Uniregistry says it was unaffected by mother of all DDoS attacks

Almost 50 top-level domains were believed to be exposed to the massive distributed denial-of-service attack that hit Dyn on Friday, but the largest of the bunch said it managed to stay online throughout.
As has been widely reported in the mainstream and tech media over the last few days, DNS service provider Dyn got whacked by one of the biggest pieces of DDoS vandalism in the internet’s brief history.
Dyn customers including Netflix, Twitter, Spotify, PayPal and Reddit were reportedly largely inaccessible for many US-based internet users over the space of three waves of attack over about 12 hours.
The company said in a statement that the Mirai botnet was likely the attackers’ tool of choice.
It said that “10s of millions” of unique IP addresses were involved.
It has since emerged that many of the bots were actually installed on webcams secured with easily-guessable default passwords. XiongMai, a Chinese webcam manufacturer, has issued a recall.
In terms of the domain registry business, only about 50 TLDs use Dyn’s DynTLD service for DNS resolution, according to IANA records.
About half of these are tiny ccTLDs. They other half are Uniregistry’s portfolio of new gTLDs, including the like of .link, .car and .photo.
Uniregistry CEO Frank Schilling told DI that the Uniregistry TLDs did not go down as a result of the attack, pointing out that the company also uses its own in-house DNS.
“We like Dyn and think they have a great product but we did not go down because we also run our own DNS,” he said. “If we relied on them exclusively we would have gone down, but that is why we don’t do that.”

Comment Tagged: ddos, dyn, mirai, uniregistry

Big brands condemn “fraudulent” .feedback gTLD in ICANN complaint

Top Level Spectrum has been accused today of running the gTLD .feedback in a “fraudulent and deceptive” manner.
Over a dozen famous brands, corralled by corporate registrar MarkMonitor, today formally complained to ICANN that .feedback is a “complete sham”.
They reckon that the majority of .feedback domains belong to entities connected to the registry, violate trademarks, and have been stuffed with bogus and plagiarized reviews.
TLS denies any involvement.
MarkMonitor clients Adobe, American Apparel, Best Buy, Facebook, Levi and Verizon are among those that today filed a Public Interest Commitments Dispute Resolution Policy complaint with ICANN.
PICDRP is the mechanism third parties can use to complain about new gTLD registries they believe are in breach of the Public Interest Commitments found in their registry contracts.
The 50-page complaint (pdf), which comes with hundreds of pages of supporting documentation spread over 36 exhibits, purports to show TLS engaging in an “escalating pattern of discriminatory, fraudulent and deceptive registry misconduct”.
While the allegations of wrongdoing are fairly broad, the most interesting appears to be the claim that TLS quietly registered thousands of .feedback names matching trademarks to itself and then filled them with reviews either ripped off from Yelp! or supplied by overseas freelancers working for pennies.
TLS denies that it did any of this.
The .feedback registry is closely tied to the affiliated entity Feedback SAAS, which offers a hosted social platform for product/company reviews. Pricing for .feedback domains is dependent on whether registrants use this service or not.
The complaint states:

the overwhelming majority of domain names registered and activated within the .FEEDBACK TLD — over seventy percent (70%) — are currently owned and operated by Respondent [TLS], and parties working in concert with Respondent
…
Respondent has solicited and paid numerous third parties, including professional freelance writers who offer to post a set number of words for a fee, to write fabricated reviews regarding Complainants’ products and services.
…
These ostensibly independent reviews from ordinary consumers are intended to give the appearance of legitimate commentary within .FEEDBACK sites, when, in fact, the reviews are a complete sham.

An investigation carried out by MarkMonitor (pdf) showed that of the 2,787 .feedback domains registered up to July 31, 73% were registered to just five registrants.
The top registrant, Liberty Domains LLC of Las Vegas, owned 47% of these domains.
MarkMonitor believes this company (which it said does not show up in Nevada company records) and fourth-biggest registrant Core Domains LLC (based at the same Vegas mail forwarding service) are merely fronts for TLS, though it has no smoking gun proving this connection.
TLS CEO Jay Westerdal denies the company is affiliated with Liberty.
The MarkMonitor investigation counted 27,573 reviews on these sites, but 22% of them purported have been written prior to the date the domain was registered, in some cases by years.
The company reckons hundreds of reviews can be traced to five freelance writers who responded to February job ads looking for people who could write and post 10 150-word reviews per hour.
Other reviews appear to have been copied wholesale from Yelp! (this can be easily verified by visiting almost any .feedback site and searching for exact-match content on Google).
Westerdal told DI last week that registrants can use an API to import reviews.
The brands’ complaint goes on to criticize TLS for its Free.feedback offering, a very odd, bare-bones web site which seems to offer free .feedback domains.
When you type a domain or email address into the form on Free.feedback, it offers to give you the equivalent .feedback domain for free, automatically populating a second form with the Whois record of the original domain.
According to the complaint, after somebody registers a free .feedback domain, Feedback SAAS starts contacting the person listed in the Whois about their “free trial registration” regardless of whether they were actually the person who signed up the the domain. The complaint states:

Complainants and multiple other trademark owners who received such email notifications from Feedback SAAS and TLS registrars never visited the FREE.FEEDBACK website, and they never requested a free trial registration in the .FEEDBACK TLD

I’ve been unable to fully replicate this experience in attempts to test Free.feedback.
The complaint alleges multiple breaches of the PICs in the .feedback ICANN Registry Agreement.
The brands want ICANN Compliance to conduct a thorough investigation of .feedback, for all Free.feedback domains with phony Whois to be terminated, and for affected trademark owners to get refunds. They also want their legal costs paid by TLS.
ICANN does not typically publish the outcome of PICDRP complaints. Indeed, this is only the second one I’m aware of. It’s difficult to judge what MarkMonitor’s posse’s chances of success are.

3 Comments Tagged: .feedback, feedback saas, free.feedback, ICANN, markmonitor, picdrp, pics, tls, top level spectrum

Guess which registrars sell the most gTLDs

MarkMonitor has become the first accredited registrar to carry over 500 gTLDs.
Inspired by a recent Dynadot press release outlining its passing of the 500-TLD mark, I thought I’d put together a league table of gTLD registrars, ordered by which carries the most.
It will come as little surprise to most that brand protection registrars dominate the top end of the list.
MarkMonitor tops the league, with 504 gTLDs in its stable as of the end of June, up from 499 in May.
It’s closely followed by Ascio and CSC. Indeed, brand-focused registrars occupy many of the top 30 registrars, as you can see from this table.
[table id=45 /]
There’s no real correlation between the number of gTLDs carried and the total domains under management for the registrar.
GoDaddy, with 53 million names, is way down in 28th position, for example.
The list was compiled from the latest gTLD registry reports, which show how many domains were registered to each accredited registrar at the end of June.
The data does not not include ccTLDs, nor does it account for situations where registrars may retail a TLD via a gateway or as a reseller of another registrar.

7 Comments Tagged: ascio, csc, markmonitor, new gTLDs

Google could shake up the registry market with new open-source Nomulus platform

Google has muscled in to the registry service provider market with the launch of Nomulus, an open-source TLD back-end platform.
The new offering appears to be tightly integrated with Google’s various cloud services, challenging long-held registry pricing conventions.
There are already indications that at least one of the gTLD market’s biggest players could be considering a move to the service.
Donuts revealed yesterday it has been helping Google with Nomulus since early 2015, suggesting a shift away from long-time back-end partner Rightside could be on the cards.
Nomulus, which is currently in use at Google Registry’s handful of early-stage gTLDs, takes care of most of the core registry functions required by ICANN, Google said.
It’s a shared registration system based on the EPP standard, able to handle all the elements of the domain registration lifecycle.
Donuts contributed code enabling features it uses in its own 200-ish gTLDs, such as pricing tiers, the Early Access Period and Domain Protected Marks List.
Nomulus handles Whois and likely successor protocol RDAP (Registration Data Access Protocol).
For DNS resolution, it comes with a plug-in to make TLDs work on the Google Cloud DNS service. Users will also be able to write code to use alternative DNS providers.
There’s also software to handle daily data escrow to a third-party provider, another ICANN-mandated essential.
But Nomulus lacks critical features such as billing and fully ICANN-compliant reporting, according to documentation.
So will anyone actually use this? And if so, who?
It’s too early to say for sure, but Donuts certainly seems keen. In a blog post, CEO Paul Stahura wrote:

As the world’s largest operator of new TLDs, Donuts must continually explore compelling technologies and ensure our back-end operations are cost-efficient and flexible… Google has a phenomenal record of stability, an almost peerless engineering team, endless computing resources and global scale. These are additional potential benefits for us and others who may contribute to or utilize the system. We have been happy to evaluate and contribute to this open source project over the past 20 months because this platform provides Donuts with an alternative back-end with significant benefits.

In a roundabout way, Donuts is essentially saying that Nomulus could work out cheaper than its current back-end, Rightside.
The biggest change heralded by Nomulus is certainly pricing.
For as long as there has been a competitive market for back-end domain registry services, pricing has been on a per-domain basis.
While pricing and model vary by provider and customer, registry operators typically pay their RSPs a flat fee and a buck or two for each domain they have under management.
Pricing for dot-brands, where DUM typically comes in at under 100 today, is believed to be weighted much more towards the flat-fee service charge element.
But that’s not how Nomulus is to be paid for.
While the software is open source and free, it’s designed to run on Google’s cloud hosting services, where users are billed on the fly according to their usage of resources such as storage and bandwidth consumed.
For example, the Google Cloud Datastore, the company’s database service that Nomulus uses to store registration and Whois records, charges are $0.18 per gigabyte of storage per month.
For a small TLD, such as a dot-brand, one imagines that storage costs could be reduced substantially.
However, Nomulus is not exactly a fire-and-forget solution.
There is no Google registry service with customer support reps and such, at least not yet. Nomulus users are responsible for building and maintaining their registry like they would any other hosted application.
So the potentially lower service costs would have to be balanced against potentially higher staffing costs.
My hunch based on the limited available information is that for a dot-brand or a small niche TLD operating on a skeleton crew that may lack technical expertise, moving to Nomulus could be a false economy.
With this in mind, Google may have just created a whole new market for middleman RSPs — TLD management companies that can offer small TLDs a single point of contact for technical expertise and support but don’t need to build out and own their own expensive infrastructure.
The barrier to entry to the RSP market may have just dropped like a rock, in other words.
And Nomulus may work out more attractive to larger TLD operators such as Donuts, with existing teams of geeks, that can take advantage of Google’s economies of scale.
Don’t expect any huge changes overnight though. Migrating between back-ends is not an easy or cheap feat.
As well as ICANN costs, and data migration and software costs, there’s also the non-trivial matter of shepherding a horde of registrars over to the new platform.
How much impact Nomulus will have on the market remains to be seen, but it has certainly given the industry something to think about.

1 Comment Tagged: .cloud, back-end, donuts, google, new gTLDs, nomulus, rightside, rsps

States drop IANA transition block lawsuit

Four US states attorneys general have quietly thrown in the towel in their attempt to have the IANA transition blocked.
The AGs of Texas, Nevada, Arizona and Oklahoma unilaterally dropped their Texas lawsuit against the US government on Friday, court records show.
A filing (pdf) signed by all four reads simply:

Plaintiffs hereby provide notice that they are voluntarily dismissing this action pursuant to Federal Rule of Civil Procedure 41(a)(1)(A)(i).

That basically means the case is over.
The AGs had sued the US National Telecommunications and Information Administration, seeking an eleventh-hour restraining order preventing the IANA transition going ahead.
The TRO demand was comprehensively rejected, after ICANN and organizations representing numerous big-name technology companies let their support for the transition be known in court.
The plaintiffs had said they were considering their options, but now appear to have abandoned the case.
It was widely believed that the suit was politically motivated, an attempt by four Republican officials to stir up anti-Obama sentiment in the run-up to the US presidential election.

Comment Tagged: iana, ICANN, ntia, transition

Donuts will cut off sham .doctors

Donuts has outlined plans to suspend or delete .doctor domain names used by fake medical doctors.
Despite protestations from governments and others, .doctor will not be a restricted gTLD when it goes to general availability next week — anyone will be able to register one.
However, Donuts said last week that it will shut down phony doctor sites:

While we are firmly committed to free speech on the Internet, we however will be on guard against inappropriate or dangerous uses of .DOCTOR. Accordingly, if registrants using this name make the representation on their websites that they are licensed medical practitioners, they should be able to demonstrate upon request that in fact they hold such a license. Failure to so demonstrate could be considered a violation of the terms of registration and may subject the registrant to registrar and registry rights to delete, revoke, suspend, cancel, or transfer a registration.

A Donuts spokesperson said that the registry will have the right to conduct spot-checks on sites, but at first will only police the gTLD in response to complaints from others.
“We have the right to spot check, but no immediate plans to do so,” he said.
In a few fringe cases, the failure to present a license would not result in the loss of a domain.
For example, a “registrant is in a jurisdiction that doesn’t license doctors (if that exists)” or a “registrant that represents him/herself as a licensed medical doctor, but uses the site to sell cupcakes”, the spokesperson said.
ICANN’s Governmental Advisory Committee had wanted .doctor restricted to medical doctors, but Donuts complained noting that “doctor” is an appellation used in many other fields beyond medicine.
It can also be used in fanciful ways to market products, the registry said.
ICANN eventually sided with Donuts, allowing it to keep an open TLD as long as it included certain Public Interest Commitments in its registry contract.
.doctor goes to GA October 26.

Comment Tagged: .doctor, donuts, ICANN, new gTLDs

Registrar accused of pimping prescription penis pills

ICANN has implicated a Chinese domain name registrar in the online selling of medications, including Viagra and Cialis, without the required prescription.
The organization’s Compliance department filed a contract breach notice with Nanjing Imperiosus, which does business as DomainersChoice.com, today.
The move follows an allegation from pharmacy watchdog LegitScript in the US Congress that DomainersChoice is “rogue internet pharmacy operator”.
Because ICANN has no authority to police online pharmacies, it’s gone after the registrar based on an obscure part of the Registrar Accreditation Agreement.
Section 3.7.7 of the 2013 RAA says that domains must be registered to a third party, unless they’re used by the registrar in the course of providing its registrar services.
According to ICANN, DomainersChoice has refused to provide evidence that many of its domains are not in fact registered to itself and CEO Stefan Hansmann, in violation of this clause.
It cites 5mg-cialis20mg.com, acheterdutadalafil.com, viagra-100mgbestprice.net and 100mgviagralowestprice.net as examples of domains apparently registered to Hansmann and his company.
Historical Whois records show Hansmann and Nanjing Imperiosus as the registrant of these names until recently.
The domains all refer to erectile dysfunction medicines, which are usually only available in the US with a prescription.
A reverse Whois lookup reveals Hansmann’s name in the records for many more pharmaceuticals-related domains, some of which are for more serious medical conditions.
Several of the domains contain the words “without prescription” or similar, where the drug in question requires a prescription in the US.
Some of the domains do not currently resolve or no longer provide current Whois records and others have been recently transferred, but some resolve to apparently active e-commerce sites.
ICANN’s breach notice (pdf) doesn’t allege any illegal activity.
The same cannot be said for LegitScript CEO John Horton, who lumped DomainersChoice in with a few other registrars he believes are operating “illegal online pharmacies”.
Horton testified (pdf) before Congress last month that the registrar was playing host to 2,300 such sites.
The testimony was filed September 14, the same day ICANN began its compliance investigation.
ICANN’s notice, which alleges a handful of other relatively trivial breaches, asks that Hansmann provide a full list of domains registered in his and his company’s name via DomainersChoice.
It also demands evidence that the domains were either used to provide registrar services or were registered to a third party.
It wants all that by November 2, after which it may start to terminate the company’s RAA.

Comment Tagged: compliance, fake pharma, ICANN, legitscript, Nanjing Imperiosus, raa

Rightside new gTLD renewals can top 80%

Rightside says it is seeing encouraging renewal figures from its oldest batch of new gTLDs.
The company this week revealed that renewals after two years of ownership on average stand at 81%.
In a blog post, Rightside broke out some numbers for .dance, .democrat, .ninja, .immobilien, .social, .reviews and .futbol.
Those seven are the only ones in its portfolio to have gone through two full renewal cycles.
The renewal rate after year one was a modest 69% — in other words it lost almost a third of its installed base after 12 months — but this increased to 81% after the second year.
The actual number of domains involved in quite tiny — 81% equates to just 21,000 names across all seven TLDs.
Breaking out a couple of TLDs, Rightside wrote:

Our first gTLD to market, .DANCE, saw a 70% renewal rate in year one expand to 83% in year two for that same subset of domains. Our best performing gTLD of the seven is .IMMOBILIEN, which renewed at 83% in its first year, and grew to a stupendous 87% in its second—which certainly makes sense given the permanent nature of real estate.

But Rightside reckons the numbers reflect well on the new gTLD industry. It said:

domain investors with portfolios including new gTLDs recognize the long-term value of these domain names, and rather than let them drop after the first year, are holding onto them to find the right buyer continue to earn parking revenue. Second—and likely the more significant driver—is that end users are actually picking up these domain names and putting them to use.

2 Comments Tagged: .dance, .democrat, .futbol, .immobilien, .ninja, .reviews, .social, new gTLDs, renewals, rightside

.xxx to get lower ICANN fees, accept the URS

ICM Registry has negotiated lower ICANN transaction fees as part of a broad amendment to its Registry Agreement that also includes new trademark protection measures.
The company’s uniquely high $2 per-transaction fee could be reduced to the industry standard $0.25 by mid-2018.
As part of the renegotiated contract, ICM has also agreed to impose the Uniform Rapid Suspension policy on its registrants.
URS is the faster, cheaper version of UDRP that allows trademark owners to have domain names suspended in more clear-cut cases of cybersquatting.
The $2 fee was demanded by ICANN when ICM first signed its RA in 2011.
At the time, ICANN said the higher fee, which had doubled from a 2010 draft of the contract, was to “account for anticipated risks and compliance activities”.
The organization seemed to have bought into the fears that .xxx would lead to widespread misuse — something that has noticeably failed to materialize — and was expecting higher legal costs as a result.
The companion TLDs .adult, .porn and .sex, all also managed by ICM, only pay $0.25 per transaction.
The overall effects on registrants, ICANN and ICM will likely be relatively trivial.
With .xxx holding at roughly 170,000 domains and a minimal amount of inter-registrar transfer activity, ICM seems to be paying ICANN under $400,000 a year in transaction fees at the moment.
Its registry fee is usually $62, though a substantial number of domains have been sold at lower promotional pricing, so the cost to registrants is not likely to change a great deal.
The reduction to $0.25 would have to be carried out in stages, with the earliest coming this quarter, and be reliant on ICM keeping a clean sheet with regards contract compliance.
Under the deal, ICM has agreed to adopt many of the provisions of the standard Registry Agreement for 2012-round gTLDs.
One of those is the URS, which may cause consternation among domainers fearful that the rights protection mechanism may one day also find its way into the .com registry contract.
ICM has also agreed to implement its existing policies on, for example, child abuse material prevention, into the contract as Public Interest Commitments.
The RA amendment is currently open for public comment at ICANN.

Comment Tagged: fees, ICANN, icm registry, new gTLDs, registry agreement, uniform rapid suspension, urs, xxx

NameCheap stops selling .xyz domains

NameCheap may have sold over a million .xyz domains, but apparently it will sell no more than that.
The registrar confirmed to DI this evening that it is no longer taking .xyz registrations. It declined to explain why.
It has also stopped selling .college and .rent domains — two other gTLDs owned by XYZ.com. Other new gTLDs are not affected.
It’s reportedly not accepting inbound transfers either, though existing domains can be renewed.
The switch-off happened at the end of last month, a NameCheap representative said.
That’s just one month after the registrar celebrated its one millionth .xyz registration, which XYZ.com commemorated with a blog post bigging up NameCheap’s user-customers.
The move is peculiar indeed. NameCheap is the third highest-volume .xyz registrar, behind West.cn and Uniregistry, responsible for about 15% of .xyz’s domains under management.
It’s also NameCheap’s biggest direct-selling gTLD by a considerable margin.
NameCheap is well-known as primarily an eNom reseller — it accounts for 28% of eNom’s domains under management and 18% of its revenue, largely from .com sales.
But with new gTLDs it has started selling domains on its own IANA ticker, meaning a direct connection to the registry and more gross profit for itself.
According to June’s registry reports, the million .xyz names accounted for roughly two thirds of NameCheap’s total DUM (not counting names sold via eNom).
The closet rival in its portfolio is .online, which provided the registrar with about 81,000 DUM.
The registrar added about 350,000 .xyz domains in June, a month in which it briefly offered them at $0.02 each.
At that time, the company reported technical issues that led to a 12-24 hour backlog of registrations to process, though its blog post announcing the problem appears to have since been deleted.
NameCheap has declined to comment on the reason for the surprise move, and XYZ did not immediately respond to a request for comment.
The fact that all of XYZ.com’s TLDs have been cut off suggests some kind of dispute between the two companies, but the fact that renewals can still be processed would suggest that NameCheap has not lost its .xyz accreditation.
More info if I get it…

14 Comments Tagged: .college, .rent, .xyz, enom, namecheap, new gTLDs, xyz.com