Over 750 domains hijacked in attack on Gandi

Gandi saw 751 domains belonging to its customers hijacked and redirected to malware delivery sites, the French registrar reported earlier this month.
The attack saw the perpetrators obtain Gandi’s password for a gateway provider, which it did not name, that acts as an intermediary to 34 ccTLD registries including .ch, .se and .es.
The registrar suspects that the password was obtained by the attacker exploiting the fact that the gateway provider does not enforce HTTPS on its login pages.
During the incident, the name servers for up up to 751 domains were altered such that they directed visitors to sites designed to compromise unpatched computers.
The redirects started at 0804 UTC July 7, and while Gandi’s geeks had reversed the changes by 1615 it was several more hours before the changes propagated throughout the DNS for all affected domains.
About the theft of its password, Gandi wrote:

These credentials were likewise not obtained by a breach of our systems and we strongly suspect they were obtained from an insecure connection to our technical partner’s web portal (the web platform in question allows access via http).

It’s not clear why a phishing attack, which would seem the more obvious way to obtain a password, was ruled out.
Gandi posted a detailed timeline here, while Swiss registry Switch also posted an incident report from its perspective here. An effected customer, which just happened to be a security researcher, posted his account here.
Gandi says it manages over 2.1 million domains across 730 TLDs.

ICANN expects to lose 750 registrars in the next year

ICANN is predicting that about 750 accredited registrars will close over the next 12 months due to the over-saturation of the drop-catching market.
ICANN VP Cyrus Namazi made the estimate while explaining ICANN’s fiscal 2018 budget, which is where the projection originated, at the organization’s public meeting in South Africa last week.
He said that ICANN ended its fiscal 2017 last week with 2,989 accredited registrars, but that ICANN expects to lose about 250 per quarter starting from October until this time next year.
These almost 3,000 registrars belong to about 400 registrar families, he said.
By my estimate, roughly two thirds of the registrars are shell accreditations under the ownership of just three companies — Web.com (Namejet and SnapNames), Pheenix, and TurnCommerce (DropCatch.com).
These companies lay out millions of dollars on accreditation fees in order to game ICANN rules and get more connections to registries — mainly Verisign’s .com.
More connections gives them a greater chance of quickly registering potentially valuable domains milliseconds after they are deleted. Drop-catching, in other words.
But Namazi indicated that ICANN’s cautious “best estimate” is that there’s not enough good stuff dropping to justify the number of accreditations these three companies own.
“With the model we have, I believe at the moment the total available market for these sought-after domains that these multifamily registrars are after is not able to withstand the thousands of accreditations that are there,” he said. “Each accreditation costs quite a bit of money.”
Having a registrar accreditation costs $4,000 a year, not including ICANN’s variable and transaction fees.
“We think the market has probably gone beyond what the available market is,” he said.
He cautioned that the situation was “fluid” and that ICANN was keeping an eye on it because these accreditations fees have become material to its budget in the last few years.
If the three drop-catchers do start dumping registrars, it would reveal an extremely short shelf life for their accreditations.
Pheenix upped its registrar count by 300 and DropCatch added 500 to its already huge stable as recently as December 2016.

GoDaddy launches security service after Sucuri acquisition

GoDaddy has revealed the first fruits of its March acquisition of web security service provider Sucuri.
It’s GoDaddy Website Security, what appears to be a budget version of the services Sucuri already offers on a standalone basis.
For $6.99 per month ($83.88/year), the service monitors your web site for malware and removes it upon request. It also keeps tabs on major blacklists to make sure you’re not being blocked by Google, Norton or McAfee.
This low-end offering gets you a 12-hour response time for the cleanup component. You can up that to 30 minutes by taking out the $299.99 per year plan.
The more expensive plan also includes DDoS protection, a malware firewall and integration with a content delivery network for performance.
There’s also an intermediate, $19.99-per-month ($239.88/year) plan that includes the extra features but keeps the response time at 12 hours.
An SSL certificate is included in the two more-expensive packages.
The pricing and feature set looks to compare reasonably well with Sucuri’s standalone products, which start at $16.66 a month and offer response times as fast as four hours.
As somebody who has suffered from three major security problems on GoDaddy over the last decade or so, and found GoDaddy’s response abysmal on all three occasions (despite my generally positive views of its customer service), the new service is a somewhat tempting proposition.

Zero registrars pass ICANN audit

Some of the biggest names in the registrar game were among a bewildering 100% that failed an ICANN first-pass audit in the latest round of random compliance checks.
Of the 55 registrars picked to participate in the audit, a resounding 0 passed the initial audit, according to data released today.
Among them were recognizable names including Tucows, Register.com, 1&1, Google and Xin Net.
ICANN found 86% of the registrars had three or more “deficiencies” in their compliance with the 2013 Registrar Accreditation Agreement.
By far the most problematic area was compliance with sections 3.7.7.1 to 3.7.7.12 of the RAA, which specifies what terms registrars must put in their registration agreements and how they verify the contact details of their customers.
A full three quarters of audited registrars failed on that count, according to ICANN’s report (pdf).
More than half of tested registrars failed to live up to their commitments to respond to reports of abuse, where they’re obliged among other things to have a 24/7 contact number available.
There was one breach notice to a registrar as a result of the audit, but none of the failures were serious enough for ICANN to terminate the deficient registrar’s contract. Two registrars self-terminated during the process.
ICANN’s audit program is ongoing and operates in rounds.
In the current round, registrars were selected from those which either hadn’t had an audit in a couple of years, were found lacking in previous rounds, or had veered dangerously close to formal breach notices.
The round kicked off last September with requests for documents. The initial audit, which all registrars failed, was followed by a remediation phase from January to May.
Over the remediation phase, only one third of the registrars successfully resolved all the issues highlight by the audit. The remainder issued remediation plans and will be followed up on in future rounds.
The 0% pass rate is not unprecedented. It’s the same as the immediately prior audit (pdf), which ran from May to October 2016.

Web.com in takeover talks – report

Web.com is in talks to be acquired by private equity firms, according to a report.
Reuters reported last night that the registrar said the talks were “early stage” and that there was no guarantee of a deal.
Web.com is of course home to Network Solutions, Register.com and is involved in secondary market plays SnapNames and NameJet.
The company had 2016 revenue of $710 million and a market capitalization prior to the report of $1.1 billion. Its shares surged on the news.

After price hike, now Tucows drops support for Uniregistry TLDs

Tucows is to drop OpenSRS support for nine Uniregistry gTLDs after the registry announced severe price increases.
The registrar told OpenSRS resellers that it will no longer support .audio, .juegos, .diet, .hiphop, .flowers, .guitars, .hosting, .property and .blackfriday from September 8, the date the increases kick in.
It’s the second major registrar, after GoDaddy, to drop support for Uniregistry TLDs in the wake of the pricing news.
“The decision to discontinue support for these select TLDs was made to protect you and your customers from unknowingly overpaying in a price range well beyond $100 per year,” OpenSRS told its resellers.
It will continue to support seven other Uniregistry gTLDs, including .click and .link, which are seeing more modest price increases and will remain at $50 and under.
While Tucows is a top 10 registrar in most affected TLDs, its domains under management across the nine appears to be under 3,000.
These domains will expire at their scheduled expiry date and OpenSRS will not allow their renewal after the September 8 cut-off. Customers will be able to renew at current prices for one to 10 years, however.
Tucows encouraged its roughly 40,000 resellers to offer to migrate their customers to other TLDs.
Uniregistry revealed its price increases in March, saying moving to a premium-pricing model was necessary to make the gTLDs profitable given the lack of volume.
Pricing for .juegos and .hosting is to go up from under $20 retail to $300. The other seven affected gTLDs will increase from the $10 to $25 range to $100 per year.
After GoDaddy pulled support for Uniregistry TLDs, the registry modified its plan to enable all existing registrations to renew at current prices.
That clearly was not enough for Tucows, which has sent a pretty clear message that it’s not prepared to be the public face of such significant price hikes.

MarkMonitor tells .feedback to take a hike after “breach” claim

MarkMonitor is to voluntarily terminate its registrar relationship with Top Level Spectrum after the .feedback registry hit it with a breach of contract notice.
Troy Fuhriman, director of domain management at the registrar, told DI today that the company has just sent TLS a letter stating that it no longer wishes to sell .feedback names.
TLS earlier this month accused MarkMonitor of breaking the terms of its Registry-Registrar Agreements by leaking details of that agreement to media outlets including yours truly.
While TLS CEO Jay Westerdal told DI that an apology from MarkMonitor would be enough to make the termination threat go away, MarkMonitor has clearly decided against that route.
“We’re going to terminate all accreditation agreements for .feedback,” he said. “In part it’s a response to ICANN’s finding that Top Level Spectrum violated its Pubic Interest Commitments, and what we believe is a retaliatory breach notification from them.”
MarkMonitor and a small posse of high-profile clients including Facebook recently won a Public Interest Commitment Dispute Resolution Policy complaint against .feedback, related to the transparency of its launch policies and pricing.
It was in that complaint that MarkMonitor released details contained in the RRA that TLS deemed to be confidential.
Terminating the agreement means that MarkMonitor will no longer be able to sell .feedback names as a registrar and will have to transfer its existing registrations to a different registrar.
Not many clients are affected. MarkMonitor had only 45 .feedback domains under management at the last count (which was still enough to make it the fourth-largest independent .feedback registrar).
Most of these domains will be moved to 101domain, which with fewer than 200 domains is still the leading .feedback registrar.
UPDATE: Westerdal says that MarkMonitor was in fact terminated on Monday. Neither party claims that MarkMonitor made any effort to comply with the breach notice by apologizing.

Pirate Bay founder launches piracy-friendly domain privacy service

The founder of controversial BitTorrent search engine The Pirate Bay has entered the domain name market with a new proxy service.
It’s called Njalla, it’s based in a Caribbean tax haven, and it says it offers a higher level of privacy protection than you get anywhere else.
The company described itself in its inaugural blog post today like this:

Think of us as your friendly drunk (but responsibly so) straw person that takes the blame for your expressions. As long as you keep within the boundaries of reasonable law and you’re not a right-wing extremist, we’re for promoting your freedom of speech, your political weird thinking, your kinky forums and whatever.

Founder Peter Sunde was reluctant to describe Njalla as a proxy registration service, but it’s difficult to think of another way of describing it.
When you buy a domain via the company’s web site, the name is registered by Njalla for itself. You can still use the domain as you would with a regular registrar, but the name is “owned” by Njalla (1337 LLC, based in Saint Kitts & Nevis).
The company is a Tucows reseller via OpenSRS, and it supports almost all gTLDs and several ccTLDs (it’s declined to support Uniregistry due to recent price increase announcements).
Prices are rather industry standard, with a .com setting you back €15 ($16).
The big difference appears to be that the service doesn’t want to know anything about its registrants. You can sign up with just an email address or, unusually, an XMPP address. It doesn’t want to know your name, home address, or anything like that.
This means that whenever Njalla receives a legal request for the user’s identity, it doesn’t have much to hand over.
It’s based on Nevis due to the strong privacy laws there, Sunde said.
Under what circumstances Njalla would suspend service to a customer and hand over their scant private information appears to be somewhat vague and based on the subjective judgement or politics of its management.
“As long as you don’t hurt anyone else, we’ll let you do your thing,” Sunde said.
Child abuse material is verboten. Spam is in a “gray zone” (although forbidden by Njalla’s terms of service).
Copyright infringement appears to be just fine and dandy, which might not be surprising. Sunde founded The Pirate Bay in 2003 and spent time in prison in Sweden for assisting copyright infringement as a result.
“You don’t hurt people by putting a movie online,” Sunde said. “You do hurt someone by putting child porn or revenge porn or stuff like that… If you look at any statistics on file sharing, it proves that the more people file-share the more money goes into the ecosystem of the media.”
While this is likely to upset the IP lobby within the domain name community, I think there’s a possibility that existing ICANN policy will soon have an impact on Njalla’s ability to operate as it hopes.
ICANN is in the process of implementing a privacy/proxy services accreditation program that will require registrars to only work with approved, accredited proxy services.
Sunde thinks Njalla doesn’t fall into the ICANN definition of a proxy service, and said his lawyers agree.
Personally, I can’t see the distinction. I expect ICANN Compliance will probably have to make a call one way or the other one day after the accreditation system comes online.

GoDaddy sold over $1 billion of domains in 2016

GoDaddy’s domain sales topped $1 billion for the first time last year, CEO Blake Irving told analysts this week.
The milestone was revealed as the registrar reported its fourth-quarter and full-year 2016 earnings late Wednesday.
In the fourth quarter, the company had a net loss of $800,000, compared to a year-ago loss of $500,000, on revenue that was up 14.2% at $485.9 million.
For the year, its loss was $21.9 million, compared to $120.4 million in 2015, on revenue that was up 15% at $1.85 billion.
GoDaddy also breaks out its revenue by segment, showing that domains revenue was up 11.2% at $242.5 million for the fourth quarter and up 11% at $927.8 million for the year.
Domain “bookings” — a somewhat informal measure that gives an indication of cash sales from domain names (as opposed to revenue under GAAP accounting) — surpassed $1 billion for the first time, Irving said.

Tucows says eNom may be shrinking as Melbourne IT drives 2016 growth

Tucows yesterday reported an 11% increase in revenue for 2016, driven partly by an acquisition, but warned that its more recent acquisition, eNom, may be shrinking.
The company reported revenue for 2016 of $189.8 million, up from $171 million in 2015. Net income was up 41% at $16 million.
For the fourth quarter, revenue was up 9% year-on-year at $48.8 million. Net income was down 9% at $2.8 million.
In a conference call, executives linked some of the growth to the April 2016 acquisition of Melbourne IT’s reseller business, which added 1.6 million domains to Tucows’ DUM.
While Tucows also operates its Ting mobile phone service, the majority of its revenue still comes from domains and related services.
In the fourth quarter, revenue was $30 million for this segment. Of that, $23.1 million came from domains sold via its wholesale network and $3.8 million came from Hover, its retail channel.
CEO Elliot Noss noted that the acquisition of the eNom wholesale registrar business from Rightside last month made Tucows easily the second-largest registrar after GoDaddy, but made eNom sound like a neglected business.
“The eNom business is a flat, potentially even slightly negative-growth business in terms of gross margin dollars,” he told analysts.
eNom’s channel skews more towards European and North American web hosting companies, which are a growth challenge, he said. He added:

We acquired a mature retail business and associated customers which for the past few years has been more about maintaining and servicing eNom’s existing customers as opposed to growth. It has not been actively promoted and as a result has a flat to declining trajectory. It’s something we don’t intend to change in the short-term, but as we look under the hood and get a better sense of the platform as we will with all of the operations, the long-term plan might be different.

The acquisition was “overwhelmingly about generating scale and realizing cost efficiencies”, Noss said.
Tucows paid $83.5 million for eNom, which has about $155 million in annual revenue and is expected to generate about $20 million in EBITDA per year after efficiencies are realized.