Cloudflare “bug” reveals hundreds of secret domain prices

The secret wholesale prices for hundreds of TLDs have been leaked, due to an alleged “bug” at a registrar.
The registry fees for some 259 TLDs, including those managed by Donuts, Verisign and Afilias, are currently publicly available online, after a programmer used what they called a “bug” in Cloudflare’s API to scrape together price lists without actually buying anything.
Cloudflare famously busted into the domain registrar market last September by announcing that it would sell domains at cost, thumbing its nose at other registrars by suggesting that all they’re doing is “pinging an API”.
But because most TLD registries have confidentiality clauses in their Registry-Registrar Agreements, accredited registrars are not actually allowed to reveal the wholesale prices.
That’s kind of a problem if you’re a registrar that has announced that you will never charge a markup, ever.
Cloudflare has tried to get around this by not listing its prices publicly.
Currently, it does not sell new registrations, instead only accepting inbound transfers from other registrars. Registry transaction reports reveal that it has had tens of thousands of names transferred in, but has not created a significant number of new domains.
(As an aside, it’s difficult to see how it could ever sell a new reg without first revealing its price and therefore breaking its NDAs.).
It appears that the only way to manually ascertain the wholesale prices of all of the TLDs it supports would be to buy one of each at a different registrar, then transfer them to Cloudflare, thereby revealing the “at cost” price.
This would cost over $9,500, at Cloudflare’s prices, and it’s difficult to see what the ROI would be.
However, one enterprising individual discovered via the Cloudflare API that the registrar was not actually checking whether they owned a domain before revealing its price.
They were therefore able to compile a list of Cloudflare’s prices and therefore the wholesale prices registries charge.
The list, and the script used to compile it, are both currently available on code repository Github.
The bulk of the list comprises Donuts’ vast portfolio, but most TLDs belonging to Afilias (including the ccTLD .io), XYZ.com and Radix are also on there.
It’s not possible for me to verify that all of the prices are correct, but the ones that are comparable to already public information (such as .com and .net) match, and the rest are all in the ballpark of what I’ve always assumed or have been privately told they were.
The data was last refreshed in April, so without updates its shelf life is likely limited. Donuts, for example, is introducing price increases across most of its portfolio this year.

CentralNic boosts reseller biz with $11.3 million Hexonet buy

CentralNic is to acquire rival reseller-based registrar Hexonet for up to €10 million ($11.3 million), its fourth acquisition in the last 12 months.
Hexonet has over 3.8 million domains under management, according to CentralNic, sold either directly or via one of its over 1,000 resellers.
Hexonet’s primary ICANN accreditation, 1API.net, was responsible for roughly 760,000 gTLD domains at the last count, but appeared to be on the decline.
CentralNic said its reseller business will grow by about 28% in terms of domains due to the deal.
Hexonet had revenue last year of about €16.5 million ($19.4 million) and EBIDTDA of about €0.8 million ($0.9 million), and will immediately contribute to the bottom line, CentralNic said.
But it’s probably not great news for everyone — in order to receive the full €10 million Hexonet had to slash €300,000 from its budget.
CentralNic is paying €7 million in cash now, covered by the €50 million bond it recently issued, and will pay another €3 million in either cash or shares (its choice) on the one-year anniversary of the deal closing, expected this month.
Hexonet has offices in Canada and close to CentralNic’s recently acquired Germany operations.
Hexonet also acts as the de facto exclusive registrar for a handful of dot-brands, including .audi, .volskwagen and .bugatti, relationships that one imagines CentralNic’s registry back-end business could try to leverage.
In the last year, CentralNic has acquired KeyDrive, TPP Wholesale and GlobeHosting.

New gTLD registry is latest billion-dollar unicorn

A new gTLD registry that used a different new gTLD for its original web site has merged to form a new company valued at a billion dollars using a new brand in a third new gTLD.
Combell Group announced this week that it has merged with TransIP Group, and that its combined valuation is over $1 billion.
They’re both European hosting companies. Together, they say that have 1.2 million customers and 600 employees.
The newly merged entity is called team.blue — that’s its brand and, using an Afilias-operated gTLD, its new primary domain.
As a privately held company with a billion-dollar valuation, it joins a list of companies called “unicorns”. For some reason.
Combell and TransIP both have domain registrar businesses and play primarily into the Scandinavian and Benelux regions of Europe.
Combell, which has its corporate site at combell.group, owns Danish registrar DanDomain, which was ICANN-accredited with about 20,000 domains under management until it allowed its accreditation to lapse at the start of the year.
TransIP, which was using a .eu domain, is ICANN-accredited, but has no gTLD domains to its name.
Curiously, the two registrars have sequential IANA IDs — 1603 and 1604.
Combell is also the registry for .gent, the new gTLD for the Belgian city of Ghent.

India’s largest registrar goes insolvent, gets suspended

India’s largest independent registrar has been found insolvent by a local court, after failing to pay back $28 million in bank loans.
Net 4 India has now also had its right to sell gTLD domains suspended by ICANN as a result.
Judging by legal papers (pdf) buried on Net4’s web site, the insolvency relates to a series of loans the company took out with the State Bank of India between 2002 and 2012.
After the company failed to pay those loans back, in 2014 the debt was acquired from SBI by Edelweiss Asset Reconstruction, which specializes in buying debt cheap then recovering it through the courts.
Edelweiss sued Net4 to get its money back a couple of years ago and, in March this year after what appears to have been a slam-dunk, won its case.
The ruling states that the outstanding debt in 2017 was almost two billion rupees — Rs 1,940,860,284, which works out to just short of $28 million at today’s rates.
Having learned about the insolvency in April, ICANN set about trying to contact Net4’s management to see if the company was coming back into compliance.
ICANN’s Registrar Accreditation Agreement says ICANN can terminate registrars’ contracts if they are in insolvency proceedings for more than 30 days.
After the company failed to show it was compliant, this week its RAA was suspended from June 21 to September 19.
During that period, Net4 will not be able to sell new domain registrations or accept incoming transfers. It will also have to display a notice on its web site to that effect.
If it has not demonstrated compliance by August 28, ICANN may start its termination process.
Net4 is the largest ICANN-accredited registrar based in India, as measured by number of registered gTLD domains (excluding Public Domain Registry, LogicBoxes, and several affiliated dummy accreditations, which are all owned by US-based Endurance International).
It had over 100,000 gTLD domains under management at the end of February — almost all in .com and other legacy gTLDs — but its DUM had been shrinking hard for many months.
At some point, Net4 appears to have been listed on both India’s National Stock Exchange and the Bombay Stock Exchange, but was delisted about a year ago.

Smaller registrars say .uk release is biased towards the Big Boys

A group of small .uk registrars have complained to Nominet that the imminent release of three million second-level .uk domain names is biased towards their deep-pocketed rivals.
So far, 33 registrars have signed a petition, penned by Netistrar’s Andrew Bennett, against Nominet’s rules.
On July 1, the registry plans to start releasing .uk 2LDs that are currently reserved under its five-year-long grandfathering program.
These are domains that match existing third-level domains in .co.uk, .org.uk, etc.
The 3LD registrants have until 0500 UTC on June 25 to claim their 2LD matches. A week later, Nominet will start releasing them in alphabetical batches of 600,000 per day, over five days, to the available pool.
It’s going to be a little like “the drop” in gTLDs such as .com, with registrars all vying to pick up the most-valuable names as soon as they are released.
In the gTLD space, each registrar is given an equal number of connections, which is why drop-catch specialists such as SnapNames own hundreds of registrar accreditations.
Nominet’s doing it a little different, instead throttling connections based on how much credit registrars have with the registry, which the petitioners believe rigs the system towards the registrars with the most money.
According to the Nominet, registrars with £450 of credit get six connections per minute, rising to nine per minute for those with £4,500, 60 per minute for £45,000 and, at the top end, 150 per minute for registrars with £90,000 stashed in the Bank of Nominet.
Larger registrars with multiple Nominet accreditations, known as “tags” in the .uk space, will be able to stack their connections for an even greater chance at grabbing the best names.
Registrars such as GoDaddy are already taking pre-orders and will auction off the domains they catch to the highest bidder, if there are multiple pre-orders for the same names, so there’s potentially a fair bit of money to be made.
The small registrars say these credit-based rules are “disproportionately unfair” to their business models.
They point out that it doesn’t make much sense to rate-limit connections based on their proven ability to pay, given that there’s no link between how many they plan to register in the crucial first minute after the drop and how many they intend to register overall.
Nominet says on its web site that the tiers as described are provisional and will be firmed up the week of June 24.
The petitioners are also bothered that Nominet has not made any EPP code available to help the smaller guys, which have fewer engineering resources, to adjust to this temporary, time-sensitive registration system, and that the release plan was not communicated well to registrars.
They further claim that Nominet has not conducted enough outreach to .uk registrants to let them know their grandfathered rights will soon expire.
Many well-known brands have yet to claim their trademark.uk names, they claim.
Nominet has previously told DI that it planned to advertise the end of grandfathering in the press and on radio in the run-up to the release.

CentralNic grabs more of the reseller market with $16.5 million acquisition

CentralNic is living up to its self-described role as an industry “consolidator” with the acquisition of Australian domain wholesaler TPP Wholesale.
The company, assuming it manages to find the financial backing, will pay AUD 24 million ($16.5 million) for the business, currently a unit of ARQ Group (formerly known as Melbourne IT).
TPP has 14,000 resellers and 840,000 domains under management, including 19% of all .com.au registrations, according to CentralNic.
The company reckons the unit had revenue of AUD 17 million ($11.7 million) and EBITDA of AUD 3.9 million ($2.7 million) in 2018, which makes the purchase look like a bit of a bargain when compared to its acquisition of Instra a few years ago.

Five more gTLD deadbeats fingered by ICANN

The company that tried unsuccessfully to get the .islam new gTLD has been slammed by ICANN for failing to pay its dues on five different gTLDs.
Asia Green IT System, based in Turkey, has been considered “past due” on its registry fees since at least January, according to an ICANN breach notice sent yesterday.
The company runs .nowruz (Iranian New Year), .pars (refers to Persia/Iran), .shia (a branch of Islam), .tci (a closed dot-brand) and .همراه (.xn--mgbt3dhd, appears to mean something like “comrade” in Persian).
The only one of these to actually launch is .nowruz. It came to market March last year — bizarrely, it didn’t leave sunrise until a week after Nowruz was over — and has scraped just over 40 registrations. It does not appear to have any active web sites.
With little to no revenue, one can imagine why it might have difficulty paying ICANN’s $25,000 annual per-TLD registry fee, which it will have been paying for almost four years before lapsing.
None of its mandatory “nic.example” sites resolve for me today, though its “whois.nic.example” sites can be reached once you click through an SSL security warning.
The primary registry web site for AGIT, agitsys.com, also does not resolve for me.
ICANN’s breach notice claims that it has been unable to contact anyone at the registry, despite many outreach attempts, since January. It believes it has outdated contact data for the company.
AGIT is perhaps best-known to DI readers for its unsuccessful attempts to apply for .islam and .halal.
ICANN rejected these applications last October after an outcry from governments of Muslim-majority nations and the Organization for Islamic Cooperation.
Given AGIT’s apparent difficulties, perhaps that was a good call.
If the registry doesn’t cough up by June 13, ICANN may start termination proceedings.
It’s the 19th published breach notice ICANN has sent to a gTLD registry. In most cases, even the handful of cases that have escalated to termination, the registry has managed to resolve the issue before losing their contracts.
The only gTLD to actually get terminated to date I believe is .wed, which is currently being wound down by Nominet in its role as Emergency Back-End Registry Operator.
The most-recent registry breach notice, filed against .whoswho in January, is still “under review” by ICANN.

Donuts acquires its 242nd gTLD

Donuts, the registry with the largest stable of new gTLDs, has added its 242nd string to its bow.
The company seems to have acquired .contact from, nominally at least, smaller portfolio rival Top Level Spectrum.
The ICANN contract for the gTLD was transferred to one of Donuts’ subsidiaries a couple weeks ago.
According to TLS CEO Jay Westerdal, while TLS was the signatory of the contract the “economic owner” of the TLD was Whitepages.com, an online directory services provider, which paid for the original uncontested .contact application.
Whitepages.com doesn’t appear in the application, the registry agreement, or the IANA records. I was unaware of the connection until today.
Despite being in the root since December 2015, .contact never actually launched. Donuts has not yet filed its launch dates with ICANN either, but it’s usually fairly speedy about pumping out strings.

CentralNic gets 680,000 AlpNames domains for free, kinda

CentralNic has emerged as the gaining registrar for AlpNames’ entire portfolio of gTLD domains.
The company announced late last week that three registrars in its stable — Moniker, Key-Systems LLC and Key-Systems GmbH — will take over roughly 680,000 domains that were left stranded when AlpNames management went AWOL.
US-based Key-Systems LLC appears to be the biggest gainer. It will be taking over domains in every gTLD except .biz, .com, .info, .net, .org, which are going to Moniker, and .pro, which are going to the German Key-Systems division.
While most registrars see their domains under management concentrated in these legacy gTLDs, by volume AlpNames had far more registrations in new 2012-round gTLDs.
It had just 19,000 .com DUM at the last count, compared to hundreds of thousands in new gTLDs such as .top and .gdn.
CentralNic said in a press release that ICANN selected its registrars after a competitive bidding process, which I’ve previously outlined here, but that it did not pay for the names. So AlpNames, presumably, won’t be getting the payday it could have received under the rules.
The transfer won’t be entirely cost-free, of course. CentralNic is going to have to provide support to its incoming customers — who will all be emailed with the details of their new Moniker accounts — for starters.
There’s also the issue of abuse. AlpNames was notorious as a haven for spammers and the like, due to its cheap prices and bulk-registration tools, so CentralNic may find itself having to deal with this legacy.
But CentralNic said it expects these incidental costs to be “minimal”.
The transfers are a big boost for CentralNic’s registrar volume, at least in the short term. The three selected registrars had a combined total of roughly two million gTLD domains at the last count. CentralNic says it acts as registrar for over seven million domains across its 13 accreditations.
For every AlpNames domain that gets renewed, CentralNic gets paid. But if AlpNames’ own track record is any guide, I suspect there’s going to be a lot of drops over the coming year.
UPDATE August 12 2020: AlpNames former CEO Iain Roache recently wrote to DI and stated the following:

Alpnames itself worked closely with ICANN for months to arrange for its exit from the Registrar business and with a number of Registrars to arrange for the transfer of the customers. Your article does not reflect the detail of what transpired and is inaccurate.

NameSilo nets $1.5 million profit

Fast-growing registrar NameSilo yesterday reported its financial results for 2018.
The Canadian company reported revenue of CDN 17.2 million ($13.3 million) for the year, up from CDN 10.4 million ($8.1 million) in 2017.
Net income was CDN 1.92 million ($1.48 million), compared to CDN 565,000 ($435,000).
Bookings were CDN 28.78 million ($21.45 million), up from CDN 14.04 million ($10.81 million) in 2017.
These are the results of NameSilo LLC, the operating registrar subsidiary of the listed entity, NameSilo Technologies Corp, which is listed on the Canadian pink sheets. The former reversed into the latter in August.
NameSilo says it has added 850,000 new domains under management since then, and now has about 2.7 million names.
According to the most-recent registry transaction reports, NameSilo was the second-fastest growing gTLD registrar in November and the 16th-largest by DUM. It ranks higher if you group registrar accreditations into families.