.XXX demands approval in Brussels

ICM Registry has called on ICANN to quickly give final approval to its .xxx top-level domain contract after its meeting with governments next month.
Company president Stuart Lawley, in a letter to ICANN (pdf), said ICM has “invested extraordinary resources” in its TLD proposal and has waited almost seven years to get into the DNS root.
Its hopes of getting the nod from ICANN’s board of directors in Cartagena last month were dashed, when it was decided that a final consultation with the Governmental Advisory Committee was required.
That consultation is set to take place in Brussels at the end of February (although ICANN’s announcement of the meeting last Friday conspicuously made no mention of .xxx).
Lawley writes:

ICM Registry urges the ICANN Board to fulfill its explicit commitments to ICM Registry and to the ICANN community, and to uphold the integrity of the ICANN process by conducting and completing its consultations with the GAC
…
Neither ICM Registry nor the ICANN community can be expected to stand by while ICANN allows yet another self-imposed deadline on this matter to come and go without a plausible explanation.

The letter notes that it’s almost a year since ICANN’s Independent Review Panel told the organization that, despite its protestations to the contrary, .xxx had already been approved.
Lawley tells me ICM is spending, on average, $100,000 a month to keep the company ticking over. He believes that the proposed registry contract has dealt with all of the GAC’s concerns.
The one concern it will never be able to avoid, of course, is that .xxx is for porn, and there are plenty of governments (be they Middle Eastern theocracies, communist Asian states or conservative Western democracies) opposed to porn in principle.
The GAC said in an official Communique in 2006 that “several members of the GAC are emphatically opposed from a public policy perspective to the introduction of a .xxx sTLD.”
As far as I can tell, that’s pretty much the only major stumbling block remaining before ICM can sign a registry contract.
UK GAC rep Mark Carvell told me yesterday that the GAC believes the 2006 statement constitutes “advice” that ICANN is duty-bound to take into account, even though it was not a consensus GAC position.
In my opinion, ICANN has no choice but to disregard this advice.
If we suddenly start living in a world where the public policies of a handful of backward nations are sufficient to veto a TLD, then we may as well pack up the whole internet and move it to Saudi Arabia or Utah.

Verizon subpoenas DirectNIC whistleblower

Verizon has subpoenaed a former DirectNIC employee as part of its ongoing cybersquatting lawsuit against the domain name registrar.
Mark Deshong filed a “whistleblower” suit against his former employer – Keypath LLC, which he said shares ownership with DirectNIC – last August, but it was quickly settled out of court.
He alleged Keypath was engaged in a fraudulent domain arbitrage scheme using Yahoo Search Marketing and credit cards applied for in the name of bogus companies.
Keypath’s lawyers (who denied the links to DirectNIC) in turn accused Deshong of trying to extort the company for a larger severance package. The case was settled in October.
Now, in a Florida court filing (pdf), Verizon said it has subpoenaed Deshong for information related to its own case, which is currently tied up in pretrial discovery arguments.
He was scheduled to provide a deposition on Tuesday.
Verizon claims DirectNIC engaged in cybersquatting via shell companies such as Kenyatech/Kentech and Belize Domain WHOIS Service.
While there’s circumstantial evidence connecting the companies, CEO Sigmund Solares signed a sworn affidavit in a previous case denying Kenyatech and DirectNIC were affiliated.
Verizon’s interest in Deshong appears to be limited to information about DirectNIC’s ownership structure and its affiliations, rather than his allegations about domain arbitrage practices.

Surge in new domain registrars

ICANN is seeing a spike in newly accredited domain name registrars.
Since the start of the year, the organization has approved 16 new companies, compared to only about 40 in the whole of 2010.
About half a dozen of the new registrars appear to belong to domain investor Andrew Reberry of TurnCommerce, which owns domains such as Glossary.com, Bulldozers.com and Fluff.com.
Many of the others were accredited yesterday and have very generic registrar names, such as Host Name Services Inc, International Registration Services Inc and Online Name Services Inc.
There are no web sites associated with this latest batch yet, but I’d be surprised if many turn out to have sought accreditation with customer-facing domain services in mind.
This is pure speculation, but I wonder if any of this may be related to ICANN’s recent decision to loosen the restrictions on cross-ownership between registrars and registries.
If and when ICANN opens up its new top-level domains program to applications, which could happen as soon as August, potential registries will also be allowed to own registrars.
Could the market for flipping accredited companies return? It’s happened before, but it may not be the most efficient or economical way of achieving accreditation nowadays.
The uptick in newly approved registrars may of course just be an anomaly.

Network Solutions will sell .xxx domains

Network Solutions has become the first big-name registrar to show that it will support the proposed .xxx top-level domain.
This page has recently appeared on the NSI site, accessible from the company’s home page through the link “.xxx Coming Soon”.
NSI appears confident that ICANN will approve the TLD soon:

.XXX will be launching shortly and Network Solutions is working with ICM Registry to provide informational services for our customers that wish to take advantage of the launch and register domain names.

The TLD is currently being tied up by ICANN’s Governmental Advisory Committee, but many believe it’s likely to be a shoo-in at the San Francisco meeting in March or sooner.

eNom named “worst” for badware

Demand Media-owned eNom has been fingered as the worst company when it comes to hosting “badware”, according to the latest quarterly report from HostExploit.
The report puts eNom at number three in its overall league table of hosts involved (albeit generally unwittingly) in supporting malicious activity online, up from seven in the third quarter.
HostExploit conducts meta-research, looking at a number of factors (such as phishing and spam) normalizing and weighting data provided by a wide variety of sources.
eNom’s position on the list is based almost entirely on its ranking under the “badware” metric, which uses data supplied by StopBadware.org members Google, Sunbelt Software and Team Cymru.
Broken down by category, eNom scored 944 out of 1,000 in the fourth quarter, using HostExploit’s scoring system for badware. The network ranked second scored only 594.
What is badware? The report says:

Badware fundamentally disregards how users might choose to employ their own computer. Examples of such software include spyware, malware, rogues, and deceptive adware. It commonly appears in the form of free screensavers that surreptitiously generate advertisements, malicious web browser toolbars that take browsers to unexpected web pages and keylogger programs that transmit personal data to malicious third parties.

Other major domain name companies also rank in the top 50 worst hosts; 1&1, Oversee.net and Go Daddy occupy positions #35, #36 and #37. Google is at #28.
The HostExploit report appears to have been funded by the Nominet Trust.

Go Daddy files UDRP on “Mad Dog” host

Go Daddy has filed a UDRP complaint against a web hosting company that uses a similar brand to sell domain names, maddogwebhosting.com.
The domain appears to have been used by a small-time hosting reseller for about two years. Its mailing address is a flat in south London.
But Go Daddy subsidiary Mad Dog Domains, which also sells hosting, has been around for longer and appears to have a trademark on its brand.
It’s not really an open-and-shut case by UDRP standards, given that Mad Dog Web Hosting appears to be a legitimate site, but I suspect Go Daddy has a reasonably good chance of prevailing.
We’ll have to wait for the ruling to be made and published by WIPO to find out the full details.

Go Daddy passes 45 million domains milestone

Go Daddy now has 45 million domain names under management.
That’s the word from Scottsdale tonight. The news comes less than a year after the registrar announced its 40 millionth domain name registration.
According to the company, it “is registering, renewing or transferring a domain name every eight-tenths of a second” and is now “larger than eight of its closest competitors combined”.
Obviously, this is great news for Go Daddy.
It also means that the company is in a very dominant position in the market, which may attract more attention in future.

Go Daddy offers Whois privacy for .co domains

.CO Internet has started allowing registrars to offer Whois privacy services for .co domains, according to Go Daddy.
In a blog post, Go Daddy’s “RachelH”, wrote:

When the Internet Corporation for Assigned Names and Numbers (ICANN) and .CO Internet S.A.S. drafted the .co policy earlier this year, they decided to hold off on private registration to prevent wrongful use of the new ccTLD — especially during the landrush. Now that .co has carved its place among popular TLDs, you can add private registration to your .co domain names.

Unless I’m mistaken, ICANN had no involvement in the creation of .co’s policies, but I don’t think that’s relevant to the news that .co domains can now be made private.
During its first several months, .CO Internet has been quite careful about appearing respectable, which is why its domains are relatively expensive, why its trademark protections were fairly stringent at launch, and why it has created new domain takedown policies.
It may be a sign that the company feels confident that its brand is fairly well-established now that it has decided to allow Whois privacy, which is quite often associated with cybersquatting (at least in some parts of the domain name community).
It could of course also be a sign that it wants to give its registrars some love – by my estimates a private registration would likely double their gross margin on a .co registration.

Whistleblower alleged shenanigans at DirectNIC

A former employee of a company allegedly affiliated with domain name registrar DirectNIC claimed the company operated a fraudulent domain arbitrage scheme using Yahoo ads and Parked.com.
Mark Deshong filed a whistleblower lawsuit in August. It was settled in October, but its claims are quite interesting, and don’t appear to have been reported on elsewhere.
Until April this year, Deshong worked for a company called Keypath LLC, a domain registration and monetization company based in Tampa, Florida.
According to his lawsuit (pdf), Keypath is owned by the same bunch of people (notably Sigmund Solares and Michael Gardner) who run DirectNIC and Parked.com, as well as entities including Intercosmos Media Group and The Producers Inc.
Deshong said he was fired after blowing the whistle on a “fraudulent” scheme to bilk money out of Yahoo Search Marketing using the old practice of domain arbitrage.
The suit claimed Keypath bought ads on YSM to bring traffic to sites such as cameras.com that, in turn, displayed nothing but contextual ads generated automatically by YSM.
The company would pay Yahoo small amounts for the traffic it received, but would be paid larger amounts for the traffic it sent elsewhere.
That’s domain arbitrage in a nutshell. It was commonplace among domainers back in 2007 and earlier, and Keypath was far from the only company engaged in the practice.
Yahoo tried to put a stop to arbitrage on its ad network in February 2008, as Domain Name Wire reported at the time, but the lawsuit alleged that Keypath carried on regardless, using bogus identities.
This is when the “fraudulent” behavior is alleged to have commenced.
The suit claimed Keypath “created fictitious, unregistered DBA [Doing Business As] company names” in order to obtain up to 1,000 credit cards from Regions Bank.
The complaint, in an eyebrow-raising paragraph, goes on to list almost 100 of these alleged DBA companies’ names.
Each one of these companies would get a Gmail or Hotmail email address and a Skype phone number for the city where the “fictitious” company was supposedly based, the complaint alleged.
A proxy server would be obtained in each of these cities, which Keypath would use to access YSM and order ads pointing to parked pages, under the guise of one of the DBAs, the suit alleged.
The scheme covered about 50,000 domains and made about $375,000 during January 2010, according to the complaint.
The lawsuit was filed under Florida’s whistleblower act, so while it alleged multiple illegal acts (such as bank fraud and wire fraud) on Keypath’s part, it only attempted to prove wrongful termination.
Deshong basically claimed that he was canned after telling his superiors he could no longer carry out duties he believed to be illegal – he didn’t want to go to jail.
In its response (pdf) to the complaint, Keypath denied essentially all of Deshong’s claims.
It also denied that the company has ties to DirectNIC, Michael Gardner, Sigmund Solares, Intercosmos, Parked.com or The Producers.
(Probably a disingenuous claim. Florida company records show they’re all currently or recently linked to businesses located at 5505 West Gray Street in Tampa, Parked.com’s main US office. Keypath’s web site shows the same address).

Keypath also accused Deshong of a shakedown, attempting to “extort an unreasonable severance package”, and said that he had “improperly retained” a company laptop after he was fired.
The suit was settled out of court (pdf) on October 25th for an undisclosed sum.
The lawsuit is only tangentially related to the cybersquatting lawsuit Verizon filed against DirectNIC earlier this year. That case appears to be currently tied up in a pre-trial discovery/jurisdictional nightmare.

Register.com settles Baidu domain hijacking lawsuit

Register.com has apologised to Chinese portal company Baidu for allowing its domain, baidu.com, to be hijacked by the Iranian Cyber Army hacker group.
The two companies have announced that the lawsuit, which alleged gross negligence among other things, has now been settled. Terms were not disclosed.
If Baidu’s complaint was to be believed, the hackers took over baidu.com with a trivial social engineering attack that relied upon a Register.com tech support employee being asleep at the wheel.
The company is one of China’s largest internet firms, employing over 6,000 people and turning over well over $600 million a year. But for the period of the hijack, visitors to baidu.com instead just saw the hackers’ defacement message instead.
The registrar had argued in court that its terms and conditions released it from liability, but the judge didn’t buy it.
Register.com, which was acquired by Web.com for $135 million in June, said yesterday:

After an internal investigation, we found that the breach occurred because Register’s security protocols had been compromised. We have worked with United States law enforcement officials and Baidu to address the issue. We sincerely apologize to Baidu for the disruption that occurred to its services as a result of this incident.

Baidu said it accepted the apology. And the check, I imagine.