Identify.com terminated

ICANN has terminated the accreditation of defunct registrar Identify.com.
The company received its final compliance notice (pdf) last week and will lose its contractual ability to sell gTLD domains April 17.
Not that many will notice or care.
According to the notice, ICANN has been informed that the company is no longer in business.
Identify.com does not currently resolve to a web page, at least for me. According to registry reports, it had just six domain names under management in November.
Back in 2011, its DUM was measured in the low hundreds. Most transferred out or deleted in the meantime.
According to the notice, the registrar failed to provide information about its dealings with the owner of a specific domain name, patschool.com.
According to DomainTools, that domain has never been registered with Identify.com.
It’s ICANN’s third registrar termination in 2015.

.tk registrar gets ICANN breach notice

OpenTLD, the registrar owned by .tk registry Freenon, has received an odd contract-breach notice from ICANN.
The company apparently forgot to send ICANN a Compliance Certificate for 2014, despite repeated pestering by ICANN staff.
It’s the first time I’ve seen ICANN issue a breach notice (pdf) for this reason.
A Compliance Certificate, judging by the 2013 Registrar Accreditation Agreement, seems to be a simple form letter that the CEO must fill in, sign and submit once a year.
Coming back into compliance would be, one imagines, five minutes’ work.
As well as being an ICANN-accredited registrar, OpenTLD is part of Freenom. That’s the registry that repurposes under-used ccTLDs with a “freemium” model that allows free registrations.
Its flagship, .tk, is the biggest ccTLD in world, with over 30 million active names.

Google leaks 282,000 private Whois records

Google has accidentally revealed registrant contact information for 282,867 domain names that were supposed to be protected by a privacy service.
The bug reportedly affected 94% of the 305,925 domains registered via Google Apps, an eNom reseller.
The glitch was discovered by Cisco and reported to Google February 19. It has since been fixed and customers were notified yesterday.
Google acknowledged in an email to customers that the problem was caused by a “software defect in the Google Apps domain renewal system”.
It seems that anyone who acquired a domain with privacy through Google Apps since mid-2013 and has since renewed the registration will have had their identities unmasked in Whois upon renewal.
Names, addresses, emails and phone numbers were revealed.
Due to services such as DomainTools, which cache Whois records, there’s no putting the genie back in the bottle. The information is out there for good now.
It’s a pretty major embarrassment for Google, which recently launched its own registrar.

Europeans digging new gTLD more than Americans?

Are European registrants more likely to register new gTLD domain names than those in the US and elsewhere?
That’s the view of Tucows, which sees more new gTLD action from its European OpenSRS resellers than it does from others.
In a blog post last week, OpenSRS blogger Gustavo Arruda noted that Americans are still stuck in a .com mindset:

Our European resellers are leading the charge. We expected the European market to be more open to new gTLDs and that prediction proved correct. It’s a market used to ccTLDs so having a couple hundred more new gTLDs was not a big deal.
North American resellers are lagging behind. It continues to be a very .COM-centric market that is still skeptical about too much choice.
South American and Asian resellers complain about the English-centric nature of new gTLDs. A lot of the new gTLDs we have launched do not make sense in these markets so adoption has been slow.

The post came as OpenSRS recorded its 100,000th new gTLD domain sale.
One reason for the Euro-slant in the market could be the relatively good performance of city gTLDs, most of which are European, and which are easily grasped concepts for buyers familiar with ccTLDs.
Hover, Tucows’ retail registrar, is geo-targeting which TLDs it offers visitors. As DI is based in London, I get offered .london domains prominently when searching for domains there.
The only US geo-gTLDs available to date are .vegas and .nyc.

Two legit registrars held to account for lack of abuse tracking

ICANN Compliance’s campaign against registrars that fail to respond to abuse reports continued last week, with two registrars hit with breach notices.
The registrars in question are Above.com and Astutium, neither of which one would instinctively bundle in to the “rogue registrar” category.
Both companies have been told they’ve breached section 3.18.1 of their Registrar Accreditation Agreement, which says: “Registrar shall take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.”
Specifics were not given, but it seems that people filed abuse reports with the registrars then complained to ICANN when they did not get the response they wanted. ICANN then was unable to get the registrars to show evidence that they had responded.
Both companies have until February 12 to come back into compliance or risk losing their accreditations.
Domain investor-focused Above.com had over 150,000 gTLD domains on its books at the last official count. UK-based Astutium has fewer than 5,000 (though it says the current number, presumably including ccTLD names, is 53,350).
It’s becoming increasingly clear that registrars under the 2013 RAA are going to be held to account by ICANN to the somewhat vague requirements of 3.18.1, and that logging communications with abuse reports is now a must.

Domain hijacking bug found in Go Daddy

Go Daddy has rushed out a fix to a security bug in its web site that could have allowed attackers to steal valuable domain names.
Security engineer Dylan Saccomanni found several “cross site request forgery” holes January 17, which he said could be used to “edit nameservers, change auto-renew settings and edit the zone file entirely”.
He reported it to Go Daddy (evidently with some difficulty) and blogged it up, with attack code samples, January 18. Go Daddy reportedly patched its site the following day.
A CSRF vulnerability is where a web site fails to adequately validate data submitted via HTTP POST. Basically, in this case Go Daddy apparently wasn’t checking whether commands to edit name servers, for example, were being submitted via the correct web site.
Mitigating the risk substantially, attackers would have to trick the would-be victim domain owner into filling out a web form on a different site, while they were simultaneously logged into their Go Daddy accounts, in order to exploit the vulnerability, however.
In my experience, Go Daddy times out logged-in sessions after a period, reducing the potential attack window.
Being phishing-aware would also reduce your chance of being a victim.
I’m not aware of any reports of domains being lost to this attack.

ICANN audit claims two more registrar scalps

Two tiny registrars — WebZero and Black Ice Domains — have had their registrar accreditations terminated for a failure to respond to a routine ICANN audit.
Israel-based Black Ice had just a couple thousands gTLD domains under management; US-based WebZero had fewer than 100.
Both registrars stood accused of not providing documents to ICANN in response to an audit, per their Registrar Accreditation Agreements.
ICANN will now look for a registrar or registrars to take over these registrars’ domains.

.uk suspension problems worse than I thought

Problems validating the addresses of .uk domain registrants, which caused one registrar to dump the TLD entirely, are broader than I reported yesterday.
Cronon, which does business as Strato, announced last week that it has stopped selling .uk domain names because in more than a third of cases Nominet, the registry, is unable to validate the Whois data.
In many cases the domain is subsequently suspended, causing customer support headaches.
It now transpires that the problems are not limited to .uk second-level names, are not limited to UK registrants, and are not caused primarily by mailing address validation failures.
Michael Shohat, head of registrar services at Cronon, got in touch last night to clarify that most of its affected customers are in fact from its native Germany or from the Netherlands.
All of the affected names are .co.uk names, not .uk SLDs, he added.
And the validation is failing in the large majority of cases not due to Nominet’s inability to validate a mailing address, but rather its inability to validate the identity of the registrant.
“This is where the verification is failing. The database they are using can’t find many of our registrants’ company names,” Shohat said.
“So 30% of our registrations were being put on hold, almost all of them from [Germany] and [the Netherlands], and 90% of them because of the company name. We checked lots of them and in every single case the name of the company was correct, and the address as well,” he said.
Michele Neylon of the ICANN Registrar Stakeholders Group said that Cronon is not the only registrar to have been affected by these issues. Blacknight Solutions, the registrar Neylon runs, has been complaining about the problem since May.
According to Neylon, the Nominet policy causing the issue is its data quality policy, which covers all .uk and .co.uk (etc) names.
The policy itself is pretty vague — Nominet basically says it will work with each individual registrar to determine a baseline of what can be considered a “minimum proportion of valid data”, given the geographic makeup of the registrar’s customer base.
Domains that fail to meet these criteria have a “Data Quality Lock” imposed — essentially a suspension of the domain’s ability to resolve.
Earlier this year, Nominet did backtrack on plans to implement an automatic cancellation of the names after 30 days of non-compliance, following feedback from its registrars.
“It’s disappointing that Cronon have taken this step; we hope they will consider working with us to find a way to move forward,” a Nominet spokesperson added.
She said that the registry has over recent years moved to “more proactive enforcement” of Whois accuracy. She pointed out that Nominet takes on the “lion’s share of the work”, reducing the burden on registrars.
“However, our solution does not include non-UK data sets to cross-reference with, so it is possible that some false positives occur,” she said. “Registrars with a large non-UK registrant bases, who are not accredited channel partners, would be affected more than others.”
An Accredited Channel Partner is the top tier of the three Nominet offers to registrars. It has additional data validation requirements but additional benefits.
While .co.uk domains are not limited to UK-based registrants, all .uk SLD registrants do need to have a UK mailing address in their Whois for legal service.
The company’s inability to validate many non-UK business identities seems to mean .co.uk could also slowly become a UK-only space by the back door.

Big registrar dumps .uk — a glimpse of Christmas future?

German registrar Cronon, which retails domains under the Strato brand, has stopped carrying .uk domains due to what it says are onerous Whois validation rules.
In a blog post, company spokesperson Christina Witt said that over one third of all .uk sales the registrar has been making are failing Nominet’s registry-end validation checks, which she said are “buggy”.
With the introduction of direct second-level registration under .uk, Nominet introduced a new requirement that all new domains must have a UK address in the Whois for legal service, even if the registrant is based overseas.
According to its web site, Nominet checks registrant addresses against the Royal Mail Postcode Address file, which contains over 29 million UK addresses, and does a confidence-based match.
If attempts to match the supplied address with a UK address in this file prove fruitless, and after outreach to the registrant, Nominet suspends the domain 30 days after registration and eventually deletes it.
It’s this policy of terminating domains that has caused Strato to despair and stop accepting new .uk registrations.
“Databases of street directories or company registers are often inaccurate and out of date,” Witt wrote (translated from the original German). “The result: addresses that are not wrong, in fact, are be found to be invalid.”
Nominet is throwing back over a third of all .uk names registered via Strato, according to the blog post, creating a customer support nightmare.
Its affected registrants are also confused about the verification emails they receive from Nominet, a foreign company of which they have often never heard, Witt wrote.
I don’t know how many .uk names the registrar has under management, but it’s reasonably large in the gTLD space, with roughly 650,000 domains under management at the last count.
If Strato’s claim that Nominet is rejecting a third of valid addresses (and how Strato could know they’re valid is open to question), that’s quite a scary statistic.
Nominet seems to be using an address database, from the Royal Mail, which is about as close to definitive as it gets. And it’s only verifying addresses from a single country.
I shudder to imagine what the false negative rate would be like for a gTLD registrar compelled to validate addresses across 200-odd countries and territories.
The latest version of the ICANN Registrar Accreditation Agreement requires registrars to partially validate addresses, such as checking whether the street and postal code exist in the given city, but there’s no requirement for domains to be suspended if these checks fail.
[UPDATE: Thanks to Michele Neylon of the Registrars Stakeholder Group for the reminder that this RAA requirement hasn’t actually come into force yet, and won’t until the RrSG and ICANN come to terms on its technical and commercial feasibility.]
Where the 2013 RAA does require suspension is when the registrant fails to verify their email address (or, less commonly, phone number), which as we’ve seen over the last year leads to hundreds of thousands of names being yanked for no good reason.
If Strato’s story about .uk is correct and its experience shared by other registrars, I expect that will become and important data point the next time law enforcement or other interests push for even stricter Whois rules in the ICANN world.

One company now owns almost a third of all registrars

TurnCommerce acquired another 299 registrar accreditations from ICANN over Christmas week.
The company, which is behind domain properties including DropCatch.com, now has at least 452 registrars in its stable. That’s over 31% of the 1,456 total currently reported by Internic.
Each of the new accreditations is named “DropCatch”, followed by a number from 446 to 751. Each has a matching .com domain as its nominal base of operations and an associated LLC shell company.
At $4,000 a year for the base accreditation fee, TurnCommerce must be spending close to $2 million a year in ICANN fees alone.
Companies in the drop-catching business acquire large numbers of registrars in order to control more batches of connections with which to spam gTLD registries with “add” requests when potentially valuable domains expire and are deleted.
With almost a third of all accredited registrars now operating under the same control, one imagines TurnCommerce’s chances of securing the names it wants have been significantly improved.
As well as DropCatch, TurnCommerce runs retail registrar NameBright and premium sales site HugeDomains. It has plans to launch additional services at Expire.com and PremiumDomains.com shortly.
Its latest crop of registrars means ICANN has accredited over 2,200 companies since the gTLD registrar market was opened for competition 15 year ago, though many have allowed their contracts to lapse or, less frequently, have been terminated by ICANN compliance efforts.