SpamHaus ranks most-botted TLDs and registrars

Namecheap and Uniregistry have emerged as two of the most-abused domain name companies, using statistics on botnet command and control centers released by SpamHaus this week.
SpamHaus data shows that over a quarter of all botnet C&Cs found during the year were using NameCheap as their registrar.
It also shows that almost 1% of domains registered in Uniregistry’s .click are used as C&Cs.
The spam-fighting outfit said it discovered “almost 50,000” domains in 2017 that were registered for the purpose of controlling botnets.
Comparable data for 2016 was not published a year ago, but if you go back a few years, SpamHaus reported that there were just 3,793 such domains in 2014.
Neither number includes compromised domains or free subdomains.
The TLD with the most botnet abuse was of course .com, with 14,218 domains used as C&C servers. It was followed by Directi’s .pw (8,587) and Afilias’ .info (3,707).
When taking into account the relative size of the TLDs, SpamHaus fingered Russian ccTLD .ru as the “most heavily abused” TLD, but its numbers don’t ring true to me.
With 1,370 botnet controllers and about five and a half million domains, .ru’s abused domains would be around 0.03%.
But if you look at .click, with 1,256 botnet C&Cs and 131,000 domains (as of September), that number is very close to 1%. When it comes to botnets, that’s a high number.
In fact, using SpamHaus numbers and September registry reports of total domains under management, it seems that .work, .space, .website, .top, .pro, .biz, .info, .xyz, .bid and .online all have higher levels of botnet abuse than .ru, though in absolute numbers some have fewer abused domains.
In terms of registrars, Namecheap was the runaway loser, with a whopping 11,878 domains used to control botnets.
While SpamHaus acknowledges that the size of the registrar has a bearing on abuse levels, it’s worth noting that GoDaddy — by far the biggest registrar, but well-staffed with over-zealous abuse guys — does not even feature on the top 20 list here.
SpamHaus wrote:

While the total numbers of botnet domains at the registrar might appear large, the registrar does not necessarily support cybercriminals. Registrars simply can’t detect all fraudulent registrations or registrations of domains for criminal use before those domains go live. The “life span” of criminal domains on legitimate, well-run, registrars tends to be quite short.
However, other much smaller registrars that you might never have heard of (like Shinjiru or WebNic) appear on this same list. Several of these registrars have an extremely high proportion of cybercrime domains registered through them. Like ISPs with high numbers of botnet controllers, these registrars usually have no or limited abuse staff, poor abuse detection processes, and some either do not or cannot accept takedown requests except by a legal order from the local government or a local court.

The SpamHaus report, which you can read here, concludes with a call for registries and registrars to take more action to shut down repeat offenders, saying it is “embarrassing” that some registrars allow perpetrators to register domains for abuse over and over and over again.

Namecheap to bring millions of domains in-house next week

Namecheap is finally bringing its customer base over to its own ICANN accreditation.
The registrar will next week accept transfer of an estimated 3.2 million .com and .net domains from Enom, following a court ruling forcing Enom owner Tucows to let go of the names.
The migration will happen from January 8 to January 12, Namecheap said in a blog post today.
Namecheap is one of the largest registrars in the industry, but historically it mostly acted as an Enom reseller. Every domain it sold showed up in official reports as an Enom sale.
While it’s been using its own ICANN accreditation to sell gTLD names since around 2015 — and has around four million names on its own credentials — it still had a substantial portion of its customer base on the Enom ticker.
After the two companies’ arrangement came to an end, and Enom was acquired by Tucows, Namecheap decided to also consolidate its .com/.net names under its own accreditation.
After Tucows balked at a bulk transfer, Namecheap sued, and a court ruled in December that Tucows must consent to the transfer.
Now, Namecheap says all .com and .net names registered before January 2017 or transferred in before November 2017 will be migrated.
There may be some downtime as the transition goes through, the company warned.

Aussie registrar guilty of $6 million slamming campaign

Domain seller Domain Register Pty Ltd has reportedly been found guilty of scamming thousands of Australians out of a total of $6 million with bogus domain renewal notices.
The Herald Sun reports today that a Federal court ruled that the company’s sales tactics were “misleading or deceptive, or likely to mislead or deceive in breach of state and federal laws”.
The company, at one time a TPP Wholesale reseller but apparently never ICANN-accredited itself, was notorious for being a leading Aussie practitioner of the old “domain slamming” scam popularized by the Brandon Gray gang through fronts such as Domain Registry of America.
It sent paper invoices that appeared to the casual reader to be renewal notices for .com.au names, but were in fact solicitations to buy matching .com names for an outrageous $249 ($195) per year.
So convincing were the notices that the hit rate was one out of every 14 organizations targeted, the Herald Sun reported. Over 21,000 suckers in total.
According to the newspaper, the court was told that Domain Register made AUD 7.7 million ($6 million) from 31,000 registrations and renewals from January 1, 2011, to May 30, 2014.
The lawsuit was filed by Australian state government watchdog Consumer Affairs Victoria a year ago, but the domain industry was warning punters about the scam as far back as 2011.
Domain Register’s punishment has yet to be determined, but the agency had been seeking refunds for victims along with punitive penalties.

Brazil loses its only registrar as UOL bows out

There are now no ICANN-accredited registrars in Brazil, following the termination of Universo Online’s contract this week.
I understand the agreement was ended at UOL’s request. It’s not a case of it breaching its contract.
UOL is a big deal in Brazil, getting beaten in the eyeballs stakes only by the likes of Google and Facebook, but as a registrar it wasn’t in the top 100 globally.
It had a little over 100,000 gTLD domains under management at the last count, with a peak over the last five years of roughly 200,000
I hear that these remaining domains will be transferred to Tucows’ accreditation.
Brazil has had at least four registrars, including UOL, over the years.
Countries roughly the same size as Brazil by population (over 200 million) include Nigeria and Pakistan, each of which still have one active registrar.
There are 10 contracted registries, managing nine 2012-round new gTLDs, in Brazil.

GoDaddy renewal revamp “unrelated” to domainer auction outrage

GoDaddy has made some big changes to how it handles expired domain names, but denied the changes are related to domainer outrage today about “fake” auctions.
The market-leading registrar today said that it has reduced the period post-expiration during which registrants can recover their names from 42 days to 30. After day 30, registrants will no longer be able to renew or transfer affected names.
GoDaddy is also going to start cutting off customers’ MX records five days after expiry. This way, if they’re only using their domain for email, they will notice the interruption. Previously, the company did not cut off MX records.
The changes were first reported at DomainInvesting.com and subsequently confirmed by a GoDaddy spokesperson.
One impact of this will be to reduce confusion when GoDaddy puts expired domains up for auction when it’s still possible for the original registrant reclaim them, which has been the cause of complaints from prominent domain investors this week.
As DomaingGang reported yesterday, self-proclaimed “Domain King” Rick Schwartz bought the domain GoDaddyBlows.com in order to register his disgust with the practice.
Konstantinos Zournas of OnlineDomain followed up with a critique of his own today.
But the GoDaddy spokesperson denied the changes are being made in response to this week’s flak.
“This is unrelated to any events in the aftermarket,” he said. “We’ve been working on this policy for more than a year.”
He said the changes are a case of GoDaddy “optimizing our systems and processes”. The company ran an audit of when customers were renewing and found that fewer than 1% of names were renewed between days 30 and 42 following expiration, he said.
GoDaddy renews about 2.5 million domains per month in just the gTLDs it carries, according to my records, so a full 1% would equal roughly 25,000 names per month or 300,000 per year. But the company spokesperson said the actual number “quite a bit less” than that.
How many of these renewals are genuinely forgetful registrants and how many are people attempting to exploit the auction system is not known.
The changes will come into effect December 4. The news broke today because GoDaddy has started notifying its high-volume customers.

ICANN terminates 450 drop-catch registrars

Almost 450 registrars have lost their ICANN accreditations in recent days, fulfilling predictions of a downturn in the domain name drop-catch market.
By my reckoning, 448 registrars have been terminated in the last week, all of them apparently shells operated by Pheenix, one of the big three drop-catching firms.
Basically, Pheenix has dumped about 90% of its portfolio of accreditations, about 300 of which are less than a year old.
It also means ICANN has lost about 15% of its fee-paying registrars.
Pheenix has saved itself at least $1.2 million in ICANN’s fixed accreditation fees, not including the variable and transaction-based fees.
It has about 50 registrars left in its stable.
The terminated registrars are all either numbered LLCs — “Everest [1-100] LLC” for example — or named after random historical or fictional characters or magic swords.
The move is not unexpected. ICANN predicted it would lose 750 registrars when it compiled its fiscal 2018 budget.
VP Cyrus Namazi said back in July that the drop-catching market is not big enough to support the many hundreds of shell registrars that Pheenix, along with rivals SnapNames/Namejet and DropCatch.com, have created over the last few years.
The downturn, Namazi said back then, is material to ICANN’s budget. I estimated at the time that roughly two thirds of ICANN’s accredited registrar base belonged to the three main drop-catch firms.
Another theory doing the rounds, after Domain Name Wire spotted a Verisign patent filing covering a system for detecting and mitigating “registrar collusion” in the space, is that Verisign is due to shake up the .com drop-catch market with some kind of centralized service.
ICANN reckoned it would start losing registrars in October at a rate of about 250 per quarter, which seems to be playing out as predicted, so the purge has likely only just begun.

Hammock swings from Rightside to MarkMonitor

Statton Hammock has joined brand protection registrar MarkMonitor as its new vice president of global policy and industry development.
He was most recently VP of business and legal affairs at Rightside, the portfolio gTLD registry that got acquired by Donuts in July. He spent four years there.
The new gig sounds like a broad brief. In a press release, MarkMonitor said Hammock will oversee “the development and execution of MarkMonitor’s global policy, thought leadership, business development and awareness strategy”.
MarkMonitor nowadays is a business of Clarivate Analytics under president Chris Veator, who started at the company in July.

After slow launch, .africa looks to add hundreds of resellers

ZA Central Registry is opening up .africa and its South African city gTLDs to potentially hundreds of new registrars via a new proxy program.
The company today announced that its new registrar AF Proxy Services has received ICANN accreditation, which should open up .africa, .joburg, .capetown and .durban to its existing .za channel.
ZACR is the ccTLD registry for South Africa and as such it already has almost 500 partners accredited to sell .za names. But most of these resellers are not also ICANN accredited, so they cannot sell gTLD domains.
The AF Proxy service is intended to give these existing resellers the ability to sell ZACR’s four gTLDs without having to seek out an ICANN accreditation themselves.
“Effectively, all users of the AF Proxy service become resellers of the Proxy Registrar which is an elegant technical solution aimed at boosting new gTLD domain name registrations,” ZACR CEO Lucky Masilela said in a press release.
While reseller networks are of course a staple of the industry and registries acting as retail registrars is fairly common nowadays, this new ZACR business model is unusual.
According to ZACR’s web site, it has 489 accredited .za registrars active today, with 52 more in testing and a whopping 792 more in the application process.
Depending on uptake of the proxy service, that could bring the number of potential .africa resellers to over 1,300.
And they’re probably needed.
The .africa gTLD went into general availability in July — after five years of expensive legal and quasi-legal challenges from rival applicant DotConnectAfrica — but has so far managed to put just 8,600 names in its zone file.
That’s no doubt disappointing for TLD serving a population of 1.2 billion and which had been expected to see substantial domain investor activity from overseas, particularly China.

.museum soon could be open to all (no haters please)

The 15-year-old .museum gTLD could soon be open to a great many more potential registrants, following an ICANN contract renewal.
The registry, MuseDoma, has negotiated a new Registry Agreement that rewrites eligibility rules to the extent that soon basically anyone should be able to register a name.
Since the gTLD went live back in 2002, it has been tightly restricted to legitimate museums and museum associations, as well as verifiable museum workers such as curators.
But the new proposed contract expands eligibility to “individuals with an interest or a link with museum profession and/or activity” and “bona fide museum users”.
It’s not at all clear how one proves they are a “bona fide museum user”, but the language suggests to me that the registry is likely to take registrants at their word and enforce some kind of post-registration review of how the domains are being used.
Indeed, the new contract contains the following new restriction:

Registration implies compliance with a fair use that only allows a use harmless to the image of museums and the community. Non-compliance will result in suspension or termination of the domain name.

So if you are fundamentally opposed to the idea of museums and want to set up a .museum web site trashing the entire concept, you probably won’t be allowed to.
Even though .museum was part of the “test-bed” application round from 2000, the proposed new contract has acquired chunks of the standard new gTLD RA from 2012.
As such, MuseDoma has agreed to take on the Uniform Rapid Suspension rights protection mechanism. This may prove somewhat controversial among those opposed to URS being “forced” on legacy gTLD registries before it has been approved as full ICANN policy.
The way ICANN fees are calculated — .museum’s flat fees are much lower — has not changed.
.museum has had a fairly steady 450 to 600 domains under management for the entirety of its existence.
The contract is open for public comment until October 3.

Former MarkMonitor execs join new brand protection registrar

Two former MarkMonitor executives have teamed up with a Fairwinds co-founder to launch a new “next generation” brand protection registrar.
The new company is Brandsight. It was set up by CEO Phil Lodico, who left brand consultancy Fairwinds about a year ago, and was accredited by ICANN earlier this month.
The first two hires are Matt Serlin, who until a couple months ago was VP of client services at MarkMonitor, and Elisa Cooper, who joins after being VP of marketing at the intellectual property management company Lecorpio.
Cooper, who also worked for MarkMonitor in the same position until a couple of years ago, will be Brandsight’s head of marketing and policy. Serlin will head up operations and client services.
The two told me yesterday that Brandsight will attempt to differentiate itself from its alma maters through a combination of better technology, expertise and use of data.
Both have many years experience in the domain industry and ICANN and, one imagines, thick contacts books of potential clients.
The Brandsight site, which went live today, will feature improved workflow via a streamlined user interface, they said.
The company also hopes “better leverage big data to help companies make better decisions and streamline processes around domain management”, Cooper said.
“Legacy registrars haven’t been focused on building new technology, some for almost 10 years,” she said.
It looks like it’s going to be a boutique operation at first — I believe Lodico, Serlin and Cooper are the only three employees right now — but Cooper said the plan is to staff up over the remainder of the year in areas such as sales.
The idea is to be a company that is purely focused on corporate domain services as its core competency, as opposed to what they called the “legacy” larger registrars that have domains as just one service among many, Cooper and Serlin said.
Brandsight is based in New York state and funded by private investors.