Donuts confirms six-figure .news buyer used a fake name

Mike Texas is in fact noted conspiracy theorist Mike Adams.
New gTLD registry Donuts confirmed with DI over the weekend that the buyer of six figures worth of “platinum” .news domain names used a fake name.
The company last week said that a company called WebSeed bought registry-reserved names including science.news, climate.news, medicine.news, health.news and pollution.news.
After a small amount of digging, I discovered that these sites were affiliated with a controversial site called Natural News, which is regularly criticized for spreading bogus, anti-science content.
I suspected that “Mike Texas”, the WebSeed CEO quoted railing against “fake news” in Donuts’ press release, was very probably a pseudonym for Natural News owner Mike Adams, who calls himself the “Health Ranger” but peddles theories often characterized as dangerous.
Yesterday, Donuts told us that, following DI’s coverage, it has managed to confirm with Texas that he is in fact Adams. The company has changed its press release accordingly.
I will note that the most compelling piece of evidence connecting Texas to Adams was a pre-GDPR Whois record.

2 Comments Tagged: .news, donuts, fake news, natural news, new gTLDs, webseed

KeyDrive reverses into CentralNic in $55 million deal

CentralNic this morning confirmed that it has signed a deal to merge with KeyDrive to dramatically grow its market share in the registrar and registry markets.
The deal, technically a reverse takeover, is worth up to $55 million, $10.5 million of which is performance-related.
KeyDrive is the holding company for brands including the registrars Key-Systems, Moniker and BrandShelter and the registries OpenRegistry and KSRegistry.
It is by far the bigger player in the registrar space. The combined company will have 7.1 million domains under management, 5.8 million of which will come from the Luxembourg-based firm.
“The acquisition of KeyDrive is transformative for CentralNic, significantly increasing the Company’s scale and giving it significant extra firepower in the domain name industry to rival the traditional major players,” CentralNic CEO Ben Crawford said in a statement.
CentralNic says the deal will make it the 11th-largest registrar in terms of gTLD domains under management and the fifth-largest registry back-end in terms of TLDs managed (which will hit 118).
KeyDrive had 2017 revenue of $58.26 million and adjusted EBITDA of $5.87 million. Operating profit was $4.3 million.
CentralNic had 2017 revenue of £24.3 million ($32.2 million), adjusted EBITDA of £6.6 million ($8.7 million) and operating profit of £1.8 million ($2.4 million). These numbers do not include the £3.2 million-a-year SKNIC business, which CentralNic acquired right at the end of last year.
KeyDrive CEO Alexander Siffrin will become COO of CentralNic and one of its largest shareholders, owning 16.4% of the combined company’s shares.
The acquisition itself is fairly complex.
CentralNic will raise $16.5 million cash in a share placement and it will issue $19.3 million of shares to a holding company majority-owned by Siffrin. The remaining $10.5 million is performance related and may be paid in a combination of cash and shares, mostly shares.
It’s all subject to shareholder approval at an August 1 general meeting.
Assuming the deal closes, CentralNic says its plan is to become the “GoDaddy of Emerging Markets”, though what this means in practice is not immediately clear.
It does seem that there will be some job losses as the company rationalizes staffing across its various locations.
As far as technical integration goes, CentralNic’s registrars will migrate to KeyDrive’s platform and KeyDrive’s registries will migrate to CentralNic’s registry platform.
The potential for a deal was first revealed in March, after a leak. Trading in its shares was halted as a result, but resumed this morning.

Comment Tagged: acquisition, centralnic, keydrive

.pharmacy TLD faces action after losing complaint over Canadian drug peddler

ICANN has hit the .pharmacy gTLD registry with a breach notice after a complaint from a Canadian web site that was refused a .pharmacy domain.
The US National Association of Boards of Pharmacy failed to operate the TLD “in a transparent manner”, contrary to the Public Interest Commitments in its registry agreement, ICANN says.
It’s only the second time, to my knowledge, that a registry has been told it has broken its contract after losing a Public Interest Commitments Dispute Resolution Process decision.
NABP runs .pharmacy as a restricted TLD that can only be used by licensed pharmacies.
A year ago, a company called Canadawide Pharmacy Ltd, which currently uses a .org domain, applied for canadawidepharmacy.pharmacy but, last December, was rejected due to claims that it was “until recently” affiliated with unlicensed cross-border drug sellers.
The sale of medications into the US, where patients are gouged mercilessly by pharmaceuticals companies, from Canada, where common drugs are sold at a fraction of the price, is controversial, with NABP previously being accused of applying for .pharmacy for protectionist reasons.
(The price of generic Viagra on Canadawide’s web site goes as low as $2.15 per dose. In the US, you’re looking at about $66 per dose for the branded version, which doesn’t even include the price of dinner.)
Earlier this year, Canadawide filed a PICDRP, accusing .pharmacy of breaching its own contractual commitment to transparency.
And it won. The PICDRP standing panel ruled 3-0 this month (pdf) that NABP lacked transparency on three counts when it rejected Canadawide’s registration.
The registry failed to provide enough evidence linking Canadawide to unlicensed affiliates, the panel ruled. It also seemed to acknowledge that the alleged affiliates were historical.
As a result of the panel’s finding, ICANN has made a public breach notice that gives NABP until August 11 to:

Provide ICANN with corrective and preventative action(s), including implementation dates and milestones, to address the PIC Reporter’s complaint, the PIC Standing Panel’s findings and ensure that NABP will operate the TLD pharmacy in a transparent manner consistent with general principles of openness and non-discrimination by establishing, publishing and adhering to clear registration policies

None of this seems to suggest that Canadawide will definitely get its domain. If NABP has sufficient evidence to continue to deny the application, it looks like it could come into compliance by merely being transparent about this evidence.

2 Comments Tagged: .pharamacy, canadawide, nabp, national association of boards of pharmacy, new gTLDs, pcdrp, pics

Donuts makes six-figure .news sale to dangerous conspiracy theorist

Donuts has sold a package of “platinum” .news domains to a network of dubious news sites peddling what many describe as dangerous pseudo-scientific nonsense.
A company called WebSeed acquired science.news, food.news, health.news, medicine.news, pollution.news, cancer.news and climate.news from the registry for an undisclosed sum in the six-figure range last December, Donuts said.
It appears that the same buyer has acquired several other presumably non-platinum .news domains, including vaccines.news, nutrients.news, menshealth.news and emergencymedicine.news
The sites have already been developed, incorporating a back catalog of “news” content from other sites under the same ownership, and Donuts reckons searches for “climate news” and “science news” already return the matching domains prominently (they don’t for me, but Google can be fickle).
Unfortunately, the domains seem to have been sold to a leading purveyor of misinformation and conspiracy theories.
That’s right, climate.news now belongs to a climate change denier, vaccines.news belongs to an anti-vaxxer, and medicine.news belongs to somebody who values alternative remedies over science-based medicine.
As far as I can tell, pretty much all of the content on the network of .news domains comes from Natural News, the controversial site owned by “Health Ranger” Mike Adams.
Natural News has been fingered as an “empire of misinformation” and a leading contributor to the “fake news” crisis that has been blighting society for the last few years.
Check out climate.news today to be treated to Adams’ theory that climate change is nothing but a conspiracy peddled by the UN and the mainstream media.
Over on vaccines.news, you’ll find a scaremongering story about how the measles vaccine has killed more people than measles over the last decade.
(Gee, I wonder why measles isn’t killing anyone any more? Could it be that we have a fucking vaccine?).
On medicine.news, Adams himself writes of “PROOF that vaccines target blacks for depopulation”.
And at pollution.news, you’ll find any number of articles discussing the “chemtrails” conspiracy theory.
To be perfectly honest, I’m not scientifically literate enough to debunk most of the content on these sites, but I know quackery when I see it.
Donuts’ press release goes to suspicious pains to point out that the sites’ content is “thoroughly researched” and advertising is “limited and relevant to the sites’ content”.
In fact, the advertising seems in most if not all cases to lead back to Adams’ own stores, where he sells stuff like water purifiers, dietary supplements and alternative medicines.
The Donuts press release also quotes the founder and CEO of WebSeed, one “Mike Texas”.
Now, I have absolutely no evidence whatsoever that Mr Texas is not a real person.
But.
Whois records (remember those?) show that the original registrant of science.news was one Mike Adams of WebSeed LLC, and WebSeed.com, while under privacy for some years, was originally registered to Adams’ Taiwan-based company.
It goes without saying that Donuts, as a neutral registry, is under no obligation whatsoever to police content on the domains it sells. That would be a Bad Thing.
But I can’t help but feel that .news has the potential to take a big credibility hit due to the content of these sites.
Imagine a fox, buying up all the good .henhouse domains. It’s a bit like that.

30 Comments Tagged: .health, .news, .science, climate, donuts, mike adams, natural news, new gTLDs, premiums, vaccines

MMX gets four more gTLDs approved for China use

MMX’s Chinese subsidiary has received the government nod for four more of its new gTLDs to operate in the country.
The approved strings are the lifestyle-oriented .fashion, .luxe, .yoga and .fit.
Getting the nod from the Ministry of Industry and Information Technology means Chinese registrants will be able to use domains in the the four gTLDs, albeit subject to China’s much more stringent censorship regime.
MIIT this week also approved .时尚, which is the Chinese version of .fashion, managed by Rise Victory, a subsidiary of Yuwei Registry.
.fashion, .fit and .yoga have about 40,000 domains in their zone files, combined, while .luxe does not yet have a launch date.
MMX has had some success in China with its flagship .vip TLD, which had over 884,000 domains under management at the last public count. It recently said preliminary second-quarter renewals there were a very respectable 75%.
It also recently that that .购物 (.shopping) and .law both went on sale in China, and “will be marketed by in-country specialists as high-value domain names”. Investors were advised not to expect high volumes.

1 Comment Tagged: .fashion, .fit, .luxe, .yoga, .时尚, china, miit, mmx

Four more dot-brands call it quits

Four more dot-brand gTLDs are to disappear after their operators decided they don’t want them any more.
These are the latest victims of the voluntary cull:

• High-priced bling-maker Richemont, an enthusiastic new gTLD early adopter, is dumping .panerai (a watch brand) and .jlc (for Jaeger-LeCoultre, another watch brand), the sixth and seventh of its fourteen originally applied-for gTLDs to be abandoned.
• Norwegian energy company Equinor, which changed its name from Statoil a few months ago, is getting rid of .statoil for obvious reasons. Will it bother to apply for .equinor next time around? We’ll have to wait (and wait) and see.
• Online printing outfit Vistaprint no longer wants .vista, one of its two delegated TLDs. It still has .vistaprint, and is in contracting with ICANN for its bitterly-won .webs, which matches its Webs.com brand.

The three companies informed ICANN of their intention to scrap their registry agreements between May 14 and June 14, but ICANN only published their requests on its web site in the last few hours.
Needless to say, none of the four TLDs had any live sites beyond their contractually mandated minimum.
The number of delegated new gTLD registries to voluntarily terminate their contracts now stands at 36, all dot-brands.
Under ICANN procedures, the termination requests and ICANN’s decision not to re-delegate the strings to other registries are now open for public comment.

2 Comments Tagged: .flc, .panerai, .vista, dot-brands, equinor, ICANN, new gTLDs, richemont, statoil, termination, vistaprint

Plural gTLDs to be banned over confusion concerns

Singular and plural versions of the same word are likely to be banned as coexisting gTLDs in future.
The ICANN community working group looking at rules for subsequent application rounds reckons having both versions of the same word online — something that is happening with more than 30 gTLDs currently — leads to “consumer confusion” and should not be permitted.
It’s one of the surprisingly few firm recommendations in the Initial Report on the New gTLD Subsequent Procedures Policy Development Process, which says:

If there is an application for the singular version of a word and an application for a plural version of the same word in the same language during the same application window, these applications would be placed in a contention set, because they are confusingly similar. An application for a single/plural variation of an existing TLD would not be permitted.

It adds that the mere addition of an S should not be disqualifying; .news would not be considered the plural of .new, for example.
Interestingly, the recommendation is based on advice received from existing registries, many of which fought for singular/plural coexistence during the 2012 round and already operate many such string pairs.
According to my database, these are the 15 plural/singular English string pairs (there are more if you include other languages) currently live in the DNS root:

.careers/.career
.photo/.photos
.work/.works
.cruise/.cruises
.review/.reviews
.accountant/.accountants
.loan/.loans
.auto/.autos
.deal/.deals
.gift/.gifts
.fan/.fans
.market/.markets
.car/.cars
.coupon/.coupons
.game/.games

Some of them are being managed by the same registries; others by competitors.
It’s tempting to wonder whether the newfound consensus that these pairs are confusing represents an attempt by 2012-round registries to slam the door behind them, if for no other reason than to avoid chancers trying to extort money from them by applying for plural or singular versions of other strings they currently manage.
But at an ICANN policy level, the plurals issue was indeed a gaping hole in the 2012 round.
All such clashes were resolved by String Confusion Objections, but only if one of the applicants chose to file such an objection.
These rulings mostly came down on the side of coexistence, but sometimes did not — .kid, .pet and .web were among those placed in direct contention with plural equivalents following aberrant SCO decisions.

5 Comments Tagged: confusion, ICANN, new gTLDs, plural, singular, string confusion objection, subsequent procedures

Digital archery ruled out for next new gTLD round

The oft-mocked “digital archery” system will not be making a return when ICANN finally starts taking more new gTLD applications.
That’s the current thinking of the ICANN community working group looking at subsequent application procedures.
Readers with long memories may recall digital archery as a hack for Californian gambling laws that ICANN org pressed for in 2012 as a way to form its 1,930 applications into an orderly queue for processing.
The idea was that applicants would fire off a bit of data to an ICANN site at a predetermined time and the applicants whose packets arrived closet to the target time, measured by the millisecond, would receive priority in the queue.
It was a bit like drop-catching, and the concept advanced to the stage where companies skilled in such things were offering digital archery services.
But after ICANN changed CEOs later that year, it turned out gambling wasn’t as illegal in California as former management thought it was. The org got itself a license to run a one-off lottery and sold tickets for $100 per application.
That’s now the preferred method for ordering the queue for the next rounds of applications, whenever those may be, according to last week’s Initial Report on the New gTLD Subsequent Procedures Policy Development Process.
Unlike 2012, the WG is proposing that portfolio applicants should be able to swap around their priority numbers according to their commercial interests.
So, if Donuts gets priority #1 for .crappy and #4,000 for .awesome, it would be able to switch priorities to get the better string evaluated earlier.
The WG is also not convinced that internationalized domain names, which received automatic priority in 2012, should get the same preferential treatment this time around.
That’s one of several questions it poses for the community in its public comment period.
While a better place in the evaluation queue had time-to-market advantages in 2012 — Donuts’ .guru sold a tonne of domains largely due to its first-mover status — that’s probably not going to be as big a deal next time around due to domainer skepticism about new gTLDs.

Comment Tagged: ICANN, new gTLDs, prioritization, subsequent procedures, the draw

Could crypto solve the Whois crisis?

Could there be a cryptographic solution to some of the problems caused by GDPR’s impact on public Whois databases? Security experts think so.
The Anti-Phishing Working Group has proposed that hashing personal information and publishing it could help security researchers carry on using Whois to finger abusive domain names.
In a letter to ICANN, APWG recently said that such a system would allow registries and registrars to keep their customers’ data private, but would still enable researchers to identify names registered in bulk by spammers and the like.
“Redacting all registration records which were formerly publicly available has unintended and undesirable consequences to the very citizens and residents that electronic privacy legislation intends to protect,” the letter (pdf) says.
Under the proposed system, each registry or registrar would generate a private key for itself. For each Whois field containing private data, the data would be added to the key and hashed using a standard algorithm such as SHA-512.
For items such as physical addresses, all the address-related fields would be concatenated, with the key, before hashing the combined value.
The resulting hash — a long string of gibberish characters — would then be published in the public Whois instead of the [REDACTED] notice mandated by current ICANN policy.
Security researchers would then be able to identify domains belonging to the same purported registrant by searching for domains containing the same hash values.
It’s not a perfect solution. Because each registry or registrar would have their own key, the same registrant would have different hash values in different TLDs, so it would not be possible to search across TLDs.
But that may not be a huge problem, given that bad guys tend to bulk-register names in TLDs that have special offers on.
The hashing system may also be beneficial to interest groups such as trademark owners and law enforcement, which also look for registration patterns when tracking down abuse registrants.
The proposal would create implementation headaches for registries and registrars — which would actually have to build the crypto into their systems — and compliance challenges for ICANN.
The paper notes that ICANN would have to monitor its contracted parties — not all of which may necessarily be unfriendly to spammers — to make sure they’re hashing the data correctly.

9 Comments Tagged: abuse, apwg, crypto, gdpr, malware, phishing, privacy, spam, whois

Euro-Whois advice still as clear as mud

European privacy chiefs have again weighed in to the ongoing debate about GDPR and Whois, offering another thin batch of vague advice to ICANN.
The European Data Protection Board, in its latest missive (pdf), fails to provide much of the granular “clarity” ICANN has been looking for, in my view.
It does offer a few pieces of specific guidance, but it seems to me that the general gist of the letter from EDPB chair Andrea Jelinek to ICANN CEO Goran Marby is basically: “You’re on your own buddy.”
If the question ICANN asked was “How can we comply with GDPR?” the answer, again, appears to be generally: “By complying with GDPR.”
To make matters worse, Jelinek signs off with a note implying that the EDPB now thinks that it has given ICANN all the advice it needs to run off and create a GDPR-compliant accreditation system for legitimate access to private Whois data.
The EDPB is the body that replaced the Article 29 Working Party after GDPR came into effect in May. It’s made up of the data protection authorities of all the EU member states.
On the accreditation discussion — which aims to give the likes of trademark owners and security researchers access to Whois data — the clearest piece of advice in the letter is arguably:

the personal data processed in the context of WHOIS can be made available to third parties who have a legitimate interest in having access to the data, provided that appropriate safeguards are in place to ensure that the disclosure is proportionate and limited to that which is necessary and the other requirements of GDPR are met, including the provision of clear information to data subjects.

That’s a fairly straightforward statement that ICANN is fine to go ahead with the creation of an accreditation model for third parties, just as long as it’s quite tightly regulated.
But like so much of its advice, it contains an unhelpful nested reference to GDPR compliance.
The letter goes on to say that logging Whois queries should be part of these controls, but that care should be taken not to tip off registrants being investigated by law enforcement.
But it makes no effort to answer Marby’s questions (pdf) about who these legit third-parties might be and how ICANN might go about identifying them, which is probably the most important outstanding issue right now.
Jelinek also addresses ICANN’s lawsuit against Tucows’ German subsidiary EPAG, and I have to disagree with interpretations of its position published elsewhere.
The Register’s Kieren McCarthy, my Chuckle Brother from another Chuckle Mother, reckons the EDPB has torpedoed the lawsuit by “stating clearly that it cannot force people to provide additional ‘admin’ and ‘technical’ contacts for a given domain name”.
Under my reading, what it actually states is that registrants should be able to either use their own contact data, or anonymized contact information identifying a third party, in these records.
The EDPB clearly anticipates that admin and technical contacts can continue to exist, as long as they contain non-personal contact information such as “admin@example.com”, rather than “kevin@example.com”.
That’s considerably more in line with ICANN’s position than that of Tucows, which wants to stop collecting that data altogether.
One area where EDPB does in fact shoot down ICANN’s new Whois policy is when it comes to data retention.
The current ICANN contracts make registrars retain data for two years, but the EDPB notes that ICANN does not explain why or where that number comes from (I hear it was “pulled out of somebody’s ass”).
The EDPB says that ICANN needs to “re-evaluate the proposed data retention period of two years and to explicitly justify and document why it is necessary”.
Finally, the EDPB weighs in on the issue of Whois records for “legal persons” (as opposed to “natural persons”). It turns out their Whois records are not immune to GDPR either.
If a company lists John Smith and john.smith@example.com in its Whois records, that’s personal data on Mr Smith and therefore falls under GDPR, the letter says.
That should provide a strong incentive for registries and registrars to stop publishing potentially personal fields, if they’re still doing so.

5 Comments Tagged: edpb, epag, european data protection board, gdpr, ICANN, privacy, tucows, whois, wp29