit.

Has Epik gone “woke”?

The epic saga of disgraced registrar Epik has taken a weird twist this week, with the company appearing to do a 180 on its longstanding devotion to “free speech”, going on a Twitter rampage, sarcastically embracing “wokeness”, and ejecting one of its most controversial anchor tenants, which is now threatening to sue.

On the face of it, it seems quite possible that the company’s official Twitter account may have been compromised. So take any quotes here from @EpikLLC with a pinch of salt. There’s also a non-zero chance that the account has shared child sexual abuse material this evening, so be careful.

The current chapter of the story appears to begin in mid-December, when the owner of the web forum KiwiFarms.net — which Wikipedia says “facilitates the discussion and harassment of online figures and communities” — claimed that Epik suspended his domain for an unspecified terms of service violation.

The domain seems to have moved to Namecheap a couple of days later, where it still sits today.

A month of online drama later, earlier today the person running Epik’s Twitter account either changed, or lost their mind. This was posted this morning as the company’s pinned tweet:

Alright all Whiny, Beta Snowflakes. Our DEI hires of the month cancelled #Kiwifarms @XJosh sorry. We don't like hate speech, porn, or doxxing. #JoeBiden will fix it! 2024! @EndWokeness

— Epik LLC (@EpikLLC) January 23, 2024

DEI stands for “Diversity, Equity and Inclusion” a workplace buzzword in some parts of the world, loved by some on the political left, hated by some on the right. @XJosh is KiwiFarms.net owner Josh Moon.

The content of the @EpikLLC tweet and the @EndWokeness mention suggests sarcasm. Epik has been known for the last several years for being a relatively safe home for some of the web’s most controversial content — typically sites for those with hard-right views.

After a series of tweets along the same lines, the @EpikLLC account reappeared this evening to post a screen grab apparently of a KiwiFarms.net page. The image in the tweet contained censored personal details and blurred photos of a naked male.

I won’t post the full tweet containing the image here, but the accompanying tweet text reads: “Here’s the complaint received that violated our TOS for doxxing. We believed this to be underage porn also. Regardless, Epik doesn’t want to do business with websites like this. If we misread this we apologize. Did we make the right choice in cancelling KF?”

Other Twitter users immediately pointed out that the Epik account had just shared an image it “believed to be underage porn”. Others said that the image showed a 19-year-old man rather than a child.

Moon, who goes by the handle “Null” on his web site, is currently asking his users whether they would be willing to crowd-fund a defamation lawsuit against Epik for claiming on Twitter that law enforcement had ordered the suspension of the domain and that the site hosted “child porn”. He says both claims are false.

KiwiFarms.net moved to Epik in September 2022 after its previous registrar, Cloudflare, kicked it out citing an “an imminent and emergency threat to human life” believed to relate to the targeting of a transgender Twitch streamer.

It’s not currently clear who owns or manages Epik. After a financial mismanagement scandal lasting many months, the company said last June that it had changed ownership. Contact details published by ICANN show it “belongs” to a company called Registered Agents Inc, which specializes in anonymous company formations.

ICANN said in June that it was doing due diligence on the new owners, but that the process could take several months.

Amazon planning new push into registrar market?

Amazon has kept a pretty low profile to date both as a registry and registrar, but there are reasons to believe it’s on the verge of becoming a more visible player in the market.

The e-commerce and web services giant has secured a second ICANN registrar accreditation and appears to be readying a new domain-focused web site.

The subsidiary Amazon Domain Registrar US LLC picked up its accreditation this week, and its official web site domain is domains.amazon, which was registered November 29.

The domain does not currently resolve from where I’m sitting.

Amazon already uses the dot-brand domain registry.amazon for its 50-odd new gTLDs, almost all of which remain unlaunched.

In the registrar market, Amazon’s subsidiary Amazon Registrar Inc has been accredited for well over a decade and has been taking registrations since 2015 as part of its Route 53 managed DNS service.

It’s not a conventional registrar storefront by any stretch — registrations seem to be available only via the management console used by existing Route 53 customers — but it has amassed over 1.3 million gTLD registrations so far.

So could domains.amazon become the newest player in the retail registrar market? Smaller registrars that cheered the exit of the Google brand from the registrar space may soon have a new big boy to contend with.

Registries and registrars vote ‘Yes’ to new DNS abuse rules

ICANN’s contracted registries and registrars have voted to accept new rules requiring them to take action on DNS abuse.

The new rules come after a vote lasting a few months with some quite high thresholds for success.

The current Registrar Accreditation Agreement merely requires registrars to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse”, which is pretty vague and barely enforceable.

The amendments, which still need to be rubber-stamped by the ICANN board, make it much clearer what registrars are expected to do in which circumstances. A new paragraph is added that reads:

3.18.2 When Registrar has actionable evidence that a Registered Name sponsored by Registrar is being used for DNS Abuse, Registrar must promptly take the appropriate mitigation action(s) that are reasonably necessary to stop, or otherwise disrupt, the Registered Name from being used for DNS Abuse. Action(s) may vary depending on the circumstances, taking into account the cause and severity of the harm from the DNS Abuse and the possibility of associated collateral damage.

For registries, the new text for the base gTLD Registry Agreement is similar, but with a little more wiggle-room:

Where a Registry Operator reasonably determines, based on actionable evidence, that a registered domain name in the TLD is being used for DNS Abuse, Registry Operator must promptly take the appropriate mitigation action(s) that are reasonably necessary to contribute to stopping, or otherwise disrupting, the domain name from being used for DNS Abuse. Such action(s) shall, at a minimum, include: (i)the referral of the domains being used for the DNS Abuse, along with relevant evidence, to the sponsoring registrar; or (ii) the taking of direct action, by the Registry Operator, where the Registry Operator deems appropriate. Action(s) may vary depending on the circumstances of each case, taking into account the severity of the harm from the DNS Abuse and the possibility of associated collateral damage.

In both cases, DNS abuse is defined by the now industry standard line: “malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse listed in this Section)”.

There are a few other quality of life updates, such as the requirement for registrars to acknowledge receipt of abuse reports and to have their abuse reporting mechanism “conspicuously and readily accessible from” their home pages.

ICANN needed registrars representing over 90% of registered gTLD domains (adjusted slightly to make GoDaddy’s voice less powerful). That threshold was passed last week, with 94% of domains voting in favor of the amendments.

For registries, ICANN required a simple majority of registries (counted by contract rather than company) and for all registries voting in favor to have been responsible for two thirds of all registry fees paid last year.

Judging by the financial thresholds, .com and .net, which are not on the base RA, were not involved.

Fast-growing Gname buys another 150 registrars

Gname, the fast-growing Singaporean registrar, has added 150 ICANN registrar accreditations to its drop-catching army.

The companies are named Gname 151 through Gname 300. The companies Gname 2 through Gname 150 were accredited in June 2021.

Gname’s primary accreditation has grown massively since it became a drop-catcher in the last two years, going from under 10,000 names under management at the start of 2021 to 3.9 million at the end of August this year. About 3.2 million of its names were in .com.

Its first 150 secondary accreditations had almost a million names between them.

In August, it was the fastest-growing registrar of gTLD names, growing by over 156,000 domains and becoming the 12th-largest registrar accreditation overall.

Drop-catchers use large numbers of accreditations because registries rate-limit their connections. More accreditations means more connections and a better chance to register a valuable domain when it drops.

The primary accreditation was originally Chinese, in the name of Beijing Huaqi Weiye Technology Co and doing business at iwanshang.cn, before it moved to a Singaporean company called Gname.com.

ICANN’s current budget predicts an increase of five accrediations in fiscal 2024, which ends next June. Its high estimate was an increase of 60. So it’s now getting about half a million bucks more than it was expecting.

ICANN’s private Whois data request service goes live

ICANN has this evening gone live with its service that enables anyone to request private Whois data on any gTLD domain.

The Registration Data Request Service lets people request contact information on registrants that would otherwise be redacted in the public Whois due to laws such as the GDPR.

The press release announcing the launch seems to have come out an hour or two before the service actually became accessible, but it’s definitely live now and I’ve tried it out.

The system is defined largely by what it isn’t. It isn’t an automated way to get access to private data. It isn’t guaranteed to result in private data being released. It isn’t an easy workaround to post-GDPR privacy restrictions.

It is a way to request an unredacted Whois record knowing only the domain and not having to faff around figuring out who the registrar is and what their mechanisms and policies are for requesting the data.

After scaling back the extremely complex and expensive original community recommendations for a post-GDPR Whois service, ICANN based the RDRS on its now decade-old Centralized Zone Data Service, which acts as an intermediary between registries and people like myself who enjoy sniffing around in zone files.

The RDRS merely connects Whois data requestors — the default settings in the interface suggest that ICANN thinks they’ll mostly be people with court orders — with the registrars in charge of the domains they are interested in.

Anyone who has used CZDS will recognize the interface, but the requesting process is longer, more complex, and requires accepting more disclaimers and Ts&Cs. That said, it’s not particularly confusing.

At first glance, it looks fine. Slick, even. I’ve used it to submit a test request with GoDaddy for my own Whois data, specifying that whoever deals with the request is free to ignore it. Let’s see what happens.

A registrar is getting blamed for an Israeli war propaganda site

Israel-based registrar Wix is being blamed for a gory anti-Hamas web site being promoted by Israeli government officials.

A number of recent media reports — notably including this one by usually reliable news wire UPI — have said that Wix is behind the incredibly NSFW web site at hamas.com.

The site is a dark parody of a Hamas fund-raising page, containing disturbing footage of the group’s October 7 atrocities — dead bodies, terrorists taking hostages, shooting dogs and burning homes.

So I imagine Wix would be disturbed to learn it is being credited as the creator of the site, apparently purely because the domain was registered via its registrar and hosted on its hosting service.

“The Israeli software company Wix has created a website to spread anti-Hamas propaganda amid the war in Gaza,” UPI reported, sourcing a GoDaddy Whois lookup that lists Wix as the registrar but shows no registrant information.

A Whois lookup on Wix itself, which should contain information beyond the registry record supplied by GoDaddy, does not reveal any additional information — not even redacted fields — about the registrant.

Hamas usually uses hamas.ps for its web site, but it’s currently down reportedly due to cyber-attacks by pro-Israel hacktivists.

hamas.com has been parked for years by what UPI uncharitably refers to as “cybersquatters”.