Africa gets its third ICANN registrar

It’s been over eight years since ICANN held its public meeting in Accra, but only now has Ghana got its first accredited domain name registrar.
Ghana Dot Com becomes Africa’s third ICANN-approved registrar, the first new accreditation on the continent since 2007.
The first African registrar was Burundi’s AfriRegister, the second Kheweul.com of Senegal.
Ghana Dot Com appears to be the dba of Network Computer Systems Ltd, the ISP that already manages Ghana’s .gh ccTLD.
Its chairman, Nii Quaynor, is a former member of the ICANN board of directors, elected in 2000 and serving until 2003.
Ghana has about 23 million citizens and almost one million internet users, according to InternetWorldStats.com.

ICANN switches off .mobi land-rush flipper

ICANN has terminated a domain name registrar that seems to have been made its business flipping land-rush domains, especially in .mobi.
Mobiline, doing business as DomainBonus.com, is an Israeli outfit that received its registrar accreditations about five years ago.
While it seems to have registered a very small number of domains, domainbonus.com did provide DNS for a few thousand dictionary .mobi domains, registered during the September 2006 land-rush.
A lot of these domains appeared to have been originally registered in the name of Mobiline’s owner, Alex Tesler.
Many have been since been flipped and archives of the DomainBonus front page show the firm was mainly preoccupied with aftermarket sales rather than fresh registrations.
ICANN has revoked its accreditation (pdf) for failure to pay its dues and escrow Whois data with Iron Mountain, as all registrars must.
ICANN is also switching off Western United Domains, a Spanish outfit that appears to have no web presence whatsoever, for the same reasons.

Registrars responsible for proxy cybersquatters

Domain name registrars can be liable when their customers break the law, if those customers use a privacy service, according to new ICANN guidance.
The ICANN advisory clarifies the most recent Registrar Accreditation Agreement, and seems primarily pertinent to UDRP cases where the registrar refuses to cooperate with the arbitrator’s request for proper Whois records.
The advisory says:

a Registered Name Holder licensing the use of a domain is liable for harm caused by the wrongful use of the domain unless the Registered Name Holder promptly identifies the licensee to a party providing the Registered Name Holder with reasonable evidence of actionable harm

In other words, if a domain gets hit with a UDRP claim or trademark infringement lawsuit, as far as the RAA is concerned the proxy service is the legal registrant unless the registrar quickly hands over its customer’s details.
Law enforcement and intellectual property interests have been complaining about registrars refusing to do so for years, most recently in comments on ICANN’s Whois accuracy study.
ICANN offers a definition of the word “promptly” as “within five business days” and “reasonable evidence” as trademark ownership and evidence of infringement.
I don’t think this ICANN guidance will have much of an impact on privacy services offered by the big registrars, which generally seem quite happy to hand over customer identities on demand.
Instead, this looks like it could be the start of a broader ICANN crackdown on certain non-US registrars offering “bulletproof” registrations to cybersquatters and other ne’er-do-wells.
I wouldn’t be surprised to find the number of ICANN de-accreditations citing refusal to cooperate with UDRP claims increasing in future.
The new ICANN document is a draft, and you can comment on it here.

AOL loses ICANN accreditation

AOL, one of the first five companies to become an ICANN-accredited registrar, appears to have let its accreditation expire.
The former internet giant is no longer listed on ICANN’s Internic registrar page, and DotAndCo.net’s data shows it lost its .com, .net and .org accreditations on April 27.
It’s hardly surprising. AOL’s profits are falling and it has been reorganizing itself ever since Time Warner returned it to life as an independent company last year.
It’s noteworthy because AOL was one of the first five registrars to challenge Network Solutions’ monopoly, when ICANN introduced competition to the domain name market in 1999.
In April 1999, the company participated in ICANN’s limited registrar “test-bed” experiment, alongside CORE, France Telecom, Melbourne IT and Register.com.
But domain names were never a big deal at the company.
AOL peaked at about 150,000 domains a few years ago and tailed off to a little more than a dozen at the end of 2009. Apparently, the company has decided to let its accreditation simply expire.

China connection to Go Daddy WordPress attacks

Go Daddy’s hosting customers are under attack again, and this time it looks like it’s more serious.
Reports are surfacing that WordPress sites hosted at Go Daddy, and possibly also Joomla and plain PHP pages there, are being hacked to add drive-by malware downloads to them.
Go Daddy has acknowledged the attacks, blaming outdated WordPress installations and weak FTP passwords, and has put up a page with instructions for cleaning the infection.
Last week, I was told that the first round of attacks was very limited. Today, the attackers seem to have stepped it up a notch.
As a result, Go Daddy could find itself in a similar situation to Network Solutions, which had a couple of thousand customer sites hacked a few weeks back.
The attacks appear to be linked to a well-known crime gang with a Chinese connection.
According to Sucuri, when a Go Daddy-hosted WordPress page is hacked, JavaScript is injected that attempts to redirect surfers to a drive-by attack from the domain kdjkfjskdfjlskdjf.com (don’t go there).
This domain was registered with BizCN.com, an ICANN-accredited Chinese registrar, but its name servers appear to have been created purely for the attack.
The registrant’s email address is hilarykneber@yahoo.com. This connects the attack to the “Kneber” botnet, a successful criminal enterprise that has been operating since at least December 2009.
A Netwitness study revealed the network comprised at least 74,000 hacked computers, and that the bulk of Kneber’s command and control infrastructure is based in China.
Since Kneber is known to be operated by a financially motivated gang, and it’s by no means certain that they’re Chinese, it’s probably inaccurate to suggest there’s something political going on.
However, I will note that Go Daddy was quite vocal about its withdrawal from the .cn Chinese domain name registration market.
Network Solutions, while it was quieter, also stopped selling .cn domains around the same time as the Chinese government started enforcing strict registrant ID rules last December.

Twenty registrars canned in 2009

ICANN shut down 20 domain name registrars in 2009, and is on course to do the same this year, according to numbers released today.
That’s up from seven de-accreditations in 2008, and twice as many as the previous record year, 2003.
ICANN can withdraw accreditation from a registrar, stopping its ability to register domains, if the registrar fails to escrow Whois information or pay its ICANN dues.
It looks like 2010 could well see a similar level of de-accreditations.
Five registrars were shuttered in the first quarter, and ICANN has sent warnings to five more this month.

Go Daddy plays down “massive” attack claim

Malicious hackers have compromised a number of WordPress installations running on Go Daddy hosting, but the company claims very few customers were affected.
Slashdot carried a story a few hours ago, linking to a blog claiming a “massive” breach of security at the domain name registrar.
(EDIT: as noted in the comments, this blog may itself have been hacked, so I’ve removed the link. You can find it in the comments if you want to take the risk.)
But Go Daddy says the problem is not as widespread as it sounds.
“We received reports from a handful of Go Daddy customers using WordPress their websites were impacted by the script in question,” Go Daddy security chief Todd Redfoot said in a statement.
“We immediately opened an investigation into what happened, how it was done and how many sites were affected,” he said. “The investigation is currently ongoing.”
The attack is certainly not ubiquitous. I host a number of WordPress sites with Go Daddy, including this one, and they all appear to be working fine today.
And a Twitter search reveals no references to an attack today prior to the Slashdot post, apart from the blog it was based on.
That doesn’t prove anything, but when Network Solutions’ WordPress hosting was breached last week there was a lot more tweet noise. That attack had thousands of victims.
For those interested in the details of the attack, this WordPress security blog appears to be the best place to get the nitty-gritty.

Go Daddy feature tallies Whois queries on your domain

I may be a bit late off the blocks, but I just learned about a rather nifty little feature buried within Go Daddy that lets you see when somebody has done a Whois lookup on one of your domains.
Log in to your Domain Manager, click Tools, click Exportable Lists, click Add New Export, then check the relevant boxes in the wizard.
The feature exports a .csv file telling you how many Whois searches have been run against each of your domain names in the last day, week, month and year.
I imagine this could provide a few useful data points when deciding how much interest there is in a domain you’re planning to sell.
I also found it quite interesting that more people executed Whois queries on domainincite.com in March than bothered to click the About tab at the top of the page.
Domain people are an odd bunch.

Demand Media gets pre-IPO board boost

Demand Media has added two big names to its board of directors, a move certain to feed the rumors that the company is preparing for an IPO this year.
Joining the board is Peter Guber, CEO and chairman of Mandalay Entertainment, a TV and movie production company that also has its fingers in the sports and digital media pies.
Josh James also takes a seat. He co-founded web analytics firm Omniture, now part of Adobe, and took it public during the dot-com boom.
“The experience they bring from two different ends of the spectrum – creative arts and web analytics – will be invaluable as Demand Media continues to focus on creating the content that consumers want,” Demand CEO Richard Rosenblatt said.
Demand Media, which owns domain name registrars eNom and BulkRegister, is mainly in the mass-market, search-driven content business.
It was reported last week that the company has hired Goldman Sachs to help it prepare for a public listing later this year.
Bulking up the board is one of the things companies do before they head to the stockmarket.

Network Solutions under attack again

Network Solutions’ hosting operation is under attack for the second time in a week, and this time it’s definitely not a WordPress problem.
The company has acknowledged that it has “received reports that Network Solutions customers are seeing malicious code added to their websites”, but has not yet released further details.
Sucuri.net, which was intimately involved in the news of the hack against NSI’s WordPress installations last week, blogged that this time the attacks appear to have compromised not only WordPress, but also Joomla-based and plain HTML sites.
Last week’s attacks were eventually blamed on insecure file permissions, which enabled shared-server hosting customers to look at each other’s WordPress database passwords.
But today NSI, one of the top-five domain name registrars, said: “It may not be accurate to categorize this as a single issue such as ‘file permissions’.”
Sucuri said that malicious JavaScript is being injected into the sites, creating an IFrame that sends visitors to drive-by download sites.
It’s a developing story, and not all the facts are out yet.
But it’s clear that NSI has a public relations problem on its hands. Some customers are already using Twitter to declare that they will switch hosts as a result.
And if it’s true, as Sucuri reports, that Google is already blocking some of the affected sites, who can blame them?