Domain hijack leads to registrar shutdown threat

ICANN has threatened to terminate Chinese domain name registrar eName Technology after the domain 1111.com was allegedly hijacked.
According to ICANN’s notice of breach (pdf), eName has refused to hand over data documenting the transfer of 1111.com as required by the Registrar Accreditation Agreement.
ICANN claims that when it tried to get eName’s help investigating a hijacking complaint, the company did not return its calls or emails.
The registrar now has 15 days to provide the transfer records as called for by the Inter-Registrar Transfer Policy.
According to historical Whois records, 1111.com was transferred to eName between February 12 and 16 this year. After a complaint, ICANN started chasing eName for the data on February 28.
The domain appears to have been owned by at least four different parties and three different registrars – Network Solutions, then Joker, then eName – since the start of 2012.
It’s the second time that ICANN has sent a breach notice to a registrar over an alleged mishandling of a domain name hijacking, and the first time it’s actually named the domain in question.
In February, the organization threatened Turkish registrar Alantron with the suspension of its contract over the botched handling of pricewire.com.

Massive firewall vendor lets domain expire

Check Point Software, one of the world’s leading firewall vendors, forgot to renew its main domain name and it wound up parked by its registrar over the weekend.
The domain checkpoint.com had an expiry date of March 30.
According a screenshot over on The Register, it was resolving to a Network Solutions placeholder page until this afternoon.
The Whois record at DomainTools still shows NetSol’s pending renewal or deletion details, but the domain – a 1994 registration – appears to be resolving normally now.
The company has a market cap of $13.37 billion.

Rogue registrar suspended over “stolen” domain

ICANN has told Turkish domain name registrar Alantron that its accreditation will be suspended for a month due to its shoddy record-keeping.
The suspension, which will become effective March 8, follows an investigation into allegations of double-selling.
ICANN issued the suspension last Thursday after trying unsuccessfully for almost three months to get its hands on Alantron’s registration records.
The company now has until March 28 to sort out its compliance problems or face losing its accreditation entirely.
I understand the investigation was prompted by complaints filed by an American named Roger Rainwater over the potentially valuable domain name pricewire.com.
Pricewire.com spent a couple of years under Whois privacy but was grabbed last August by Turkish registrant Altan Tanriverdi, according to historical Whois records.
Rainwater, who says he had been monitoring it for three or four years, subsequently paid Tanriverdi an undisclosed sum for the domain, signing up for an Alantron account so it could be pushed.
Rainwater showed up in the Whois for pricewire.com on September 7 last year. But he says he was unable to change his name servers and 48 hours later the name disappeared from his account.
He says he was told by Alantron that it had put the domain in Tanriverdi’s account “by mistake” and that it was sold to SnapNames as part of a batch of dropping domains.
According to emails sent to Rainwater, seen by DI, Alantron said that pricewire.com was “registered via a partner company called Directi for a company called Snapnames”.
SnapNames had already auctioned the name – apparently there were more than 40 bidders – and the name has since been transferred to one Sammy Katz of Philadelphia.
However, given that Whois reliability is at question here, it’s not entirely clear who owns it. It’s currently parked at InternetTraffic.com.
Tanriverdi, who appears to be equally aggrieved, has published an extensive history of the dispute, along with screenshots, here (in Turkish).
In short: Alantron stands accused of double-selling pricewire.com.
ICANN’s compliance team has been unable to get its hands on the underlying transaction data despite repeated attempts because Alantron apparently doesn’t have it.
Its suspension notice alleges that Alantron was running two registration systems in parallel and that they weren’t talking to each other, resulting in the same name being sold to two parties.
Read ICANN’s suspension notice in PDF format here.

Moniker and SnapNames join Key-Systems stable

KeyDrive has acquired rival registrar Moniker and rival aftermarket player SnapNames from Oversee.net, according to a statement on the company’s web site.
The deal, which closed in January, would make the combined company the sixth-largest ICANN-accredited registrar, with over 5.4 million domains under management, KeyDrive said.
KeyDrive formed with the merger of German registrar Key-Systems and aftermarket services provider NameDrive last July. It’s based in NameDrive’s native Luxembourg.
The deal gives the primarily European company an additional footprint in the US market. Moniker is based in Florida, SnapNames in Oregon.
It’s a not-too-soon exit for Moniker, which had a disappointing 2011 largely defined by the super-fast churning of domains under management and the regular canning of staff.
I’ve been hearing rumors that the two Oversee units were on the auction block for months.
It’s the fifth significant piece of M&A in the registrar market in the last six months, following the sale of Go Daddy and Group NBT to private investors, Tucows’ acquisition of EPAG and NetSol’s move to Web.com
Terms of the acquisition have not been disclosed. Indeed, there does not appear to have been an official announcement yet, beyond the KeyDrive home page.
The deal was first reported by DomainNameNews.
More details as they come in.

End in sight for Go Daddy’s 60-day transfer lock

Go Daddy’s unpopular 60-day domain name lockdown period, which prevents customers moving to other registrars, could be reduced to as little as five days under new ICANN policy.
ICANN’s GNSO Council this week voted to amend the Inter-Registrar Transfer Policy, which is binding on all registrars, to clarify when and how a registrar is allowed to block a transfer.
Today, Go Daddy has a policy of preventing transfers for 60 days whenever the registrant’s name is changed in the Whois record.
It’s designed to help prevent domain name hijacking, but to many customers it’s frustrating and looks shady; as a result it’s one of the most frequently cited criticisms of the company.
Other registrars may have similar policies, but Go Daddy is the only one you ever really hear complaints about.
Some have even posited that the practice violates the IRTP, which explicitly prevents registrars spuriously locking domains when customers update their Whois.
But ICANN’s compliance department has disagreed with that interpretation, drawing a distinction between “Whois changes” (cannot block a transfer) and “registrant changes” (can block a transfer).
Essentially, if you change your name in a Whois record the domain can be locked by your registrar, but if you change other fields such as mailing address or phone number it cannot.
Go Daddy and other registrars would still be able prevent transfers under the revised policy, but they would have to remove the block within five days of a customer request.
This is how ICANN explains the changes:

Registrar may only impose a lock that would prohibit transfer of the domain name if it includes in its registration agreement the terms and conditions for imposing such lock and obtains express consent from the Registered Name Holder: and
Registrar must remove the “Registrar Lock” status within five (5) calendar days of the Registered Name Holder’s initial request, if the Registrar does not provide facilities for the Registered Name Holder to remove the “Registrar Lock” status

Registrars may have some freedom in how they implement the new policy. Unblocking could be as simple as checking a box in the user interface, or it could mean a phone call.
Go Daddy, which was an active participant in the IRTP review and says it supports the changes, supplied a statement from director of policy planning James Bladel:

In the coming months, Go Daddy is making a few changes to our policy for domains in which the registrant information has changed.
We believe this new procedure will continue to prevent hijacked domain names from being transferred away, while making the transfer experience more user-friendly for our customers.

The changes were approved unanimously by the GNSO Council at its meeting on Thursday.
Before they become binding on registrars, they will have to be approved by the ICANN board of directors too, and the soonest that could happen is at its February 16 meeting.
The changes are part of a package of IRTP revisions – more to come in the near future – that have been under discussion in the ICANN community since 2007. Seriously.

Key-Systems sued over brand protection trademark

Israeli domain name registrar Domain The Net Technologies has filed a preemptive lawsuit against German competitor Key-Systems over their respective brand management trademarks.
According to the complaint, Domain The Net filed for a US trademark on the term “BrandShield”, which it uses to market brand protection services at brandshield.com.
Key-Systems, which runs a similar service called BrandShelter, filed an opposition to Domain The Net’s trademark application last October, due to the alleged potential for confusion.
Anticipating a possible lawsuit, Domain The Net has therefore sued first, asking the District Court in Virginia to declare that BrandShield does not infringe the BrandShelter trademark.
The complaint lists several dozen live brand+word trademarks to demonstrate that no one company should have exclusive rights to the word “brand”.
You can view the complaint, which was filed yesterday, in PDF format here.
(Hat tip: @GeorgeKirikos)

Melbourne IT involved in 100+ gTLD applications

Melbourne IT says it has prepared applications for over 100 new generic top-level domains on behalf of clients including members of the Association of National Advertisers.
The registrar’s CEO, Theo Hnarakis, said in a press release:

Big brands from around the world have already engaged with Melbourne IT Digital Brand Services to help them apply for more than 100 new TLDs.
Big name companies in the financial sector, plus the retail and consumer goods industries have shown the most interest in applying so far, and roughly a quarter of the companies we are assisting are members of the Fortune Global 500. Applicants working with Melbourne IT also include members of the U.S. Association of National Advertisers.”

The company agrees with the emerging industry consensus which estimates 1,000 to 1,500 applications between Thursday and April 12, with roughly two-thirds of those “dot-brand” applications.
It’s an open industry secret that many companies ostensibly opposing the new gTLD program with the ANA are also preparing applications, but their level of enthusiasm is still open to question.
Anecdotally, many potential dot-brand applicants appear to be under the misapprehension that a new gTLD application is necessary to defend their brands from top-level cybersquatters, which is not the case.

Go Daddy gripe site relaunches with .co domain

Erstwhile Go Daddy gripe site No Daddy, formerly found at nodaddy.com, has been relaunched under new ownership at nodaddy.co.
The original site opened in 2007 as a place for customers to share “horror stories”, but was acquired by Go Daddy last July at around the same time it secured a reported $2.2 billion investment.
It’s still not entirely clear whether Go Daddy paid off the previous owners, or whether it was legal or other threats that caused the nodaddy.com domain to change hands.
The site once ranked second only to Go Daddy itself in Google search results for the company’s name.
The new site, NoDaddy.co, is unaffiliated with the previous owners.
The owner identifies himself as “AdverseVariable” and the domain is registered using a Whois privacy service offered by Bahamas-based registrar Internet.bs.
The new forum currently only has one post.

Go Daddy eats humble pie after SOPA boycott

Go Daddy lost tens of thousands of domain name registrations totaling hundreds of thousands of dollars in lost recurring revenue due to yesterday’s SOPA-related boycott.
NameCheap, the eNom reseller that spearheaded the campaign against Go Daddy, said on Twitter that it had raised over $25,000 for the Electronic Frontier Foundation, suggesting that it saw over 25,000 inbound transfers using its SOPASUCKS discount code.
Twitter noise also suggests that several other registrars, such as Name.com and Gandi, gained from the protest.
The boycott went ahead due to Go Daddy’s former support of the Stop Online Piracy Act, which many Americans believe will infringe civil liberties by erecting a great big DNS firewall around the country.
The company withdrew its support for the bill before Christmas, but many customers either chose to ignore its new stance or to point out that “not supporting” did not necessarily mean “opposing”.
Frankly, I think many people just wanted to lash out, and withdrawing business from a company with an established reputation for being a bit downmarket is a lot easier than, say, turning off SOPA-supporting ESPN or cutting up your SOPA-supporting Visa card.
Warren Adelman, Go Daddy’s new CEO, issued this statement last night, clarifying the company’s position:

We have observed a spike in domain name transfers, which are running above normal rates and which we attribute to Go Daddy’s prior support for SOPA, which was reversed.
Go Daddy opposes SOPA because the legislation has not fulfilled its basic requirement to build a consensus among stake-holders in the technology and Internet communities. Our company regrets the loss of any of our customers, who remain our highest priority, and we hope to repair those relationships and win back their business over time.

The company has over 50 million domains under management. Even if 50,000 were transferred to other registrars, that’s still only 0.1% of Go Daddy’s installed base.
Name server records compiled by DailyChanges also heavily suggest that the company sold over 43,000 new domain registrations yesterday.
The fact that Adelman chose to eat humble pie rather than pointing this out was probably a wise PR decision.
Also, NameCheap deserves some kudos for running a very effective social media campaign.

Let’s all beat up Go Daddy!

I think it’s fair to say that Go Daddy is ending 2011 on a bum note.
A handful of competitors, notably Namecheap, are exploiting the recent outrage about the company’s support for the Stop Online Piracy Act (since recanted) to really stick the boot in.
NameCheap today called for December 29 to be marked as Move Your Domain Day and is currently sponsoring the hashtag #BoycottGoDaddy on Twitter.
It also said it will donate $1 to the Electronic Frontier Foundation for every domain transferred to it that day using the coupon code SOPASUCKS.
Other registrars are joining in with somewhat less gusto.
Dotster, for example, is offering cheap transfers with the discount code NOFLIPFLOP, a reference to Go Daddy’s changed position on SOPA.
So what’s the net effect of all this on Go Daddy’s business? It’s difficult to tell with much accuracy at this point.
NameCheap claims to have seen 40,000 inbound transfers in the last week, most of them presumably coming from former Go Daddy customers.
That’s going to be a difficult claim to verify however, even when December’s official gTLD registry reports are published a few months from now.
Unlike most ICANN-accredited registrars, NameCheap does not register domains directly — it has fewer than 200 .com domains under management, according to the most recent registry report.
The company started off life as an eNom reseller and appears to have never gotten around to migrating its customers.
(I wonder how many people transferring their domains this week are aware that some of their fees are probably flowing into the coffers of Demand Media, another popular internet hate figure.)
Several media articles have sourced DomainTool’s DailyChanges service for numbers of transfers out of domaincontrol.com, Go Daddy’s default name server constellation.
But as Andrew Allemann and Elliot Silver have already noted, those numbers are not a reliable indication of how many domains are being transferred from Go Daddy to other registrars.
Here’s a graph showing the transfers in and out of domaincontrol.com since the start of the month.

Transfers out briefly overtook transfers in this week, but by a negligible number.
The two big spikes you can see – both of which occur before the boycott began on December 22 – can be attributed to domainers (possibly a single domainer) moving thousands of domains from domaincontrol.com to internettraffic.com, a parking service, and back again.
Those movements had nothing to do with SOPA or the boycott, nor do they indicate that the domains were transferred away from Go Daddy. Name server changes != transfers.
Facts shouldn’t get in the way of a good story, however.
That’s probably why NameCheap seems to have got away with its insinuations about Go Daddy “blocking” transfers yesterday, which turned out to be highly questionable.
It transpires that transfers into NameCheap were failing not because of any nefarious activity by Go Daddy, but because NameCheap’s Whois queries were being automatically rate limited.
This was likely because NameCheap failed to white-list the IP addresses it uses for port 43 Whois look-ups either using ICANN’s RADAR tool or by notifying Go Daddy directly.
Registrar expert Jothan Frakes said as much on this blog yesterday, as did Michele Neylon of the unrelated registrar Blacknight on Twitter.
Go Daddy senior direct of product development Rich Merdinger suggested in a statement last night that NameCheap looked for the PR opportunity before picking up the phone:

Namecheap posted their accusations in a blog, but to the best our of knowledge, has yet to contact Go Daddy directly, which would be common practice for situations like this. Normally, the fellow registrar would make a request for us to remove the normal rate limiting block which is a standard practice used by Go Daddy, and many other registrars, to rate limit Whois queries to combat WhoIs abuse.

NameCheap has naturally disputed this interpretation of events, saying it had tried to get in touch with Go Daddy but received no response for 24 hours (Christmas Day, presumably).
Regardless of the he said/she said, the narrative in the media and on Twitter for the last couple of days has been pretty clear — Go Daddy: Bad, NameCheap: Good.
The SOPA story seems to have hit a nerve, and there are no shortage of pissed-off Go Daddy customers with horror stories to recount or just general criticisms of the company’s fairly brash image.
Warren Adelman picked a hell of a time to take over as CEO.