How NetSol opts you in to cybersquatted .xyz names

Clear-cut cases of cybersquatting seem to be among those .xyz domain names that Network Solutions has registered to its customers without their explicit request.
Some of the domains I’ve found registered in .xyz, via NetSol to the registrants of the matching .com or .net names, include my-twitter.xyz, facebook-liker.xyz and googledia.xyz.
Domains including other brands, such as Rolex, Disney, iPhone, Amazon and Pepsi can also be found registered to third parties, via NetSol, in .xyz’s zone today.
They’re all registered via NetSol’s Whois privacy service, which lists the registrant’s “real” name in the Whois record, but substitutes mailing address, email and phone number with NetSol-operated proxies.
I think the chance of these names being paid for by the registrant is slim. It seems probable that many (if not all) of the squatty-looking names were registered via NetSol’s promotional program for .xyz.
As previously reported, NetSol has been giving away domain names in .xyz to owners of the matching .com names. Tens of thousands of .xyz names seem to have been registered this way in the last week.
The “registrants” did not have to explicitly accept the offer. Instead, NetSol gave them the option to “opt-out” of having the name registered on their behalf and placed into their accounts.
The effect of this has been to propel .xyz into the leading spot in the new gTLD league table. It had 82,236 names in today’s zone file. a clear 15,000 names ahead of second-place .club.
But it’s not clear how much, if any, support NetSol has received from the registry, XYZ.com. CEO Daniel Negari told Rick Schwartz, in a coy interview last week:

The Registry Operator is unable to “give away” free domain names. I never even saw the email that the registrar sent to its customers until I discovered it on the blogs.

The opt-out giveaway has also prompted speculation about NetSol’s right to register domains without the explicit consent of the registrant, both under the law and under ICANN contract.
Under the Registrar Accreditation Agreement, in order to register a domain name, registrars “shall require” the registrant “to enter into an electronic or paper registration agreement”.
That agreement requires the registrant to agree to, among many other things, the transfer or suspension of their domains if (for example) they lose a UDRP or URS case.
But that doesn’t seem to be happening with the opt-out names,
Barry Shein, president of The World, had shein.xyz registered on his behalf by NetSol on Saturday. He already owns shein.com, also registered with NetSol.
NetSol’s email informing him of the registration, which Shein forwarded to DI, reads as follows:

Dear Valued Network Solutions Customer,
Congratulations, your complimentary SHEIN.XYZ domain has arrived!
Your new .XYZ domain is now available in your Network Solutions account and ready to use. To go along with your new .XYZ domain, you have also received complimentary access to Professional Email and Private Registration for your .XYZ domain.
If you choose not to use this domain no action is needed and you will not be charged any fees in the future. Should you decide to keep the domain after your complementary first year, simply renew it like any other domain in your account.
We appreciate your business and look forward to serving you again.
Sincerely,
Network Solutions Customer Support
www.networksolutions.com
http://www.networksolutions.com/help/index.jsp

Importantly, a footnote goes on to describe how NetSol will take a refusal to opt out as “continued acceptance” of its registration agreement:

Please note that your use of this .XYZ domain name and/or your refusal to decline the domain shall indicate acceptance of the domain into your account, your continued acceptance of our Service Agreement located online at http://www.networksolutions.com/legal/static-service-agreement.jsp, and its application to the domain.

So, if you’re a NetSol customer who was picked to receive a free .xyz name but for whatever reason you don’t read every marketing email your registrar sends you (who does?) you’ve agreed to the registration agreement without your knowledge or explicit consent, at least according to NetSol.
I am not a lawyer, but I’ve studied enough law to know that this is a dubious way to make a contract. Lawyers I’ve shown this disclaimer to have laughed out loud.
Of course, because each registrant already owns a matching .com, they’ve already accepted NetSol’s registration agreement and terms of service at least once before.
This may allow NetSol to argue that the initial acceptance of the contract also applies to the new .xyz domains.
But there are differences between .com and .xyz.
Chiefly, as a new gTLD, .xyz registrants are subject to policies that do not apply to .com, such as the Uniform Rapid Suspension policy.
URS differs from UDRP in that there’s a “loser pays” model that applies to complaints involving over 15 domains.
So these .xyz registrants have been opted into a policy that could leave them out of pocket, without their explicit consent.
Of course, we’re talking about people who seem to be infringing famous trademarks in their existing .com names, so who gives a damn, right?
But it does raise some interesting questions.
Who’s the registrant here? Is it the person who owns the .com, or is it NetSol? NetSol is the proxy service, but the .com registrant’s name is listed in the Whois.
Who’s liable for cybersquatting here? Who would Twitter file a UDRP or URS against over my-twitter.xyz? Who would it sue, if it decided to opt for the courts instead?

RADAR to be down at least two weeks after hack

ICANN expects its RADAR registrar database to be offline for “at least two weeks” following the discovery of a security vulnerability that exposed users’ login names and encrypted passwords.
ICANN seems to have been quick to act and to disclose the hack.
The attack happened last weekend and ICANN was informed about it by an “internet user” on Tuesday May 27, according to an ICANN spokesperson. RADAR was taken offline and the problem disclosed late May 28.
The spokesperson added that “we do not believe the user is affiliated with a current or previously accredited registrar.”
ICANN isn’t disclosing the nature of the vulnerability, but said RADAR will be offline for some time for a security audit. The spokesperson told DI in an email:

It will be at least two weeks. It is more important to complete a thorough security assessment of the site than to rush this process. First of all, we’re keeping the system offline until we complete a thorough audit of the system. We are also currently engaged in a security review of all systems and procedures at ICANN to assess and implement ongoing improvements as appropriate.

RADAR is a database used by registrars to coordinate stuff like emergency contacts and IP address whitelisting for bulk Whois access.
The downtime is not expected to impact registrants, according to ICANN. The spokesperson said: “Nothing that occurred has raised any concerns that registrants could or would be adversely affected.”

ICANN registrar database hacked

ICANN’s database of registrar contact information has been hacked and user data has been stolen.
The organization announced this morning that the database, known as RADAR, has been taken offline while ICANN conducts a “thorough review” of its security.
ICANN said:

This action was taken as a precautionary measure after it was learned that an unauthorized party viewed data in the system. ICANN has found no evidence of any unauthorized changes to the data in the system. Although the vulnerability has been corrected, RADAR will remain offline until a thorough review of the system is completed.

Users of the system — all registrars — have had their usernames, email addresses and encrypted passwords compromised, ICANN added.
ICANN noted that it’s possible to brute-force a hashed password into plaintext, so it’s enforcing a password reset on all users, but it has no evidence of any user accounts being accessed.
RADAR users may want to think about whether they have the same username/password combinations at other sites.
RADAR is a database used by registrars in critical functions such as domain name transfers.
Registrars can use it, for example, to white-list the IP addresses of rival registrars, enabling them to execute large amounts of Whois queries that would usually be throttled.
The news follows hot on the heels of a screwup in the Centralized Zone Data Service, which enabled any new gTLD registry to view data belonging to rival registries and other CZDS users.

KnujOn scores a win as BizCN gets first breach notice

The Chinese registrar BizCN has received its first breach notice from ICANN’s compliance department, following a sustained campaign by anti-abuse activist KnujOn.
The notice concerns Whois accuracy, specifically for the domain names rapetube.org and onlinepharmacy4.org, and a bunch of other peripheral breaches of the Registrar Accreditation Agreement.
The “porn” site rapetube.org was the subject of a Washington Post article last December, in which KnujOn’s Garth Bruen said he feared the site might contain footage of actual crimes.
Bruen has been chasing BizCN about Whois inaccuracy, and specifically the rapetube.org domain, since 2011.
He said in a September 2013 CircleID post that he’s filed Whois inaccuracy complaints about the domain with ICANN “multiple times”.
His campaign against ICANN Compliance led to an Ombudsman complaint (which was rejected) last year.
Now Compliance appears to be taking the case more seriously. ICANN, according to the breach notice, has been on BizCN’s case about rapetube.org’s Whois since March 24 this year.
At that time, the name was registered to a Vietnamese name with a French address and phone number and a contact email address at privacy-protect.cn.
According to Bruen’s interview with the Post, this email address bounced and nobody answered the phone number. The privacy-protect.cn domain does not appear to currently resolve.
ICANN evidently has some unspecified “information” that shows the email “does not appear to be a valid functioning email address”.
But BizCN told ICANN April 2 that it had verified the registrant’s contact information with the registrant, and provided ICANN with correspondence it said demonstrated that.
ICANN says the correspondence it provided actually predated KnujOn’s latest complaint by six months.
In addition, when BizCN forwarded a scanned copy of the registrant’s ID card, ICANN suspected it to be a fake. The notice says:

Registrar provided copies of correspondence between the reseller and registrant. The response included the same email address that was still invalid according to information available to ICANN, and included a copy of a government identification card to confirm the registrant’s address. According to information available to ICANN, the identification card did not conform to any current or previous form of government identification for that jurisdiction.

Despite repeated follow-up calls, ICANN said it still has not received an adequate response from BizCN, so its accreditation is now in jeopardy.
BizCN has something like 450,000 gTLD names under management and is in the top 50 registrars by volume.
As for rapetube.org, it’s still registered with BizCN, but its Whois changed to a Russian company “Privat Line LLP”, at privatlinellp.me, on or about April 17.
That change is not going to help BizCN, however, which is being asked to provide evidence that it took “reasonable steps to investigate and reasonable steps to correct the Whois inaccuracy claims”.
It has until May 29 to sort out the breaches or face termination. Read the breach notice here.

NameCheap gets contract breach notice

ICANN has sent a formal breach notice to top ten registrar NameCheap, saying the company failed to comply with a mandatory audit.
ICANN also claims in the notice (pdf) that the company has failed to keep its web site up to date with pricing information required by policies.
NameCheap, which says it has over three million domains under management, may be the largest registrar to get to the formal, published breach notice stage of the ICANN compliance process.
But it should be noted that while the company is accredited and must comply with its Registrar Accreditation Agreement, it does almost all of its business as an eNom reseller.
Just a handful of domain names are registered under NameCheap’s own IANA number.

101domain shifts blame to Google as premium buyers offered 50% discount

101domain has offered a 50% discount to customers that were sold premium new gTLD domains for a vastly reduced price, and has tried to shift some of the blame to the registry, Google.
The offer was made in a letter (pdf) to affected registrants — previously hit with delayed invoices for thousands of dollars for domains they bought for $12.99 — sent yesterday.
It indicates that the registrar is prepared to eat at least part of its pricing error on both first-year registrations and subsequent annual renewals.
101domain told customers:

• You now have until June 23, 2014 to make a decision whether to delete the name or pay for the premium name.
• If you want to keep the name(s), 101domain will offer you a 50% discount on the first year premium price and a 25% discount on premium annual renewals.
• If you give up your name(s), we will give you a credit on 101domain.com for any future purchases equal to 25% of the price of the premium name.

Previously, affected registrants had been told to pay up or have their domains deleted the following day.
As we reported last week, almost 50 domains in Google’s .みんな (“.everyone”) were sold for $12.99, despite some being earmarked by the registry as “premiums” with annual fees of up to $7,000.
In its letter to customers yesterday, 101domain characterized Google’s system for handling premiums as non-standard and difficult for registrars to work with.
Google’s list of premium names was circulated to registrars via an email, and the registry had no EPP commands for checking out whether a name was premium in real-time, the registrar says.
There was also no way for registrars to prevent the registration of premiums and no way to check with the registry for premium sales, it added.
It seems clear from the letter that the discounts now on offer mean that if registrants choose to keep their names they’ll be getting them at less than the registry fee — 101domain will eat the difference.

We contacted Google and requested them to work with us on the matter since we felt strongly that both sides were responsible to right the situation. Google offered no assistance other than extending the date to delete the names — telling us it was our problem.

Despite this seemingly generous response to domainer outrage, at the least one affected customer is not impressed.
In an email to DI last night the original registrant that first alerted us to the pricing problem described the latest 101domain offer as “lame”.

Guy hit with $1,600 bill a month after registering “premium” name for $12.99

101domain has sent out almost 50 invoices, believed to total many thousands of dollars, to customers who had bought “premium” domain names for $12.99 well over a month ago.
One DI reader, who said he’d rather not be named, received a bill from the registrar today for $1587.01 for a .みんな domain name he hand-registered March 10 for the base fee of $12.99.
The email from 101domain stated that unless he pays the bill by 5pm PST tomorrow, his domain will be deleted:

It has come to our attention that the .みんな registry considers certain name(s) that you have registered with us as premium names and that there were some intermittent pricing errors on our website allowing you to purchase these name(s) at regular pricing. The cause of this error has been resolved and we sincerely apologize for the error.
In order to correct these pricing errors, the Registry has granted us the option to delete these names if we are unable to collect the premium pricing from our customers.
…
Due to a short deadline, payment must be received by Thursday, April 24, 2014, 5pm PST in order for deletion of the name not to occur. In the event that payment isn’t received by Thursday, April 24, 2014, 5pm PST the domain name(s) will be deleted, released back into the pool of available domain names, and any payments previously received for the domain names will be fully refunded to you.

The registrar offered a full refund of the $12.99 and a 20% discount coupon as compensation.
“I am not sure what’s the legal status of this,” the registrant told DI. “Also asking for this a more than a month later (purchased on 10th of March), besides being not cool, is just wrong.”
.みんな is one of Google’s new gTLDs. It’s Japanese for “everyone”.
101domain COO Anthony Beltran told DI that “fewer than 50” names were affected by the pricing error, all of them in .みんな.
“Literally every registry is doing things differently, but we have committed to offering them as our customers overwhelmingly demand them,” he said. “Most of them understand, as early adopters, there will be occasional issues, and our disclaimers and T&Cs speak to this.”
He offered the following explanation for the error:

In order to offer pre-paid orders, 101domain’s practice is to put up pricing as soon as it is confirmed and as soon as we receive lists of premium names, reserved names, and name collisions from a registry. This is generally well before EPP is available so there is no live domain:check. Our search queries these lists internally to offer accurate pricing well before most other registrars do so that our clients are well ahead of the curve with plenty of time to research and submit orders. Mistakes do rarely occur; some premium lists are fluid, complications have been introduced with SEDO and AFTERNIC getting exclusive listings of premium names (while we have access through their distribution channels like SEDO MLS), or names are snapped up in Sunrise, EAP, or Landrush. We will typically notify clients prior to names becoming active of any changes in pricing or availability and promptly refund in full if requested. With this TLD, this did not happen properly unfortunately.

Nobody’s claiming Google did anything wrong.
I’m not sure what American or Californian consumer protection law says about this kind of thing, but it is a quite startling situation.
Are there any other fields of commerce where you can be billed a month later because a retailer got confused about its wholesale prices?

Bug takes out HostGator, BlueHost for a day

Endurance International, the domain name registrar that owns some of the world’s biggest web hosting brands, has been hit by a “network firmware” bug that took out one of its data centers.
It’s not currently clear how many many of the 10 million+ domains that EIG hosts were affected, but the outage seems to have lasted at least 17 hours and is only just being resolved right now.
Customers of EIG brands BlueHost and HostGator are among those known to be affected. HostGator alone hosts over 9 million domains, according to Wikipedia.
The outage, affecting a Provo, Utah data center, seems to have begun at 11am local time (7pm UTC) yesterday.
On the BlueHost Facebook page, the company wrote at about 8am UTC today:

Our NetOps team addressed the source of the problems affecting some customers: a bug in the firmware utilized in our vendor’s hardware. We worked very closely with this vendor and we have implemented a bug fix that is beginning to propagate across the network now. You may find some performance inconsistencies during this rollout, but they should resolve fairly quickly.

In more recent updates on Twitter and Facebook and forums, the companies said that some customers may still be affected by the bug, but that they’re quickly coming back online.
Endurance owns dozens of domains and hosting brands. In the registrar space, its best known and largest are probably FastDomain, Domain.com, Dotster and, following the recent acquisition, Directi.
Today’s downtime is the third significant outage in the last 12 months.
The same data center was hit by a prolonged outage in August 2013, which was followed by a shorter outage on December 31.

Are Whois email checks doing more harm than good?

“Tens of thousands” of web sites are going dark due to ICANN’s new email verification requirements and registrars are demanding to know how this sacrifice is helping solve crimes.
These claims and demands were made in meetings between registrars and ICANN’s board and management at the ICANN 49 meeting in Singapore last week.
Go Daddy director of policy planning James Bladel and Tucows CEO Elliot Noss questioned the benefit of the 2013 Registrar Accreditation Agreement during a Tuesday session.
The 2013 RAA requires registrars to verify that registrants’ email addresses are accurate. If registrants do not respond to verification emails within 15 days, their domains are turned off.
There have been many news stories and blog posts recounting how legitimate webmasters found their sites gone dark due to an overlooked verification email.
Just looking at my Twitter stream for an “icann” search, I see several complaints about the process every week, made by registrants whose web sites and email accounts have disappeared.
Noss told the ICANN board that the requirement has created a “demonstrable burden” for registrants.
“If you cared to hear operationally you would hear about tens and hundreds of thousands of terrible stories that are happening to legitimate businesses and individuals,” he said.
Noss told DI today that Tucows is currently compiling some statistics to illustrate the scale of the problem, but it’s not yet clear what the company plans to do with the data.
At the Singapore meeting, he asked ICANN to go to the law enforcement agencies that demanded Whois verification in the first place to ask for data showing that the new rules are also doing some good.
“What crime has been forestalled?” he said. “What issues around fraud? We heard about pedophilia regularly from law enforcement. What has any of this done to create benefits in that direction?”
Registrars have a renewed concern about this now because there are moves afoot in other fora, such as the group working on new rules for privacy and proxy services, for even greater Whois verification.
Bladel pointed to an exchange at the ICANN meeting in Durban last July, during which ICANN CEO Fadi Chehade suggested that ICANN would not entertain requests for more Whois verification until law enforcement had demonstrated that the 2013 RAA requirements had had benefits.
The exact Chehade line, from the Durban public forum transcript, was:

law enforcement, before they ask for more, we put them on notice that they need to tell us what was the impact of what we did for them already, which had costs on the implementers.

Quoted back to himself, in Singapore Chehade told Bladel: “It will be done by London.”
Speaking at greater length, director Mike Silber said:

What I cannot do is force law enforcement to give us anything. But I think what we can do is press the point home with law enforcement that if they want more, and if they want greater compliance and if they want greater collaborations, it would be very useful to show the people going through the exercise what benefits law enforcement are receiving from it.

So will law enforcement agencies be able to come up with any hard data by London, just a few months from now?
It seems unlikely to me. The 2013 RAA requirements only came into force in January, so the impact on the overall cleanliness of the various Whois databases is likely to be slim so far.
I also wonder whether law enforcement agencies track the accuracy of Whois in any meaningfully quantitative way. Anecdotes and color may not cut the mustard.
But it does seem likely that the registrars are going to have data to back up their side of the argument — customer service logs, verification email response rates and so forth — by London.
They want the 2013 RAA Whois verification rules rethought and removed from the contract and the ICANN board so far seems fairly responsive to their concerns.
Law enforcement may be about to find itself on the back foot in this long-running debate.

Registrars screwing up new gTLD launches?

Some of the largest domain name registrars are failing to support new gTLDs properly, leading to would-be registrants being told unregistered names are unavailable.
The .menu gTLD went into general availability yesterday, gathering some 1,649 registrations in its first half day.
It’s not a great start for the new gTLD by any stretch, but how much of it has to do with the channel?
I tested out searches for available names at some of the biggest registrars and got widely different results, apparently because they don’t all properly support tiered pricing.
Market leader Go Daddy even refuses to sell available names.
The .menu gTLD is being operated by a What Box? subsidiary, the inappropriately named Wedding TLD2.
The company has selected at least three pricing tiers as far as I can tell — $25 is the baseline registry fee, but many unreserved “premium” names are priced by the registry at $50 and $65 a year.
For my test, I used noodleshop.menu, which seems to carry the $65 fee. Whois records show it as unregistered and it’s not showing up in today’s .menu zone file. It’s available.
This pricing seems to be accurately reflected at registrars including Name.com and 101domain.
Name.com, for example, says that the name is available and offers to sell it to me for $81.25.

Likewise, 101domain reports its availability and a price of $97.49. There’s even a little medal icon next to the name to illustrate the fact that it’s at a premium price.

So far so good. However, other registrars fare less well.
Go Daddy and Register.com, which are both accredited .menu registrars, don’t seem to recognize the higher-tier names at all.
Go Daddy reports the name is unavailable.

And so does Register.com.

For every .menu name that carried a premium price at Name.com, Go Daddy was reporting it as unavailable.
With Go Daddy owning almost half of the new gTLD market, you can see why its failure to recognize a significant portion of a new gTLD’s available nice-looking names might impact day-one volumes.
The experience at 1&1, which has pumped millions into marketing new gTLD pre-registrations, was also weird.
At 1&1, I was offered noodleshop.menu at the sale price of $29.99 for the first year and $49.99 thereafter, which for some reason I was told was a $240 saving.

Both the sale price and the regular price appear to be below the wholesale cost. Either 1&1 is committed to take a $15 loss on each top-tier .menu name forever, or it’s pricing its names incorrectly.
A reader informed me this morning that when he tried to buy a .menu premium at 1&1 today he was presented with a message saying he would be contacted within 24 hours about the name.
He said his credit card was billed for the $29.99, but the name (Whois records seem to confirm) remains unregistered.
I’d test this out myself but frankly I don’t want to risk my money. When I tried to register the same name as the reader on 1&1 today I was told it was still available.
If I were a new gTLD registry I’d be very worried about this state of affairs. Without registrars, there’s no sales, but some registrars appear to be unprepared, at least in the case of .menu.