Nominet to give nod to .uk privacy services

Nominet plans to start accrediting proxy/privacy services in .uk domain names, and to make it easier to opt-out of having your full contact details published in Whois.
The proposed policy changes are outlined in a consultation opened this morning.
“We’ve never recognized privacy services,” director of policy Eleanor Bradley told DI. “If you’ve registered a .uk with a privacy service, we consider the privacy service to be the registrant of that domain name.”
“We’ve been pretending almost that they didn’t exist,” she said.
Under the proposed new regime, registrars would submit a customer’s full contact details to Nominet, but Nominet would publish the privacy service’s information in the domain’s Whois output.
Nominet, getting its hands on the customer data for the first time, would therefore start treating the end customer as the true registrant of the domain.
The company says that introducing the service would require minimal work and that it does not intend to charge registrars an additional fee.
Currently, use of privacy services in .uk is pretty low — just 0.7% of its domains, up from 0.09% a year ago.
Bradley said such services are becoming increasingly popular due to some large UK registrars beginning to offer them.
One of the reasons for low penetration is that quite a lot of privacy is already baked in to the .uk Whois database.
If you’re an individual, as opposed to a “trading” business, you’re allowed to opt-out of having any personal details other than your name published in Whois.
A second proposed reform would make that opt-out available to a broader spectrum of registrants, Nominet says.
“We’ve found over the last few years that it’s quite a hard distinction to draw,” Bradley said. “We’ve had some criticisms for our overly strict application of that.”
In future, the opt-out would be available according to these criteria:

i. The registrant must be an individual; and,
ii. The domain name must not be used:
a) to transact with customers (merchant websites);
b) to collect personal data from subjects (ie data controllers as defined in the Data Protection Act);
c) to primarily advertise or promote goods, services, or facilities.

The changes would allow an individual blogger to monetize her site with advertising without being considered a “trading” entity, according to Nominet.
But a line would be drawn where an individual collected personal data on users, such as email addresses for a mailing list, Bradley said.
Nominet says in its consultation documents:

Our continued commitment to Nominet’s role as the central register of data will enable us to properly protect registrants’ rights, release contact data where necessary under the existing exemptions, and maintain public confidence in the register. It acknowledges that some registrants may desire privacy, whilst prioritising the core function of the registry in holding accurate records.

The proposals are open for comments until June 3, which means they could potentially become policy later this year.

Rightside to release 20,000 two-character domains

A week from now, new gTLD registry Rightside is to release over 20,000 two-character domain names.
The releases will come across all of its delegated gTLDs, but exclude letter-letter combinations.
Only letter-number, number-letter and number-number combinations will be available, following ICANN’s partial lifting of the ban on two-character domains back in December.
Strings such as “a1”, “2b” and “69” will presumably become available.
Rightside said the domains will be sold on a first-come, first-served basis, with prices ranging from $200 to $50,000.
The registry has almost 30 delegated new gTLDs, including .auction, .software, .lawyer, .sale and .video.
If you’re interested, set your alarms for 1700 UTC on March 18. That’s when all 20,000 drop.
Two-letter domains are still reserved, pending the outcome of ICANN’s government-delayed release process.

Adware dominating popular new gTLD ranks

Afilias’ .kim has become the latest victim (beneficiary?) of adware, as robo-registrations boost the gTLD’s zone file and apparent popularity.
It’s the latest new gTLD, after .xyz and .country, to see its rankings soar after hundreds of gibberish, bulk-registered domains started being used to serve ads by potentially unwanted software.
.kim is today the 4th most-popular new gTLD, with 85 domains in the top 100,000 on the internet and 264 in the top one million.
A month ago, it had a rank of 223, with just 16 domains in the top one million.
The domain names involved — gems such as oatmealsmoke.kim, vegetableladybug.kim and tubhaircut.kim — have seen a boat-load of traffic and rocketing Alexa rank.
The reason for the boost seems to be a one-off bulk registration of about 1,000 meaningless .kim domain names in early February, which now appear to be being used to serve ads via adware.
In this chart (click to enlarge), we see .kim’s zone file growth since the start of 2015.

The spike on February 5, which represents over 1,000 names, is the date almost all of the .kim names with Alexa rank were first registered.
They all appear to be using Uniregistry as the registrar and its free privacy service to mask their Whois details.
These domains often do not resolve if you type them into your browser. They’re also using robots.txt to hide themselves from search engines.
But they’ve been leaving traces of their activity elsewhere on the web, strongly suggesting their involvement in adware campaigns.
It seems that the current (ab?)use of .kim domains is merely the latest in a series of possibly linked campaigns.
I noted in January that gibberish .country domains — at the time priced at just $1 at Uniregistry — were suddenly taking over from .xyz in the popularity charts.
The following three charts, captured from DI PRO’s TLD Health Check, show how the three TLDs’ Alexa popularity rose and fell during what I suspect were related adware campaigns..
First, .xyz, which was the first new gTLD to show evidence of having robo-registrations used in adware campaigns, saw its popularity spike at the end of 2014 and start of 2015:

Next, Minds + Machines’ .country, which saw its zone file spike by 1,500 names around January 6, starts to see its Alexa-ranked total rocket almost immediately.
.country peaks around February 9, just a few days after the .kim robo-registrations were made.

Finally, as .country’s use declines, .kim takes over. Its popularity has been growing day by day since around February 13.

I think what we’re looking at here is one shadowy outfit cycling through bulk-registered, throwaway domain names to serve ads via unwanted adware programs.
It seems possible that domains are retired when they become sufficiently blocked by security countermeasures, and other domains in other TLDs are then brought online to take over.
None of this necessarily reflects badly on any of the new gTLDs in question, or even new gTLDs as a whole, of course.
For starters, I’ve reason to believe that TLDs such as .eu and .biz have previously been targeted by the same people.
The “attacks”, for want of a better word, are only really noticeable because the new gTLDs being targeted are young and still quite small.
It takes much longer to build up genuine popularity for a newly launched web site than it does to merely redirect exist captive traffic to a newly registered domain.
What it may mean, however, is that .kim and .country are going to be in for statistically significant junk drops about a year from now, when the first-year registrations expire.
For .kim, 1,000 names is about 14% of its current zone file. For .country, it’s more like a quarter.
The daily-updated list of new gTLD domains with Alexa rank can be explored by DI PRO subscribers here. The charts in this post were all captured from the respective TLD’s page on TLD Health Check.

.porn now the biggest new gTLD sunrise

.porn and .adult have taken the crown of the most-subscribed new gTLD sunrise periods to date.
The two ICM Registry spaces opened up for registrations from users of the Trademark Clearinghouse on March 2.
A little over a week later, the company tells DI that both gTLDs have individually exceeded the previous sunrise record holder.
My understanding is that .london was the new gTLD with the most sunrise registrations, selling just over 800 names to TMCH customers during its combined sunrise/landrush, which ended last July.
ICM revealed in a webinar last week that it expected its new gTLDs to have to biggest sunrise numbers to date.
“Both .porn and .adult will have exceeded that [.london] number comfortably,” ICM president Stuart Lawley confirmed to DI today.
.adult is “almost neck and neck” with .porn, Lawley said.
The numbers are still pretty small compared to ICM’s 2003-round gTLD, .xxx, which had over 80,000 sunrise applications in October 2011.
They’re also pretty small compared to the TMCH’s overall number of registrations, which at the last public disclosure was a little under 35,000.
But ICM has another couple opportunities for trademark owners to defensively register that may work out cheaper.
First, from April 6 to April 30 companies that bought non-resolving “blocked” names in the .xxx Sunrise B will be able to block the same strings in .porn and .adult.
ICM says registrars are offering discounts for five-year blocks.
Then, from May 6 to May 31 the Domain Matching program starts. That’s open to any .xxx registrant, defensive or otherwise, but not to those with .xxx Sunrise B blocks.

.xxx to sell at .com prices to pump .porn launch

ICM Registry is to offer .xxx domain names at dramatically reduced prices, which could be in line with .com pricing at some registrars, for the month of April.
At least one registrar plans to offer .xxx names at about $13 for the duration of the offer.
.porn and .adult are set to go to general availability June 4. Before then, there will be a series of launch phases aimed at giving trademark owners and .xxx registrants plenty of opportunity to defensively register.
One phase, Domain Matching, will run from May 6 to May 31.
During DM, owners of .xxx names will be able to get their matching .porn and .adult domains (assuming they haven’t been claimed in the prior sunrise periods) at a reduced fee.
The discount period in April will enable registrants to pre-qualify for .porn’s Domain Matching by buying .xxx names at a much reduced price.
.porn and .adult prices during general availability are expected to be the same as in .xxx, which retails for around $100 ($62 going to ICM).
I don’t know what ICM’s registry fee during the discount period is, but the registrar EnCirca said it plans to sell a bundle of .xxx, .porn and .adult for $39 during April, which works out to $13 each.
EnCirca and 101domain appear to be pricing DM for a registration in a single TLD at about $19.
ICM’s gesture follows its admission in November that .xxx registrants would not get the free, perpetual block of matching .porn and .adult names that the registry had originally planned to offer.
The company has run a deep-discount program once before, in May 2013, when it sold .xxx at .com prices and saw 13,136 adds, compared to 1,131 in the previous month.

Donuts bought .reise

Donuts has been confirmed by a German news site as the new owner of .reise, which was auctioned by its previous owner last week.
It was the first time a live gTLD had been sold at auction.
The deal, which is believed to have cost Donuts at least $400,000, means the company now owns .reise and .reisen.
Both mean “.travel”. According to my GCSE German skillz, last exercised 22 years ago, .reisen is a verb and .reise is a noun, but .reisen is also the plural of the noun .reise.
I believe this means that Donuts is the first company to own both the plural and singular forms of a new gTLD string.
Heise Online reports that former registry Dotreise was forced to sell up due to competition from Donuts.
Donuts’ .reisen has over 4,000 names in its zone file, compared to .reise’s 1,300. It’s a small market so far, but Donuts has the lion’s share.
The article notes that Donuts got a better position in ICANN’s prioritization draw in late 2012, meaning it got to market slightly earlier. Donuts also sells for a much lower price.
I doubt time to market was as much of a factor as price.
But it might be interesting to note that while Donuts’ advantage was just six days in terms of contract-signing, that lead had been extended to six weeks by the time .reise was delegated.
Donuts, which has more experience than any other company when it comes to the transition to delegation process, managed to hit general availability two weeks sooner than .reise, even though Donuts’ sunrise period was twice as long.

Neustar set to lose contract that provides HALF its revenue

Neustar has been devastated by the news that it is likely to lose a US government contract that provides almost half of its annual revenue.
The US Federal Communications Commission yesterday recommended that Telcordia Technologies take over the Local Number Portability Administrator contract, which Neustar has held since 1997.
The service is basically North America’s centralized phone number registry. It’s not directly related to its domain name businesses.
In 2014, the deal was worth $474.8 million to Neustar, or 49% of its annual revenue.
On the news, the company’s share price fell off a cliff, losing almost 20% of its value before recovering slightly to end the day almost 12% down.
Neustar expressed dismay and anger in a press release, saying the FCC was putting the security of the US phone system at risk:

Although apparently the LNPA is used to port numbers, it is also critical for technology migrations, mergers and acquisitions, disaster recovery, accurate 911 location, and is the only authoritative database for the proper call completion of 11 billion voice calls and text messages each day. The recommendation misunderstands the operating system and would harm public safety, law enforcement, fundamentally burden small carriers, and disrupt service for 12 million consumers — all in pursuit of theoretical savings for a few carriers, which Neustar believes will be dwarfed by the costs and risks of transition.

Switching to Telcordia is currently only a recommendation that FCC commissioners must approve, and Neustar said it will “review all of its options”.
The LNPA deal is due to expire June 30 this year.
Neustar’s domain business — or “security services” as the company calls it — comprises DNS resolution, the registries for .us, .biz and .co, and the back-end registry for many new gTLDs. It brought in revenue of $140.3 million in 2014.
According to Reuters, Neustar is currently talking to advisers about the potential sale of the company, which is currently listed on the New York Stock Exchange, to private equity.
The potential buyers are reportedly waiting for the award of the number portability contract before sealing the deal.

Tucows and Namecheap exit $14m .online deal

Tucows and Namecheap have both pulled out of their joint venture with Radix to run the .online registry.
Tucows revealed the move, which will see Radix run .online solo, in a press release yesterday.
Both Tucows and Namecheap are registrars, whereas Radix is pretty much focused on being a registry nowadays.
While financial terms have not been disclosed, Tucows CEO Elliot Noss had previously said that each of the three companies had funded the new venture to the tune of $4 million to $5 million.
I estimate that this puts the total investment in the deal — which includes the price of winning .online at auction — at $13 million to $14 million.
Noss has also hinted that the gTLD sold for much more than the $6.8 million paid for .tech.
.online has not yet been delegated.

Google buys .app for over $25 million

The fiercely competed new gTLD .app has sold to Google for a record-breaking $25 million.
The company’s Charleston Road Registry subsidiary beat out 12 other applicants for the string, including Donuts, Amazon, Famous Four Media, Radix and Afilias.
The auction lasted two days and fetched a winning bid of $25,001,000, more than any other new gTLD to date.
The previous high is believed to be .blog, which I estimate sold for less than $20 million.
Because it was an ICANN-run “last resort” auction, all of the money goes into ICANN’s special auction proceeds fund, which previously stood at just shy of $35 million.
Previous ICANN auctions have fetched prices between $600,000 and $6,760,000.
Google originally proposed .app as a closed registry in which only Google and its partners could register names.
However, after the Governmental Advisory Committee pressured ICANN to disallow “closed generics”, Google changed its application to enable anyone to register.

Verisign sues .xyz and Negari for “false advertising”

Handbags at dawn!
Verisign, the $7.5 billion .com domain gorilla, has sued upstart XYZ.com and CEO Daniel Negari for disparaging .com and allegedly misrepresenting how well .xyz is doing.
It’s the biggest legacy gTLD versus the biggest (allegedly) new gTLD.
The lawsuit focuses on some registrars’ habit of giving .xyz names to registrants of .com and other domains without their consent, enabling XYZ.com and Negari to use inflated numbers as a marketing tool.
The Lanham Act false advertising lawsuit was filed in Virginia last December, but I don’t believe it’s been reported before now.
Verisign’s beef is first with this video, which is published on the front page of xyz.com:

Verisign said that the claim that it’s “impossible” to find a .com domain (which isn’t quite what the ad says) is false.
The complaint goes on to say that interviews Negari did with NPR and VentureBeat last year have been twisted to characterize .xyz as “the next .com”, whereas neither outlet made such an endorsement. It states:

XYZ’s promotional statements, when viewed together and in context, reflect a strategy to create a deceptive message to the public that companies and individuals cannot get the .COM domain names they want from Verisign, and that XYZ is quickly becoming the preferred alternative.

As regular readers will be aware, .xyz’s zone file, which had almost 785,000 names in it yesterday, has been massively inflated by a campaign last year by Network Solutions to push free .xyz domains into customers’ accounts without their consent.
It turns out Verisign became the unwilling recipient of gtld-servers.xyz, due to it owning the equivalent .com.
According to Verisign, Negari has used these inflated numbers to falsely make it look like .xyz is a viable and thriving alternative to .com. The company claims:

Verisign is being injured as a result of XYZ and Negari’s false and/or misleading statements of fact including because XYZ and Negari’s statements undermine the equity and good will Verisign has developed in the .COM registry.
…
XYZ and Negari should be ordered to disgorge their profits and other ill-gotten gains received as a result of this deception on the consuming public.

The complaint makes reference to typosquatting lawsuits Negari’s old company, Cyber2Media, settled with Facebook and Goodwill Industries a few years ago, presumably just in order to frame Negari as a bad guy.
Verisign wants not only for XYZ to pay up, but also for the court to force the company to disclose its robo-registration numbers whenever it makes a claim about how successful .xyz is.
XYZ denies everything. Answering Verisign’s complaint in January, it also makes nine affirmative defenses citing among other things its first amendment rights and Verisign’s “unclean hands”.
While many of Verisign’s allegations appear to be factually true, I of course cannot comment on whether its legal case holds water.
But I do think the lawsuit makes the company looks rather petty — a former monopolist running to the courts on trivial grounds as soon as it sees a little competition.
I also wonder how the company is going to demonstrate harm, given that by its own admission .com continues to sell millions of new domains every quarter.
But the lesson here is for all new gTLD registries — if you’re going to compare yourselves to .com, you might want to get your facts straight first if you want to keep your legal fees down.
And perhaps that’s the point.
Read the complaint here and the answer here, both in PDF format.