Glitch redux: ICANN screws up new gTLD security again

No lessons learned from 2012? ICANN admitted this morning that a glitch in its Registry Service Provider Evaluation Program exposed the identities of more than a dozen companies to their rivals.

The Org fessed up that some companies looking to get pre-approved as RSPs were able to see “identifiable organizational information” belonging to another user when using ICANN’s technical testing system.

“A total of 14 of 26 organizations using RST OT&E were affected. All affected organizations have been notified,” ICANN said. “No personal data was exposed, with the exception of a single minor and limited instance.”

It doesn’t sound like any gTLD application intentions were revealed — that part of the program doesn’t open until next year.

There were probably not too many surprises among the leaks. The landscape of the RSP market is well understood.

The only exceptions that spring to mind would be ccTLD registries that have not yet revealed their plans for the gTLD space, and completely new market entrants that have not yet tipped their hand.

The glitch sounds remarkably familiar for ICANN watchers with long memories. A bug discovered in 2015 exposed much more data, and about applicants themselves, but it was only exploited by one person on a handful of occasions.

That “glitch” led to allegations of hacking and trade secret theft and a long-running Independent Review Process case that wasn’t resolved until October 2023.

ICANN said it has taken down its testing environment to fix the bug and has hired an outside consultant to kick the tires.

This delay means testing will be offline for around two weeks, coming back November 12 at the earliest, and the reveal date for the list of participating RSPs has been pushed back from December 9 to an unspecified future date we realistically have to assume will be in the new year.

It’s not expected to delay the April 2026 opening of the next application round.

CentralNic claims second-largest TLD migration ever

CentralNic today boasted that it successfully completed the migration of the .co TLD from GoDaddy to its own servers earlier this month, claiming the number two spot in the record books.

The company, part of Team Internet, said it moved more than 3.3 million .co domains to its registry back-end on October 4. The process took 29 hours, it said in a press release.

The 3.3 million number confirms .co’s place as the second-largest TLD migration, ahead of the 3.1 million .au names moved from Neustar to Afilias in 2018, but behind the four million .in names moved from GoDaddy to Tucows completed this May.

.io sales almost double over three years

The .io ccTLD continues to be a cash cow, with sales up 6.70% in 2024, according to the registry’s latest financial filing.

The company also faced its largest-ever UK tax bill last year, at a time when the future of .io came under sharp focus due to the imminent dissolution of the British Indian Ocean Territory to which .io is assigned.

UK-based Internet Computer Bureau last month reported revenue for 2024 of £31.6 million ($42.4 million), up from £29.6 million ($39.7 million) in 2023. Revenue has grown 93% since 2021, mostly due to a spike in 2022.

While ICB, an Identity Digital subsidiary, also runs .ac and .sh, the vast majority of its business is certainly in .io, a popular ccTLD with tech start-ups.

The company is essentially a single-employee shell, structured to pass the vast majority of its revenue to US-based parent Identity Digital. Its gross margins are barely 4%, an implausibly low number for a .com-comparable, high-volume registry business.

ICB reported operating profit for 2024 of £1.6 million ($2.1 million), reversing a loss of £1.7 million in 2023. But its bottom line was bolstered by £2 million of unspecified investment income, leading to profit after tax of £2.8 million ($3.7 million).

The UK tax bill was almost three times as large as any previous year at £807,000 ($1 million) seemingly due to this investment income.

The future of .io is still ambiguous, after the UK and Mauritius signed a treaty to transfer sovereignty over BIOT, which is also known as the Chagos Archipelago. Implementation of the treaty is currently being enacted by both countries’ legislatures.

A UK diplomatic team recently met with Mauritius’ prime minister to discuss the transfer of power, and the discussions reportedly touched on the “domaine Internet”.

A Mauritian newspaper reported that the discussions covered “l’avenir du domaine Internet, qui représente un enjeu économique intéressant pour Maurice”, which could translate as “the future of the Internet domain — which represents an interesting economic opportunity for Mauritius”.

The industry trend at the moment is for the governments of countries with popular ccTLDs to put the squeeze on their registry operators, but neither the UK nor Mauritius has a direct governance or contractual relationship with .io.

Amazon delays book and fashion gTLDs

Two gTLD launches pencilled in for next month seem to have been delayed a year.

Amazon Registry has filed updated launch dates for two Japanese-language TLDs: .書籍 (.xn--rovu88b), meaning “book”, and .ファッション (.xn--bck1b9a5dre4c), meaning “fashion”.

Both had been previously scheduled to go to general availability in early November, but new dates published by ICANN have pushed both back to the same dates in 2026.

Both have already completed their mandatory sunrise periods, back in late 2016. If they do go GA next year, it will have been a full decade between trademark protection and free-for-all.

Amazon has been slowly releasing its long-dormant stockpile of gTLDs recently. Three — .you, .talk and .fast — went GA earlier this month. Three others — .free, .hot and .spot — launched in the first half of the year.

.mobi to get a new rival in .mobile

There’s a new registry player in town. Dish DBS is preparing to launch the .mobile gTLD, which has been dormant for almost a decade, according to notes on its web site.

The first phase of the launch — sunrise — has been pencilled in for 30 days from November 10. If ICANN’s been informed of the launch dates, it has not yet officially published them on its own web site.

The launch plan would see a limited registration period targeting mobile phone operators running until early February. That would be followed by a 12-day Early Access Period and a February 19 general availability launch.

The plan is to have .mobile a fully open unrestricted space positioned as a “modern, mobile-first domain extension designed for life in motion – perfect for creators, startups, professionals, and forward-thinking brands.”

I’m expecting this to be the first of several launches from Dish, which has been sitting on a portfolio of a dozen gTLDs — the others are .sling, .dish, .latino, .dot, .ott, .ollo, .blockbuster, .dtv, .dvr, .phone, and .data — from the 2012 round.

Dish seems to be deep in bed with Tucows, its back-end registry services partner, on the revitalized portfolio.

The launch of .mobile of course will be viewed in the context of .mobi almost two decades ago, which was hyped at a time of gTLD scarcity and heavily speculated.

Now under Identity Digital, .mobi peaked at over 1.2 million registered domains in 2013 but has been in a death spiral ever since as investors cut their losses. It now sits at around 265,000 domains.

The original plan for .mobi, which was applied for four years before the launch of the first iPhone, was to provide a namespace where phone users could be assured that a site would be compatible with their phones. It looks incredibly naive in hindsight.

Dish did not have the same idea for .mobile. It wanted .mobile as a single-registrant space where only itself and its affiliates could register names, but that plan was scuppered when ICANN retroactively banned such models.

Bye-bye .boomer! Blockchain players abandon new gTLD plans

A dozen organizations that were planning to apply to ICANN for a new gTLD next year have abandoned their ambitions.

Unstoppable Domains said recently that 12 partners offering blockchain-based alt-TLDs have confirmed they no longer expect to apply for a matching gTLD when the Next Round opens next year.

The affected blockchain extensions are: .bald, .basenji (formerly .benji), .bay, .boomer, .calicoin, .caw, .cgai, .donut, .mery, .mumu, .nibi and .pendle.

Because some buyers may have hoped to grab the matching DNS domain if and when the matching gTLD got delegated, Unstoppable said it will offer refunds to anyone who registered a name in any of these extensions.

It’s also added “Applying to ICANN 2026” and “Not applying to ICANN 2026” tags to search results on its storefront.

The refunds don’t apply to alt-TLDs that could never have applied to ICANN because the string breaks the rules in some way (for example being numeric or too short).

Unstoppable wants to be a registry back-end

Unstoppable Domains has applied to ICANN to become a back-end registry services provider, according to the company’s CEO.

Matt Gould told DI that the company is currently going through the Registry Service Provider Evaluation Program, which pre-approves RSPs prior to next year’s next round of applications.

There are 27 companies with applications submitted to the program, according to ICANN’s latest stats, but Unstoppable is the first confirmed market newcomer.

The company is a recently accredited registrar, but is best-known for selling names on non-DNS blockchain naming systems.

Gould said Unstoppable plans to use its RSP accreditation for its own gTLD applications and those of its crypto-company clients. It doesn’t sound like it will be aggressively competing for customers in the traditional DNS space.

The accreditation is necessary because Unstoppable intends to vertically integrate, marrying traditional DNS with on-chain names in its gTLDs, so extra technical work is needed, Gould said.

Unstoppable is building its registry infrastructure using Google’s open-source Nomulus software, he said.

Registry to release one-letter domains tomorrow

People looking for a single-character domain name in a two-character ccTLD will have a new option from tomorrow.

Adsib, the registry for Bolivian ccTLD, plans to make one and two-character domains directly under .bo on September 4.

There are no restrictions on how many domains a person may register, not are there any local presence requirements, according to the registry’s new policy document.

It’s not clear yet whether there will be premium pricing for SCDNs. Regular pricing for a second-level .bo domain from the registry is BOB 980 (about $140). Overseas registrars mark up by about $50.

The new policies come as part of a broader sweep by Adsib that also updates rules on banned content, restricted second-level spaces, transfers and subdomains, among other things.

New ICANN funding rules will cost smaller ccTLDs more

The way ccTLDs fund ICANN is being reformed, with some registries set to pay thousands of dollars more to the Org’s annual budget.

The new rules, adopted by the ccNSO late last week, won’t affect the largest ccTLDs like .de and .uk, but they could drag mid-tier and the smallest registries into higher tax bands.

The funding model, last adjusted in 2013, is based on each registry’s number of domains under management. The suggested contribution is fixed, rather than per-domain, and depends on which DUM range a ccTLD falls into.

The newly approved bands see the top two tiers unchanged — with over five million names the due is $225,000, and over 2.5 million it’s $150,000.

The third tier, which captures at least 14 ccTLDs from the likes of Denmark, Japan and Mexico, starts at 1.2 million names (a change from one million in the 2013 guidelines) and continues to suggest a $75,000 donation.

Moving the threshold from a million to 1.2 million doesn’t seem to affect many registries. Of the ccTLDs I have up-to-date stats for, only South Korea and possibly Montenegro appear to benefit from the change.

Band D, which affects about a dozen ccTLDs from the likes of Malaysia, Norway and New Zealand, is seeing its contributions go up from $25,000 to $35,000, but the threshold is rising from 500,000 domains to 600,000.

This means that .ai would have to pay the higher rate, but historically Anguilla has not contributed to ICANN at all.

As the ccNSO is at pains to point out, ccTLD contributions are all voluntary, and the bands are suggestions rather than binding.

Fees for the smaller ccTLDs seem to have seen the most rejiggering, with three new low-end tax bands being introduced for registries with the lowest DUM counts. There are now 10 bands in total rather than seven.

Under the 2013 guidelines, any ccTLD with under 50,000 names was only asked to pay $500 a year. That lowest threshold has now been reduced to 10,000 names, raising dozens of registries into higher bands.

Countries such as Ecuador, Azerbaijan and Algeria, and the French department of Réunion, will now be asked to asked to pay $2,500, up two grand a year.

The contributions are designed to pay for the services ICANN provides ccTLDs, but the overall amount is pretty small compared to the Org’s overall budget.

The ccNSO has calculated that the 2013 model affected 255 ccTLDs and would raise as much as $4 million for ICANN a year. That would change to $4.7 million from 306 ccTLDs under the 2025 model.

But that’s only if everyone plays ball. In reality, only 109 ccTLDs gave ICANN anything at all in its last-reported year, and the total take was $2.1 million. Some registries, from the UK, Israel and Russia, cut or eliminated their funding.

Since its start of the voluntary contribution model, fewer than half of all ccTLD registries have ever given ICANN any money.

.ai rival lines up gTLD bid

The increasingly popular .ai top-level domain looks like it could have its first full competitor before long.

An organization called 0G Foundation, which says it has made a “decentralized AI operating system”, has announced plans to apply to ICANN for the new gTLD .agi next year.

AGI stands for “artificial general intelligence”, considered by many to be the end goal of AI technology development, where software possesses intelligence equivalent to or better than a human.

0G made the announcement via Unstoppable Domains, its application partner.

The organization plans to make .agi names available on its own proprietary blockchain first, with a “limited-time pre-sale” before launch “in the coming months”.

Unstoppable is selling .agi “reservations”, with prices starting at $5 for gibberish and potentially valuable dictionary words carrying premium price tags.