Sixty gTLD registries not monitoring security threats

Roughly 5% of gTLD registry operators have been doing no abuse monitoring, despite contractual requirements to do so, a recent ICANN audit has found.
ICANN checked with 1,207 registries — basically all gTLDs — between November 2018 and June, and found about 60 of them “were not performing any security threat monitoring, despite having domains registered in their gTLDs”.
A further 180 (15%) were not doing security checks, but had no registered domains, usually because they were unused dot-brands. ICANN told these companies that they had to do the checks anyway, to remain in compliance.
In all cases, ICANN said, the registries remediated their oversights during the audit to bring their gTLDs back into compliance.
ICANN does not name the non-compliant registries in the summary of the audit’s results, published yesterday (pdf).
Registries under the 2012 new gTLD base registry agreement all have to agree to this:

Registry Operator will periodically conduct a technical analysis to assess whether domains in the TLD are being used to perpetrate security threats, such as pharming, phishing, malware, and botnets. Registry Operator will maintain statistical reports on the number of security threats identified and the actions taken as a result of the periodic security checks. Registry Operator will maintain these reports for the term of the Agreement unless a shorter period is required by law or approved by ICANN, and will provide them to ICANN upon request.

It’s possible to keep tabs on abuse by monitoring domain blocklists such as SpamHaus, SURBL and PhishTank. Some such lists are freely available, others carry hefty licensing fees.
ICANN itself monitors these lists through its Domain Abuse Activity Reporting project, so it’s able to work out the differences between the levels of abuse registries report and what the empirical data suggests.
Registries typically either use these lists via in-house tools or license products provided by vendors such as Neustar, RegistryOffice, Knipp, CSC, DOTZON, Afnic, AusCERT, Shadowserver, Telefonica, Secure Domain Foundation and Netcraft, ICANN said.
Perhaps unsurprisingly, there’s a bit of disagreement between ICANN and some registries about how the somewhat vague obligations quote above are be interpreted.
ICANN thinks registries should have to provide information about specific domains that were identified as abusive and what remediation actions were taken, but some registries think they only have to provide aggregate statistical data (which would be my read of the language).
The contracts also don’t specify how frequently registries much carry out security reviews.
Of the 80% (965) of registries already in compliance, 80% (772) were doing daily abuse monitoring. Others were doing it weekly, monthly, or even quarterly, ICANN found, all of which appear to be in line with contractual requirements.

Bumper batch of dot-brands off themselves for Friday 13th

It’s Friday 13th tomorrow, and to celebrate the occasion no fewer than 13 dot-brands have opted to take the easy way out and self-terminate.
ICANN has published a bumper list of contracted brand registries that have informed the organization that they no longer wish to run their gTLDs.
Adding themselves to the dot-brand deadpool are: .ladbrokes, .warman, .cartier, .piaget, .chrysler, .dodge, .mopar, .srt, .uconnect, .movistar, .telefonica, .liason and .lancome.
That brings the total of self-terminated new gTLDs to date to 66.
The imminent demise of .cartier and .piaget is perhaps notable, as it means luxury goods maker Richemont has now abandoned ALL of the nine dot-brands it originally applied for.
Richemont, an enthusiastic early adopter of the new gTLD concept, applied for 14 strings in total back in 2012.
The only ones it has left are generics — .watches along with the the Chinese translation .手表 and the Chinese for “jewelry”, .珠宝, none of which have been launched and in all likelihood are being held defensively.
It’s the same story with L’oreal, the cosmetics company. It also applied for 14 gTLDs, mostly brands, but abandoned all but .lancome prior to contracting.
With .lancome on its way out, L’oreal only owns the generics .skin, .hair, .makeup and .beauty, at least one of which is actually being used.
Also of note is the fact the car company Chrysler is dumping five of its six gTLDs — .chrysler, .dodge, .mopar, .srt and .uconnect — leaving only .jeep (unused) still under contract.
Clearly, Chrysler is not as keen on dot-brands as some of its European competitors, which have been among the most prolific users.
Telefonica’s abandonment of .movistar and .telefonica also means it’s out of the gTLD game completely now, although its Brazilian subsidiary still owns (and uses) .vivo.
Betting company Ladbrokes only ever owned .ladbrokes, though it did unsuccessfully apply for .bet also.
Rounding off the list is .warman, a brand of — and I’m really not making this up — industrial slurry pumps. The pumps are made by a company called Weir, which uses global.weir as its primary web site. So that’s nice.
As far as I can tell, none of the gTLDs that are being killed off had ever been used, though each registry will have paid ICANN six-figure fees since they originally contracted.

Another victory for Amazon as ICANN rejects Colombian appeal

Amazon’s application for .amazon has moved another step closer to reality, after ICANN yesterday voted to reject an appeal from the Colombian government.
The ICANN board of directors voted unanimously, with two conflict-related abstentions, to adopt the recommendation of its Board Accountability Mechanisms Committee, which apparently states that ICANN did nothing wrong when it decided back in May to move .amazon towards delegation.
Neither the board resolution nor the BAMC recommendation has been published yet, but the audio recording of the board’s brief vote on Colombia’s Request for Reconsideration yesterday can be found here.
As you will recall, Colombia and the seven other governmental members of the Amazon Cooperation Treaty Organization have been trying to stymie Amazon’s application for .amazon on what you might call cultural appropriation grounds.
ACTO governments think they have the better right to the string, and they’ve been trying to get veto power over .amazon’s registry policies, something Amazon has been strongly resisting.
Amazon has instead offered a set of contractual Public Interest Commitments, such as giving ACTO the ability to block culturally sensitive strings, in the hope of calming the governments’ concerns.
These PICs, along with Amazon’s request for Spec 13 dot-brand status, will likely be published for 30 days of public comment this week, Global Domains Division head Cyrus Namazi told the board.
Expect fireworks.
After comments are closed, ICANN will then make any tweaks to the PICs that are necessary, before moving forward to contract-signing with Amazon, Namazi .said.

Why you should never let a pizza joint apply for your billion-dollar dot-brand

A multi-billion dollar telecoms company has lost its two dot-brand gTLDs after apparently hiring a failed pizza restaurant to manage them.
For reals.
Several times a year, my friends at other domain news blogs will post cautionary tales about companies losing their domains after falling out with the consultant or developer who originally registered the names on their behalf.
I believe this story is the first example of the same thing happening at the top level, with two valuable dot-brand gTLDs.
It concerns the Saudi Arabian telco Etihad Etisalat, which does business as Mobily. It’s publicly traded, with millions of subscribers and 2018 revenue of the equivalent of $3.14 billion.
The two gTLDs we’re concerned with are .mobily and موبايلي. (.xn--mgbb9fbpob), the Arabic version of the brand.
Back in 2012, a Bahrain company called GreenTech Consultancy Company applied for both of these TLDs. The applications made it explicit that they were to be single-registrant dot-brands to be used by Mobily.
Quite what the relationship between Mobily and GreenTech was — if there even was one — isn’t particularly clear.
GreenTech’s shareholders were Anwar Ahmed and Asma Malik, two Pakistani nationals living in Bahrain, according to Bahrain business records.
Its web site is an laughable mess of broken English, shameful grammar, irrelevant and impenetrable technobabble (much of which appears verbatim on several other South Asian tech companies’ web sites), and a suggestion that the company is primarily in the business of selling satellite modems.
The site just stinks of bogosity. It looks like a dirt-cheap developer threw the site together during his lunch break for beer money.
Bahrain company records show that GreenTech shared a registration with a company called Greentech Pizzeria Restaurant. Same two directors, same address, same company number.
The consultancy company was formed in February 2012 — during the ICANN application window — and the pizza joint opened a bit over a year later.
Why a multi-billion dollar telecommunications company would entrust its brands to these guys, if that is in fact what happened, is a bit of a mystery.
From information that has recently emerged, which I’ll get to shortly, it appears that the true applicant was a Los Angeles-based gTLD consultancy called WiseDots, which in 2011 was co-founded by recently departed ICANN CFO Kevin Wilson and Herman Collins.
WiseDots employees Collins, Wael Nasr and Alan Bair were all at some point listed as primary or secondary contacts for the two applications, as was domain lawyer Mike Rodenbaugh of Rodenbaugh Law.
Wilson left WiseDots in May 2012 and rejoined three years later as CEO after a stint at Donuts. He’s currently listed as the Admin contact for both Mobily gTLDs in the IANA records.
It appears that Mobily signed a letter of intent with WiseDots on April 9, 2012, just three days before the ICANN application window closed, and that was later formalized into a contract in 2014, six months before GreenTech signed its contracts with ICANN.
Both applications made it through ICANN’s evaluation process with apparently no trouble — there were no objections on trademark or any other grounds — and the Registry Agreements were signed in December 2014.
It’s worth noting that neither contract contains Specification 13, which is required for a registry to operate as a dot-brand. If you want to run a dot-brand, you have to show ICANN that you own a trademark matching the string you’ve applied for.
GreenTech did actually submit requests for Spec 13 approval (pdf) — a week after the contracts were already signed — but at a later date both were either withdrawn or rejected by ICANN for reasons unknown.
Both requests include what appear to be scans of Saudi trademark certificates, but they’re both in Arabic and I’ve no idea who they’re assigned to. Presumably, Mobily, which may explain why GreenTech couldn’t get its Spec 13.
After the contracts were signed, it took exactly one full year — the maximum delay permitted by ICANN — before they were delegated and entered the DNS root.
A year after that, in December 2016, ICANN whacked GreenTech with a breach-of-contract notice (pdf), after the company apparently failed to pay its ICANN fees.
The fees had been “past due” for at least six months. It seems quite possible GreenTech had never paid its fees after delegation.
The breach was later escalated to termination, and the two parties entered mediation.
According to Nasr, in a letter to ICANN, Mobily had promised to pay the ICANN fees, but had reneged on its promise, causing the breach.
The issue was resolved, with GreenTech apparently agreeing to some “confidential” terms with ICANN, in November 2017.
It has now transpired, from Nasr’s letter and attached confidential joint-venture agreement, that GreenTech, WiseDots, Collins, Ahmad, Nasr and yet another consultant — an Egyptian named Ahmed El Oteify, apparently with Varkon Group — made a pact in August 2016 whereby the two gTLDs would be transferred into the control of a new jointly owned Bahrain company to be called MobileDots WLL, which in turn would be owned by a new jointly owned Delaware company called MobileDots LLC.
The TLD contracts would then be transferred to Mobily, according to Nasr.
“GreenTech and the two Mobiledots companies were intended to be intermediate conduits for the future transfer of the two Mobily licenses to Mobily as their eventual Registered Operator,” he wrote.
“At no point in time was GreenTech ever contemplated as the true operator of the ‘Mobily’ gTLD licenses. Indeed, GreenTech ran a defunct pizza restaurant, and was long ago de-registered by the Bahraini government for its numerous payments and filing defaults,” he wrote.
The Delaware company was created, but there does not appear to be an official record of the Bahrain company being formed.
According to Nasr, after Mobily stopped paying its ICANN dues the joint venture partners fell out with each other over how to finance the registries. This led to GreenTech asking ICANN to terminate its contracts, which I blogged about in May.
As is customary when a brand registry self-terminates, ICANN made a preliminary decision not to transfer the GreenTech contracts to a third party and opened it up to public comments.
Nasr’s letter is the first example of anyone ever actually using that public comment opportunity.
He argued that because of the JV agreement, ICANN should instead transfer .mobily and the Arabic version to MobileDots.
ICANN declined, saying “it is not within the remit of ICANN org to transfer the TLDs to a specific successor Registry Operator (such as Mobiledots L.L.C., as Mr. Nasr requests) through this termination process”.
As a further twist in the tale, on August 23 this year, just four days before the contract terminations were due to become effective, GreenTech withdrew its requests for reasons unknown.
But it seems ICANN has had enough.
Last Thursday, it told GreenTech (Wilson and Ahmed) that it is terminating its registry contracts anyway, “invoking certain provisions set forth in the previously agreed-upon confidential terms between ICANN org and GreenTech”.
Its termination notices do not reveal what these “confidential terms” are.
But, given that GreenTech stopped existing as a legal entity in February (according to Bahrain company records) it appears it would have been on fairly solid grounds to terminate anyway.
ICANN’s decision is not open for comment this time around, and IANA has been asked to delete both TLDs from the root as soon as possible.
The upshot of all this is that a massive Saudi telco has lost both of the dot-brands it may or may not have wanted, and a whole mess of gTLD consultants appear to be out of pocket.
And the moral of this story?
Damned if I know. Something to do with pizzas, probably.

A third of the top TLDs are shrinking

Roughly one hundred of the top 300 top-level domains shrank in the second quarter, according to the latest CENTRstats Global TLD Report.
Median growth in domain registrations “hit a new recorded low” of 3.1%, the second new low in a row, CENTR said. It was 5.6% a year ago.
At the high end of the range, African ccTLDs — which have a relatively low base reg count, making impressive percentage growth easier — had median growth of 8.5%.
At the low end, European ccTLDs had median growth of 2%, CENTR said. These ccTLDs have more regs than all the other regions combined, making high-percentage growth trickier.
Europe was of course helped out by the UK, which spiked in July due to the end of the five-year second-level domain claims period, an effect I reported on last week.
Judging by CENTR’s numbers, Europe would have been virtually flat had .uk not grown by 1.1 million names in the quarter.
CENTR does not seem to count Taiwan’s .tw, the other ccTLD known to have driven growth internationally in Q2.
Verisign’s Domain Name Industry Brief, and DI’s own database, has Taiwan as the eighth-largest TLD, but it does not even make it to the CENTRstats’s top 10. (UPDATE September 9: .tw has since been added to the list.)
The gTLDs fared little better in percentage terms — up 2.4% year-over-year at the end of July. Verisign’s .com grew at 5% over the same period. For 2012-round new gTLDs, the number is 2.8%.
The CENTRstats report, which contains a whole lot more data, can be viewed or downloaded here.

These two ccTLDs drove two thirds of all domain growth in Q2

The number of registered domain names in the world increased by 2.9 million in the second quarter, driven by .com and two ccTLDs.
That’s according to the latest Verisign Domain Name Industry Brief, which was published (pdf) overnight, and other data.
The quarter ended with 354.7 million domains. Verisign’s own .com was up 1.5 million over Q1 at 142.5 million names.
ccTLDs across the board grew by 1.9 million names sequentially to 158.7 million. Year-over-year, the increase was 10.5 million domains.
The sequential ccTLD increase can be attributed almost entirely to two TLDs: .tw and .uk. These two ccTLDs appear to account for two thirds of the overall net new domains appearing in Q2.
Taiwan grew by about 600,000 in the quarter, presumably due to an ongoing, unusual pricing-related growth spurt among Chinese domainers that I reported in June.
The UK saw an increase of roughly 1.3 million domains, ending the quarter at 13.3 million.
That’s down to the deadline for registering second-level .uk matches for third-level .co.uk domains, which passed June 25.
Nominet data shows that 2LDs increased by about 1.2 million in the period, even as 3LDs dipped. The difference between this and the Verisign data appears to be rounding.
Factoring out the .uk and .tw anomalies, we have basically flat ccTLD growth, judging by the DNIB data.
Meanwhile, the new gTLD number was 23 million. That’s flat after rounding, but Verisign said that the space was actually up by about 100,000 names.
Growth as a whole was tempered by what I call the “other” category. That comprises the pre-2012 gTLDs such as .net, .org, .info and .biz. That was down by about a half a million names.
.net continued its gradual new gTLD-related decline, down 200,000 names sequentially at 13.6 million, while .org was down by 100,000 names.
The overall growth numbers are subject to the usual DNIB-related disclaimers: Verisign (and most everyone else) doesn’t have good data for some TLDs, including large zones such as .tk and .cn.

.blog registry handover did NOT go smoothly

The transition of .blog between registry back-end providers ended up taking six times longer than originally planned, due to “a series of unforeseen issues”.
Registry Knock Knock Whois There today told registrars that the move from Nominet to CentralNic took 18 hours to complete, far longer than the two to three hours anticipated.
An “unexpected database error” was blamed at one point for the delay, but KKWT said it is still conducting a post-mortem to figure out exactly what went wrong.
During the downtime, .blog registrations, renewals, transfers and general domain management at the registry level would not have been possible.
DNS resolution was not affected, so registrants of .blog domains would have been able to use their web sites and email as usual.
The migration, which covered roughly 200,000 domains, wrapped up at around 0800 UTC this morning. It seems engineers at the two back-end providers, both based in the UK, will have been working throughout the night to fix the issues.
KKWT reported the new CentralNIC EPP back-end functioning as expected but that several days of “post-migration clean-up” are to be expected.
Eighteen hours is more than the acceptable 14 hours of monthly downtime for EPP services under ICANN’s standard Registry Agreement, but below the 24 hours of weekly downtime at which emergency measures kick in.
CentralNic already handles very large TLDs, including .xyz, but I believe this is the largest incoming migration it’s handled to date.
KKWT is owned by Automattic, the same company as WordPress.com.

Donuts slashes prices on a million domains

Donuts is to overhaul the pricing on 1.1 million registry-reserved “premium” domain names, taking hundreds of thousands out of premium status altogether.
The company said today that it has decided to reduce the registration cost of 250,000 domains across its 242 new gTLDs. Discounts as deep as 90% are possible, judging by the company’s pricing page.
A further 850,000 will have their premium tag removed and return to regular pricing.
Part of the overhaul relates to the Rightside acquisition, which closed in 2017. While Rightside’s portfolio of TLDs was substantially smaller than Donuts’, it had been much more aggressive on its premium pricing.
For the domains being moved to standard pricing, Donuts will give it one last shot at squeezing a premium price out of them, however.
The company said that from September 5 to November 1 there will be a “pre-sales” event, during which registrants can pay the current premium fee for the first year on the understanding that they will renew at the standard pricing.
For example, drunk.games currently commands a roughly $130-a-year registration fee at registrars. If you buy it during the pre-sales event you’ll pay $130 for the first year but only about $20 upon renewal.
Donuts says this unusual landrush-style event is designed to make the names more attractive to investors who want to get in before prices fall.
The full effect of the price changes takes effect November 5.
It’s worth noting that standard pricing at Donuts is actually going up across most TLDs, by as much as 9%, on October 1, so you may want to check what your actual renewal fee is before buying.
A searchable database of the newly priced inventory can be found here.

.tech gTLD startups “raise $2 billion”

Tech startups using domain names in the .tech gTLD have raised $2 billion in venture capital financing over the last two years, according to Radix.
The registry looked at startups listed on Crunchbase as of June and found 650 companies using .tech domains. Of these, 170 of them had raised $2 billion in funding.
About 250 TLDs are in use by Crunchbase-listed startups, according to Radix.
According to a list provided by the company, funding amounts range from a modest $50,000 (obtained by the likes of the VR firm at virtualspaces.tech) to $620 million (obtained by the self-driving car company at aurora.tech).
Not every company on the list is still in business (if name resolution is any guide), and some of the .tech names bounce visitors to longer .com domains.
Meanwhile, domainer Morgan Linton has done a bit of similar research and discovered that 43% of the “top pick” startups appearing at Disrupt, the conference that like Crunchbase is owned by TechCrunch, are not using .com domains.
It’s a smaller sample size, but according to Linton, 18% of them use .io names. Most of the non-coms are on ccTLDs, in fact. The only new gTLD on his list is Google’s .app.
Disrupt made headlines in the domain world in 2010 when it launched its first conference web site on a .co domain, to coincide with the international launch of Colombia’s ccTLD by .CO Internet.
But that marketing deal lapsed after a year. Disrupt is back on techcrunch.com and disrupt.co is back in registry hands as a “premium” reserved name.
.co still appears on Linton’s list, however, so the initial partnership may still be bearing fruit.

CIRA replaces CORE as emergency backup registry

ICANN has switched around its line up of emergency registry providers, swapping out CORE Association for CIRA.
The organization last night announced that its three newly contracted Emergency Back-End Registry Operators are Nominet, CNNIC, and CIRA.
EBEROs are failsafe registries that will take over any gTLD that has failed or is on the verge of failing outright, putting its customers domains at risk.
The EBERO is responsible for winding down these gTLDs in an orderly fashion, giving registrants the chance to migrate to a different TLD.
So far, only .wed has entered the program, when the project with the imaginative business model of making it impractical to renew domains went out of business in 2017.
Nominet now caretakes .wed under the EBERO program.
Both Nominet (.uk) and CNNIC (.cn) have been approved EBEROs since 2013, under five-year contracts with ICANN.
CORE was also approved in 2013, but appears to have lost its contract. It’s been replaced by CIRA, the Canadian Internet Registry Association.
“We are honoured to be among this select group of trusted registry operators,” Dave Chiswell, VP of product development for CIRA, said in a statement. He said CIRA only suffered eight hours of downtime when it migrated .ca to a new back-end platform recently.
A key reason for CIRA replacing CORE is very likely geography. When ICANN put out its request for proposals last year, it made a big deal about how it wanted coverage in Europe, Asia and North America — where most gTLD registries are concentrated.
CORE is based in Switzerland. CIRA is obviously based in Canada and CNNIC is Chinese.
Another side-effect of the contract renegotiations is that ICANN is now paying 30% less for the services of the three providers, according to a recent board resolution.
The three providers are contracted for five years.
Whether, and to what extent, they’ll ever actually be triggered to provide EBERO services is open to debate.
Currently, there are six gTLDs in advanced stages of ICANN compliance proceedings, putting them at risk of having their contracts revoked: .whoswho, and five Persian-themed strings.
It’s not inconceivable than one or more of these gTLDs could wind up in EBERO, but ICANN appears to be cutting the registries a lot of slack to resolve their issues.