Domain name hijacker gets jail time

A man who hijacked Comcast’s domain name, causing hours of outages for the ISP’s customers, has been sentenced to four months in jail.
James Black, who went by the handle “Defiant”, will also have to serve 150 hours of community service, three years of supervised release, and pay Comcast $128,557 in restitution.
Assistant United States Attorney Kathryn Warma told the court:

Mr. Black and his Kryogenicks crew created risks to all of these millions of e-mail customers for the simple sake of boosting their own childish egos.

The attack took place over two years ago. Kryogenicks reportedly used a combination of social engineering and technical tricks to take over Comcast’s account at Network Solutions.
During the period of the hijacking, comcast.net redirected to the hacker’s page of choice. All Comcast webmail was unavailable for at least five hours.

Digging for dirt in the Demand Media IPO – roundup

Demand Media, parent of second-largest domain name registrar eNom, has filed to go public, and the publication of its S-1 registration document has given an unprecedented glimpse inside the company.
Unsurprisingly, the “content mill” part of Demand’s operation, which accounts for more than half of its revenue, has garnered the most media coverage over the weekend.
Demand says that the fact that is “transforming traditional content creation models” and is “frequently the subject of unflattering reports in the media about our business and our model.”
Reports of its IPO are no exception.
This report in DailyFinance.com observes that the key difference between Demand and traditional media is that Demand does it “at scale”, with some 10,000 writers producing 5,700 articles per day.
DaniWeb notes that Demand’s freelancers are “working for wages often well below industry standard to churn out content” and said the company is subject to “redundancies, inefficiencies and the reliance on trying to game Google”.
Others are more direct: “wtf: this is why the Internet is full of unreadable junk”
CNNMoney.com reports that Demand is “notorious” for paying as little as $15 per article, and that it can make a 58% return on a month’s articles over seven quarters.
As a freelancer reporter, I don’t like Demand’s model either. I think it devalues the profession. The S-1 reveals that the company is well aware that it’s also quite exploitative:

We believe that over the past two years our ability to attract and retain freelance content creators has benefited from the weak overall labor market and from the difficulties and resulting layoffs occurring in traditional media, particularly newspapers. We believe that this combination of circumstances is unlikely to continue and any change to the economy or the media jobs market may make it more difficult for us to attract and retain freelance content creators.

On the domain name side of the business, DomainNameWire was quickest off the mark, digging out the fact that eNom uses look-ups by prospective registrants to decide what articles might be profitable and what web sites it could develop.
The S-1 says:

These queries and look-ups provide insight into what consumers may be seeking online and represent a proprietary and valuable source of relevant information for our platform’s title generation algorithms and the algorithms we use to acquire undeveloped websites for our portfolio.

eNom has already said that this should NOT be interpreted as “front-running”. (apologies, the first version of this article accidentally omitted the word “not”)
Also found in the S-1, and already known from eNom’s registration agreement Ts & Cs, the company keeps some customers’ expired domain names for itself, if they have value.
I can remember a time not too many years ago when this kind of behavior was frowned upon.
DNW also points to the list of Demand’s subsidiaries. There are 146 of them, at least 100 of which are shells for ICANN registrar accreditations.
Others, such as Acquire This Name, which KnuJon had beef with (pdf) a year ago, act as eNom resellers.
Looking at the financials, All Things Digital gently mocks the company’s reliance on non-standard “Adjusted OIBDA” numbers in its S-1 to make the company appear profitable.
Meanwhile, Mike Berkens at TheDomains is incredulous looking at the amount of money Demand has lost since its inception: some $52 million.

ICANN threatens to shut down registrar flipper

ICANN has said it will terminate one of its registrars for non-payment of fees, the thirteenth such threatening letter the organization has sent out this year.
The unfortunate recipient is #1 Host Brazil, which has just a couple hundred domains under its belt in the generic top-level domains.
I may be wrong, but based on some cursory research I’m inferring that the registrar is basically a shell accreditation, acquired in order to flip to a larger registrar.
There are 10 other “‘#1 Host” registrars, such as #1 Host Australia and #1 Host Canada, listed on ICANN’s list of accredited registrars, almost all of which were awarded in late 2005 to the same Texan.
They all use the same logos and, due to the hash sign, all appear at the top of alphabetical lists of ICANN-accredited registrars.
Apart from the Brazil and Israel variants, most of the other “#1” accreditations have been acquired by Moniker at various times over the last few years, according to Internic and Whois records.
#1 Host Brazil faces de-accreditation (pdf) on August 24 unless it pays almost $9,000 in ICANN fees and provides evidence of $500,000 in commercial liability insurance.

Using Go Daddy equals “bad faith” registration

Registered a domain name with Go Daddy recently? Unless you’ve updated your name server settings, you’ve automatically committed a “bad faith” registration.
At least, that’s the conclusion I’m drawing from a couple of recent clueless UDRP decisions.
The most recent example is the case of Churchill Insurance, which just won churchillimports.com, following a proceeding with the National Arbitration Forum.
The registrant claimed he planned to use the domain, which he registered just six months ago, to sell cigars. Seems reasonable. Other sites sell cigars using the name “Churchill”.
But the NAF panelist, Flip Petillion, wasn’t buying it:

Respondent uses the churchillimports.com domain name to resolve to a directory website that displays links to third-party websites, some of which provide insurance products and services that compete with Complainant’s business.
…
it is shown on a balance of probability that Respondent uses the disputed domain name to operate a directory website and, thus, profits from this use through the receipt of “click-through” fees. Accordingly, the Panel finds that this use constitutes bad faith registration and use pursuant to Policy
…
as the disputed domain name was registered after the registration of Complainant’s established trademark rights and given the fact that Respondent’s website employs insurance themed links that resolve to websites of Complainant’s competitors, Respondent could not have registered and used the disputed domain name without actual or constructive knowledge of Complainant and its rights in the CHURCHILL mark.

What Petillion clearly failed to realize – or decided to conveniently ignore – is that everything he ascribes to the registrant was actually caused by default Go Daddy behavior.
Churchill sells car insurance in the UK. The registrant is an American, from Georgia. There’s a very slim chance he’d ever heard of the company before they slapped him with the UDRP.
But Petillion decided that the fact that insurance-themed links were present on the site shows that the registrant must have known about the company. Like he put the links there himself.
He concludes the registrant had “bad faith” because Go Daddy’s parking algorithm (I believe it’s operated by Google) knows to show insurance-related ads when people search for “churchill”.
In addition, churchillimports.com is the default parking page that Go Daddy throws up whenever a domain name is newly registered.
The registrant didn’t need to do anything other than register the name and, according to this bogus ruling, he’s automatically committed a bad faith registration.
Where does NAF find these people?
I’m sure I’m not the first to notice this kind of behavior, and I’m sure Go Daddy’s not the only registrar this affects.

ICANN un-terminates domain name registrar

In what I believe is an unprecedented move, ICANN has renewed a domain name registrar’s accreditation having already sent it a public notice of non-renewal.
A Technology Company, aka ATECH, was told last month that its accreditation would expire July 12 because it had failed to pay over $5,600 in ICANN fees.
That letter (pdf) suggested that ATECH had been in breach since before April 2009.
On all previous occasions, whenever ICANN has posted a notice of termination or non-renewal on its site, it’s game over for that registrar.
Today, a brief note on ICANN’s web site says simply:

A Technology Company, Inc. cured all outstanding contract breaches as of 30 June 2010. A Technology Company, Inc.’s accreditation was renewed on 13 July 2010.

As I’ve previously noted, ATECH and .xxx registry hopeful ICM Registry share a common founder, although the two companies are no longer affiliated.

Registrar linked to .xxx loses ICANN accreditation

A Technology Company Inc, a registrar previously linked to the .xxx top-level domain application, has lost its ICANN accreditation for non-payment of fees.
The company, which is also known as NameSystem.com or ATECH, was founded by Jason Hendeles, who is also the founder of ICM Registry, the company behind .xxx.
ICANN has informed ATECH (pdf) that its accreditation will expire and not be renewed on July 12 because it has failed to pay $5,639 in ICANN fees.
ATECH was one of the second wave of competitive registrars to go live, applying for its ICANN accreditation all the way back in 1999. It currently has just a few thousand domains under management.
Hendeles, currently ICM’s vice president of strategic business development, was behind ICM’s original .xxx bid, filed in ICANN’s 2000 round of new TLD applications.
ICM was subsequently taken over by British businessman Stuart Lawley, its current chief executive.
I’m told ATECH was sold to Alok Prakash of Oregon a few years ago.
UPDATE 2010-07-14: ATECH has evidently coughed up, and has regained its accreditation.

Aussie registrar trademarks “Whois”

An Australian domain name registrar has secured a trademark on the word “Whois”.
Whois Pty Ltd, which runs whois.com.au, said it has been granted an Australian trademark on the word in the class of “business consulting and information services”.
It looks rather like the company is using the award as a way to promote its own trademark protection services.
I shudder to think what could happen if the firm decided to try to enforce the mark against other registrars.
Or, come to think of it, what would happen if it tried to secure “whois” in a new TLD sunrise period.
I’m not a lawyer, but I imagine that the fact that the word “Whois” has been in use for almost 30 years, pre-dating the creation of the DNS itself, might prove a useful defense.
RFC 812, published in March 1982, is the first use of the word I’m aware of.
It does not appear that there are currently any live US trademarks on the term.

ICANN registrar’s domain listed for sale on Sedo

When selecting a domain name registrar there are often clues you can use to determine broadly whether a firm is entirely reliable, but this one is new to me.
Vivid Domains, a small-time, seven-year-old ICANN-accredited registrar, currently has its primary domain, vividdomains.com, listed for sale on Sedo.
It’s listed as a “domain without content” too, which looks even more peculiar.
According to DotAndCo, the company recently relocated from Florida to Grand Cayman.
WebHosting.info notes that, having chugged along for some time with only a few hundred domains under management, Vivid’s registration base has leapt from about 400 to over 1,900 in the last two weeks.
KnujOn’s registrar audit report (pdf), released at ICANN Brussels last week, notes that the anti-spam company was unable to locate a business registration for Vivid.
I’m not suggesting Vivid is dodgy, but these are the kind of clues I would use when deciding whether to give a registrar a wide berth.

Register.com sold at a $65 million loss

Register.com has been acquired by web hosting company Web.com for $135 million, substantially less than the $200 million Vector Capital paid for it five years ago.
Web.com said the acquisition will help it access new small business customers for lead generation, to cross-sell its existing products.
The company’s customer base will increase by over 400% to more than one million customers, Web.com said. The combined firm will have annual revenue of $180 million.
Register.com was one of the first five ICANN-accredited registrars. It failed as a public company, and after years of financial wrangling was finally taken private by Vector in 2005.
Vector specializes in buying up troubled companies and turning them around, but it doesn’t appear to have increased the value of this particular asset over the last five years.

More WordPress attacks at Go Daddy

The Kneber gang has continued its attacks on Go Daddy this week, again targeting hosting customers running self-managed WordPress installations.
Go Daddy said that several hundred accounts were compromised in order to inject malicious code into the PHP scripts.
“The attack injects websites with a fake-antivirus pop-up ad, claiming the visitor’s computer is infected,” Go Daddy security manager Scott Gerlach blogged.
According to the alarmists-in-chief over at WPSecurityLock, the attacks place a link to a script hosted on cloudisthebestnow.com, a domain registered by “Hilary Kneber”.
The script attempts to install bot software on visitors’ machines.
As I’ve written before, the Kneber botnet has been running since at least December 2009. It generally hosts its malware on domains registered with ICANN-accredited BizCN.com, a Chinese registrar.
Go Daddy said it has contacted the registrar to get the domain yanked. It may have been successfully killed already, but I’m too much of a little girl to check manually.
I must confess, as somebody with a number of WordPress installations on Go Daddy servers, it makes me a little nervous that these attacks are now well into their second month and I still don’t know whether I should be worried or not.