Spammy .loan makes Alibaba fastest-growing and fastest-shrinking registrar in June

Chinese registrar Alibaba was both the fastest-growing and fastest-shrinking registrar in June, purely due to its dalliance with hundreds of thousands of cheap .loan domain names.
Stats compiled by DI from the latest monthly registry reports show that Alibaba’s Singapore-based registrar — which has only been active for a year — grew its domains under management by 720,669 in June, almost four times as many as second-placed NameCheap.
The huge increase was due to Alibaba’s DUM in .loan doubling in June, going from from 621,851 to 1,274,532. Another 50,000 extra domains came from .win.
Both .loan and .win are run by registry GRS Domains, the company that replaced Famous Four Media as manager of the Domain Venture Partners gTLD portfolio.
According to SpamHaus, .loan has a “badness” of just shy of 90%, based on a sample size of 45,000 observed domains. SpamHaus has .win at almost 39% bad.
GRS has promised to turn its portfolio around and cut off its deep-discounting promotions effective August 20. The June figures reflect a time when discounts were still in place.
The Singapore Alibaba had DUM of 1,771,730 at the end of June.
At the bottom end of the June league table was a second Alibaba accrediation, Beijing-based Alibaba Cloud Computing (aka HiChina or net.cn), which had a net DUM loss of 266,411, after seeing 345,268 deletes in .loan (along with 45,000 deletes in .xyz and 35,000 in .xin).
The second biggest loser was AlpNames, which is owned by the same people as Famous Four, which deleted over 114,000 names in the month. The vast majority of these names were in FFM/GRS gTLDs, including .loan.
The main, earliest Alibaba accreditation, Alibaba Cloud Computing (Beijing), which has zero exposure to new gTLDs, grew by 69,794 domains to end June as the seventh fastest-growing registrar with DUM of 7,672,594.
As of a couple weeks ago, Alibaba has a fourth ICANN accreditation, Alibaba Cloud US LLC, but that obviously does not figure into the June numbers.
Here’s the top 10 registrars for June by DUM growth:
[table id=52 /]
And the bottom 10:
[table id=53 /]
You may notice that in both tables the net change column is not equal to the sum of adds and net transfers minus deletes. This is because, per ICANN contract, domains still in their five-day Add Grace Period are counted in DUM but not in adds, so many adds slip over into the following month.

Comment Tagged: .loan, .win, alibaba, di pro, Famous Four Media, grs domains, registrar league, spam, spamhaus

Here’s what ICANN’s boss is saying about Whois access now

Should ICANN become the sole source for looking up private domain registrant data? That’s one of the options for the post-GDPR world of Whois currently being mulled over on Waterfront Drive.
ICANN CEO Goran Marby laid out some of ICANN’s current thinking on the future of Whois last week at an occasionally combative meeting in Los Angeles.
One idea would see ICANN act as a centralized gatekeeper for all Whois data. Another could risk ICANN becoming much more tightly controlled by governments.
I’ve listened to the recordings, read the transcripts, chatted to participants, and I’m going to attempt to summarize what I believe is the current state of play.
As regular DI readers know, post-GDPR Whois policy is currently being debated to a tight deadline by an Expedited Policy Development Process working group.
The work has been a tough slog, and there seems to be little hope of the EPDP closing all of its outstanding issues before its first conclusions are due under three weeks from now.
One of the outstanding issues not yet addressed in any depth by the group is the potential creation of a “unified access model” — a standardized way cops, trademark owners, cybersecurity professionals and others could look at the same Whois data they could look at just a few months ago.
While the EPDP has carried on deferring discussion of such a model, ICANN Org has in parallel been beavering away trying to figure out whether it’s even going to be legally possible under the new European privacy law to open up Whois data to the people who want to see it, and it’s come up with some potentially game-changing ideas.
After weeks of conference calls, the EPDP working group — made up of 30-odd volunteers from all sections of the ICANN community — met in LA for three days last week to get down to some intensive face-to-face arguments.
I gather the meeting was somewhat productive, but it was jolted by the publication of an ICANN blog post in which Marby attempted to update the community on ICANN’s latest efforts to get clarity on how GDPR legally interacts with Whois.
Marby wrote that ICANN “wants to understand whether there are opportunities for ICANN, beyond its role as one of the ‘controllers’ with respect to WHOIS or its contractual enforcement role, to be acknowledged under the law as the coordinating authority of the WHOIS system.”
What did ICANN mean by this? While “controller” is a term of art defined in mind-numbing detail by the GDPR, “coordinating authority” is not. So ICANN’s blog post was open to interpretation.
It turns out I was not the only person confused by the post, and on Tuesday afternoon last week somebody from the EPDP team collared Marby in the corridor at ICANN HQ and dragged him into the meeting room to explain himself.
He talked with them for about an hour, but some attendees were still nonplussed — some sounded downright angry — after he left the room.
This is what I gleaned from his words.
No End-Runs
First off, Marby was at pains to point out, repeatedly, that ICANN is not trying to bypass the community’s Whois work.
It’s up to the community — currently the EPDP working group, and in a few weeks the rest of you — to decide whether there should be a unified access model for Whois, he explained.
What ICANN Org is doing is trying to figure out is whether a unified access model would even be legal under GDPR and how it could be implemented if it is legal, he said.
“If the community decides we should have a policy about a unified access model, that’s your decision,” he told the group. “We are trying to figure out the legal avenues if it’s actually possible.”
He talked about this to persons unknown at the European Commission in Brussels last month.
Whatever ICANN comes up with would merely be one input to the community’s work, he said. If it discovers that a unified access model would be totally illegal, it will tell the community as much.
Marby said ICANN is looking for “a legal framework for how can we diminish the contracted parties’ legal responsibility” when it comes to GDPR.
So far, it’s come up with three broad ideas about how this could happen.
The Certification Body Idea
GDPR sections 40 to 43 talk about the concepts of “codes of conduct” and “certification bodies”.
It’s possible that ICANN was referring to the possibility of itself becoming a certification body when it blogged about being a “coordinating authority”. Marby, during the EPDP meeting, unhelpfully used the term “accreditation house”.
These hypothetical entities (as far as I know none yet exist) would be approved by either national data protection authorities or the pan-EU European Data Protection Board to administer certification schemes for companies that broadly fall into the same category of data processing businesses.
It seems to be tailor-made for ICANN (though it wasn’t), which already has accreditation of registries and registrars as one of its primary activities.
But this legal avenue does not appear to be a slam-dunk. ICANN would presumably have to persuade a DPA or two, or the EDPB, that giving third parties managed access to citizens’ private data is a good thing.
You’d think that DPAs would be dead against such an idea, but the EU members of ICANN’s Governmental Advisory Committee have put their names to advice stating that Whois should remain accessible under certain circumstances, so it’s not impossible they could see it ICANN’s way.
The C.R.A.P. Idea
Marby’s second idea for taking some of the GDPR burden off the shoulders of contracted parties is to basically make ICANN a proxy, or man-in-the-middle, for Whois queries.
“What would happen if ICANN Org legally is the only place you can ask a question through?” he said. “And the only ones that the contracted parties actually can answer a question to would be ICANN Org? Would that move the legal responsibility away from the contracted parties to ICANN Org?”
In many ways, this is typical domain industry tactics — if there’s a rule you don’t want to follow, pass it off to a proxy.
This model was referred to during the session by EPDP members as the “hub and spoke” or “starfish”. I think the starfish reference might have been a joke.
Marby, in a jocular callback to the “Calzone” and “Cannoli” Whois proposals briefly debated in the community earlier this year, said that this model had a secret ICANN-internal code-name that is “something to do with food”.
Because whenever I’ve tried to coin a phrase in the past it has never stuck, I figure this time I may as well go balls-out and call it the “Cuisine-Related Access Plan” for now, if for no other reason than the acronym will briefly annoy some readers.
Despite the name I’ve given it, I don’t necessarily dislike the idea.
It seems to be inspired by, or at least informed by, side-channel communications between Marby and the Intellectual Property Constituency and Business Constituency, which are both no doubt mightily pissed off that the EPDP has so far proven surprisingly resilient to their attempts to get Whois access into the policy discussions as early as possible.
Two months ago, a few influential IP lawyers proposed to Marby (pdf) a centralized Whois model in which registrars collect data from registrants then pass it off to ICANN, which would be responsible for deciding who gets to see it.
Forget “thin” versus “thick” Whois — this one would be positively, arguably dangerously, obese. Contracted parties would be relegated to “processors” of private data under GDPR, with ICANN the sole “controller”.
Benefits of this would include, these lawyers said, reducing contracted parties’ exposure to GDPR.
It’s pretty obvious why the IP lobby would prefer this — ICANN is generally much more amenable to its demands than your typical registry or registrar, and it would very probably be easier to squeeze data out of ICANN.
While Marby specifically acknowledged that ICANN has taken this suggestion as one of its inputs — and has run it by the DPAs — he stopped well short of fully endorsing it during last week’s meeting in LA.
He seemed to instead describe a system whereby ICANN acts as the gatekeeper to the data, but the data is still stored and controlled at the registry or registrar, saying: “We open a window for access to the data so the data is still at the contracted parties because they use that data for other reasons as well”.
The Insane Idea
The third option, which Marby seemed to characterize as the least “sane” of the three, would be to have Whois access recognized by law as a public interest, enabling the Whois ecosystem to basically ignore GDPR.
Remember, back on on GDPR Day, I told you about how the .dk ccTLD registry is carrying on publishing Whois as normal because a Danish law specifically forces it to?
Marby’s third option seems to be a little along those lines. He specifically referred to Denmark and Finland (which appears to have a similar rule in place) during the LA session.
If I understand correctly, it seems there’d have to be some kind of “legal action” in the EU — either legislation in a member state, or perhaps something a little less weighty — that specifically permitted or mandated the publication of otherwise private Whois data in gTLD domains.
Marby offered trademark databases and telephone directories as examples of data sets that appear to be exempt from GDPR protection due to preexisting legislation.
One problem with this third idea, some say, is that it could bring ICANN policy under the direct jurisdiction of a single nation state, something that it had with the US government for the best part of two decades and fought hard to shake off.
If ICANN was given carte blanche to evade GDPR by a piece of legislation in, say, Lithuania, would not ICANN and its global stakeholders forever be slaves to the whims of the Lithuanian legislature?
And what if that US bill granting IP interests their Whois wet dream passes onto the statute books and ICANN finds itself trapped in a jurisdictional clusterfuck?
Oh, my.
Fatuous Conclusion For The Lovely People Who Generously Bothered To Read To The End
I’m not a lawyer, so I don’t pretend to have a comprehensive understanding of any of this, but to be honest I’m not convinced the lawyers do either.
If you think you do, call me. I want to hear from you. I’m “domainincite” on Skype. Cheers.

1 Comment Tagged: edpb, epdp, gdpr, ICANN, privacy, trademarks, whois

Parsons quits GoDaddy board

Bob Parsons has resigned from GoDaddy’s board of directors, 21 years after he founded the company.
The registrar announced today that Parsons will leave this Friday to devote more attention to his philanthropic Bob and Renee Parsons Foundation and to the various motorcycle and golf-related businesses he runs under the Yam Worldwide brand.
He was CEO of GoDaddy from 1997 until 2011 and executive chairman until 2014.
The company is of course the runaway success story of the competitive registrar market, using a combination of cheap prices and bold marketing to eat incumbent Network Solutions’ lunch in just a few short years.
Today, it has over $2.2 billion in annual revenue and somewhere in the region of 60 million domains under management, and that’s just the gTLDs.
GoDaddy’s success made Parsons himself a billionaire.

Comment Tagged: godaddy

Brazil dancing around four million reg milestone

The Brazilian ccTLD, .br, last week topped four million registrations for the first time, then promptly dropped back below the milestone.
The TLD was at 4,000,260 domains on Monday September 24, prompting a press release from Nic.br, dropping back below four mill the next day, then hit 4,002,574 this Monday.
The TLD stands at 3,996,604 today, according to statistics Nic.br publishes on its web site.
It’s taken about six years to grow from three million names. The leap from two million to three million took about two and a half years.
Brazil operates on a three-level structure, with dozens of second-level domain options available to registrants.
The large majority of registered names — 3,645,073 — are in the .com.br space.

1 Comment Tagged: .br, brazil, nic.br

Donuts says DPML now covers “millions” of trademark variants as price rockets again

Donuts has added more than a third to the price of its Domain Protected Marks List service, as it adds a new feature it says vastly increases the number of domains trademark owners can block.
The company has added homograph attack protection to DPML, so trademark-owning worrywarts can block variations of their brand that contain confusing non-Latin characters in addition to all the domain variants DPML already takes out of the available pool.
An example of a homograph, offered by Donuts, would be the domain xn--ggle-0nda.com, which can display as “gοοgle.com” and which contains two Cyrillic o-looking characters but is pretty much indistinguishable from “google.com”.
Donuts reckons this could mean “millions” of domains could be blocked, potentially preventing all kinds of phishing attacks, but one suspects the actual number per customer rather depends on how many potentially confusable Latin characters appear in the brands they want to protect.
DPML is a block service that prevents others from registering domains matching or closely matching customers’ trademarks. Previous additions to the service have included typo protection.
The new feature supports Cyrillic and Greek scripts, the two that Donuts says most homograph attacks use.
The company explained it to its registrars like this:

The Donuts system will analyze the content of each SLD identified in a DPML subscription, breaking it down to its individual characters. Each character is then “spun” against Unicode’s list of confusable characters and replaced with all viable IDN “glyphs” supported by Donuts TLDs. This spinning results in potentially millions of IDN permutations of a brand’s trademark which may be considered easily confusable to an end user. Each permutation is then blocked (removed from generally available inventory) just like other DPML labels, meaning it can only be registered via an “Override” by a party holding a trademark on the same label.

While this feature comes at no additional cost, Donuts is increasing its prices from January 1, the second big increase since DPML went live five years ago.
Donuts declined to disclose its wholesale price when asked, but I’ve seen registrars today disclose new pricing of $6,000 to $6,600 for a five-year block.
That compares to retail pricing in the $2,500 to $3,000 range back in 2013.
Hexonet said it will now charge its top-flight resellers $6,426 per create, compared to the $4,400 it started charging when DPML prices last went up at the start of last year. OpenProvider has also added two grand to its prices.
Donuts said the price increase also reflects the growth of its portfolio of gTLDs over the last few years. It now has 241, 25% more than at the last price increase.

3 Comments Tagged: .brands, cybersquatting, domain protected marks list, donuts, dpml, hexonet, homographs, openprovider, phishing, trademarks

Chinese registrars on the decline

Having been on a growth trajectory for some years, the number of ICANN-accredited registrars based in China appears to be on the decline.
According to my records, so far this year 26 registrar contracts have been terminated, voluntarily or otherwise, 11 of which were Chinese. I’m excluding the mass drop of Pheenix accreditations from these numbers.
The country with the next-highest number of terminations was the USA, with three.
ICANN has terminated nine registrars for breaches of the RAA this year, six of which were Chinese.
All the Chinese notices included non-payment of ICANN fees as a reason for termination, though it appears that most of them had a negligible number of gTLD domains under management.
ICANN Compliance tells me there’s no particular focus of China at the moment, this is all a result of regular day-to-day enforcement.
ICANN has sent breach notices to 28 companies this year, seven of which were to Chinese registrars.
Meanwhile, 22.cn has moved 13 of its accredited shell registrars to Hong Kong. Another registrar moved its base from China to Australia.
Seven Chinese registrars have been newly accredited this year,
Net, this has all reduced the number of accredited registrars based in China to 91.
The country still has the second-most registrars ahead of the US, with its almost 2,000 registrars, and a clear 31 registrars ahead of third-place India.

Comment Tagged: accreditation, china, compliance, ICANN, termination

$3.2 million-a-year registrar up for grabs

Swedish ccTLD registry IIS is to sell off its registrar business, .SE Direkt, which is expected to bring in some $3.2 million in revenue this year.
The foundation said today that .SE Direkt has 121,836 .se domains under management and 87,852 customers, 66,819 of which are corporate.
That represents about 7% of the total .se market by domains.
IIS created the registrar in 2009 as part of its transition to a competitive two-tier sales model.
The registry explained in a note to press:

The idea was that it would work as a transition solution and that domain name holders would gradually transfer to other registrars. The number of customers has not fallen at the expected rate, but after 10 years it is on a level where IIS believes that the time is right to no longer continue with the registrar operations.

The buyer, which will have to be or become an IIS-accredited .se registrar, will get the customer base, domain database and two-year brand license, but none of the staff or other assets of the unit.
.SE Direkt sells .se names for 270 SEK ($30.27) per year.
Its revenue for 2017 was SEK 29.8 million ($3.3 million) and is expected to decline to SEK 28.3 million ($3.2 million) in 2018. The buyer would take over from the start of 2019.
There’s obviously a risk here that revenue is on a downward trajectory due to IIS’s aforementioned strategy of deliberately shedding customers.
Some effort to reverse this trend may be required by whoever takes over.
Stats on churn, usage, transfers and so on can be found in this IIS RFP (pdf).
IIS said that bids from interested parties must be submitted by October 17 and the foundation expects to select the winner by November 1.

2 Comments Tagged: .se, .se direkt, acquisition, iis, rfp

It’s Drazek vs Dammak for GNSO Council chair

The chair of ICANN’s Generic Names Supporting Organization Council is contested this year, with a registry veep facing off against a software engineer.
The nomination from the contracted parties house is US-based Keith Drazek, Verisign’s VP of policy and government relations.
He’ll be opposed by non-contracted parties nominee and current vice-chair Rafik Dammak, a Tunisian working as a software engineer for NTT Communications (which is technically a contracted party due its dot-brand gTLD) in Japan.
Both men are long-time, active members of the ICANN community and GNSO.
The Council will pick its new chair about a month from now at the ICANN 63 meeting in Barcelona.
The winner will replace lawyer Heather Forrest, the non-contracted party who took the seat after an unopposed vote a year ago.

Comment Tagged: elections, gnso, gnso council, ICANN

Cloudflare selling all domains at cost: “All we’re doing is pinging an API”

Content delivery network provider Cloudflare has promised to sell domains in all TLDs at the wholesale cost, with no markup, forever.
The company made the commitment yesterday as it announced its intention to get into the registrar business.
Founder Matthew Price used the announcement to launch a blistering attack on the current registrar market, which he said is charging “crazy” prices and endlessly upselling their customers with unwanted, worthless products. He blogged:

why should registrars charge any markup over what the TLDs charge? That seemed as nutty to us as certificate authorities charging to run a bit of math. When we see a broken market on the Internet we like to do something about it.
…
we promise to never charge you anything more than the wholesale price each TLD charges. That’s true the first year and it’s true every subsequent year. If you register your domain with Cloudflare Registrar you’ll always pay the wholesale price with no markup.
For instance, Verisign, which administers the .com TLD, currently charges $7.85 per year to register a .com domain. ICANN imposes a $0.18 per year fee on top of that for every domain registered. Today, if you transfer your .com domain to Cloudflare, that’s what we’ll charge you per year: $8.03/year. No markup. All we’re doing is pinging an API, there’s no incremental cost to us, so why should you have to pay more than wholesale?

There are catches, of course.
For starters, the service is not available yet.
Price wrote that Cloudflare will roll it out gradually — for inbound transfers only — to its “most loyal” customers over an unspecified period. Even customers on its cheapest plans will get access to the queue, he wrote.
Eventually, he said, it will be available “more broadly”.
It will be interesting to see if the no-markup pricing could become available to non-customers too, and whether it sticks to its business model when its support lines start ringing and it becomes apparent the business is actually big ole cash vampire.
Cloudflare has been ICANN-accredited for several years, but it’s only been offering registrations to high-value enterprise customers so far.
My records show that it has not much more than 800 domains under management, all in .com, .net, .org and .info.
The announcement was made, perhaps not coincidentally, a couple days after CRM software provider Zoho made headlines when its 40 million customers were taken offline because its former registrar suspended zoho.com over a trivial level of abuse. In response to the screw-up, Zoho transferred the domain to Cloudflare.

11 Comments Tagged: cloudflare, ICANN, pricing, tierra, zoho

MMX waving goodbye to .london? Boss puts focus on renewal profits, China

MMX’s revenue from domain renewals could cover all of its expenses within the next 24 months, if everything goes to plan, according to CEO Toby Hall.
Hall was speaking to DI this evening after the company reported its first-half financial results, which saw revenue up 22% to $6.4 million and a net loss of $14.7 million, which compared to a loss of $526,000 a year earlier.
MMX’s huge loss for the period was largely — to the tune of $11.8 million — attributable to the restructuring of an “onerous” contract with one of its gTLD partners.
Hall refuses point blank to name that partner, but for reasons I discussed last year, I believe it is .london sponsor London & Partners, which is affiliated with the office of the Mayor of London.
When L&P selected MMX to be its registry partner for .london back in 2012, I understand a key reason was MMX’s promise to pay L&P a fixed annual fee and commit to a certain amount of marketing spend.
But two years ago, after it became clear that .london sales were coming in waaaay below previous management’s expectations, MMX renegotiated the deal.
Under the new deal, instead of committing to spend $10.8 million on marketing the TLD itself, MMX agreed to give half that amount to L&P for L&P to do its own marketing.
It appears that L&P has already spunked much of that cash ineffectively, or, as MMX put it:

a significant portion of that marketing budget has been spent by the partner with minimal impact on revenues in the current year and no expectation of any material uplift in future periods

MMX seems to have basically written off the .london deal as a bad call, and now that MMX is no longer in the registry back-end or registrar businesses, it seems unlikely that the .london partnership will be extended when it expires in three years.
Again, Hall would not confirm this bad contract was for .london — I’m making an informed guess — but the alternatives are limited. The only other TLDs MMX runs in partnership currently are .review and .country, and not even 2012 MMX management would have bet the farm on those turkeys.
Another $2.1 million of the company’s H1 net loss is for “bad debt provisions” relating the possibility that certain US-based registrar partners may not pay their dues, but this provision is apparently related to a new accounting standard rather than known deadbeats threatening to withhold payments.
If you throw aside all of this accountancy and look at the “operating EBITDA” line, profit was up 176% to $661,000 compared to H1 2017.
While the loss may have cast a cloud over the first half, Hall is upbeat about MMX’s prospects, and it’s all about the renewals.
“Renewal revenue will be more than all the costs of business within 24 months,” he said. To get there, it needs to cross the $12 million mark.
He told DI tonight that “an increasing percentage of our business is based on renewals… just on renewal revenue alone we’ll be over $10 million this year”.
Renewal revenue was $4.7 million in 2017 and $2.4 million in 2016, he said. In the first half, it was was up 40% to $3.4 million.
MMX’s acquisition of porn domain specialist ICM Registry, which has renewal fees of over $60 per year, will certainly help the company towards its 2018 goal in the second half. ICM only contributed two weeks of revenue — $250,000 — in H1.
Remarkably, and somewhat counter-intuitively, the company is also seeing renewal strength in China.
Its .vip gTLD, which sells almost exclusively in China, saw extremely respectable renewals of 76% in the first half, which runs against the conventional wisdom that China is a volatile market
Hall said that .vip renewals run in the $5 to $10 range, so apparently TLD volume is not being propped up by cheap wholesale renewal fees. The TLD accounts for about 30% of MMX’s renewal revenue, Hall said.
About 60% of .vip’s domains under management are with Chinese registrar Alibaba. The biggest non-Chinese registrar is GoDaddy, with about 3% of the namespace.
More exposure to China, and specifically Alibaba, is expected to come soon due to MMX’s repurposing of the 2012-logic gTLD .luxe, which is being integrated into the Ethereum blockchain.
MMX said last week that some six million (mostly Chinese) users of the imToken Ethereum wallet will in November get the ability to register .luxe domains via imToken and easily integrate them with their Ethereum assets.
The announcement was made at the Alibaba Cloud Computing Conference in China last week, so you can probably guess imToken’s registrar of choice.

Comment Tagged: .london, .vip, china, earnings, financials, icm registry, Minds + Machines, mmx, new gTLDs, renewals