Google leaks 282,000 private Whois records

Google has accidentally revealed registrant contact information for 282,867 domain names that were supposed to be protected by a privacy service.
The bug reportedly affected 94% of the 305,925 domains registered via Google Apps, an eNom reseller.
The glitch was discovered by Cisco and reported to Google February 19. It has since been fixed and customers were notified yesterday.
Google acknowledged in an email to customers that the problem was caused by a “software defect in the Google Apps domain renewal system”.
It seems that anyone who acquired a domain with privacy through Google Apps since mid-2013 and has since renewed the registration will have had their identities unmasked in Whois upon renewal.
Names, addresses, emails and phone numbers were revealed.
Due to services such as DomainTools, which cache Whois records, there’s no putting the genie back in the bottle. The information is out there for good now.
It’s a pretty major embarrassment for Google, which recently launched its own registrar.

Comment Tagged: enom, google, google apps, privacy, whois

Here’s why trademark owners will think .sucks sucks

Vox Populi Registry is to launch its .sucks gTLD at the end of the month, and its plans are likely to piss off trademark owners no end.
As previously reported, the company has backpedaled on its idea of pricing its sunrise period names at $25,000 per name per year, but it’s introducing some new concepts that seem almost designed to get hackles up in the IP community.
From March 30 to May 29, any company with a trademark registered in the Trademark Clearinghouse will be able to buy their matching .sucks domains at sunrise for $2,499. That’s also the annual renewal fee.
It’s a tenth of the price previously touted, but still pretty steep even by sunrise standards.
Vox Pop isn’t doing anything particularly unusual with its sunrise, which is governed by policies closely regulated by ICANN.
But its big new idea is its “Sunrise Premium” list, a list of strings dominated by famous trademarks.
Vox Pop CEO John Berard told DI yesterday that the Sunrise Premium list has been compiled from strings registered or blocked in other TLDs’ sunrise periods.
While he declined to characterize it as a list of trademarks, he acknowledged that it will be trademark-heavy.
If your mark is on this list, you will never be able to get a .sucks domain at the regular general availability retail price of $249 a year. It will always be $2,499 a year.
Despite the name, Sunrise Premium names are only available during general availability, which begins June 1.
On the one hand, this mandatory premium pricing for the world’s most well-defended marks appears to have benefits for some trademark owners.
While Sunrise Premium names are not restricted to owners of matching marks, the $2,499 fee applies whether you’re the mark owner, a legitimate third-party registrant, or a cybersquatter.
So the high price looks like a deterrent to cybersquatting, suggesting that Vox Pop is fighting from the IP corner.
But then we discover that Sunrise Premium names will never be eligible for the .sucks “Block” service — similar to .xxx’s Sunrise B, a Block is a non-resolving registry reservation — which is expected to retail at a discounted $199 per year.
Berard said that the registry wants to encourage use.
“If you are on the Sunrise Premium list or want a premium name, those can’t be blocked,” Berard said. “It’s all part and parcel of us trying to put more power in the hands of individuals and to cultivate a commitment on behalf of the commercial world to participate in the dialogue.”
But the fact remains: if you have a track record of defensively registering your trademark, Vox Pop is essentially penalizing you with higher fees.
Feel those hackles rising yet?
Vox Pop’s stated goals are to give companies a way to manage customer feedback and individuals a way to exercise their rights to criticize.
“A company would be smart to register its name because of the value that consumer criticism has in improving customer loyalty, delivering good customer service, understanding new product and service possibilities,” Berard said.
“They’re spending a lot more on marketing and customer service and research. This domain can another plank in that platform,” he said. “On the other hand, we also want to make sure that these names are also accessible to individuals who have something to say.”
Companies on the Sunrise Premium list have an additional thing to worry about: the .sucks Consumer Advocate Subsidy, which will bring the price of a .sucks domain down to $9.95 per year.
The subsidy will only be available to registrants unaffiliated with the trademark-owning company, and they’ll have to direct their domains to a discussion forum platform called Everything.sucks.
Berard said Everything.sucks will be operated by a third party, but could not yet disclose the details.
The subsidy program will be available on regular and Sunrise Premium names, but not Sunrise names. It is not expected to launch until September.
It’s not yet clear how flexible and configurable the service will be.
It seems likely that if somebody wants to write a blog, say, criticizing a certain company, product, service or public figure, they will incur the usual $249 annual reg fee.
It’s not exactly “free” speech.
On the whole, the finalized policies and fees may look like they’re specifically designed to irk the IP lobby, but they do seem to be aligned with Vox Pop’s mission statement.
If you’re of the view that trademark owners should have the sole right to use the string matching their mark as a domain name, you’re likely to be unhappy with what Vox Pop is doing.
If, on the other hand, you’re an advocate of the right of every free person to stick it to The Man, you may view the policies more favorably.
Either way, it could be a money-spinner for Vox Pop.
I’m expecting .sucks to be only the third new gTLD to top 1,000 sunrise registrations (assuming .porn and .adult will be the first).
Assuming the registry’s slice of the $2,499 fee is over $2,000, the company is looking to clear in excess of $2 million in annually recurring sunrise revenue alone.

4 Comments Tagged: blocks, ICANN, new gTLDs, sucks, sunrise, sunrise premium, trademarks, vox populi

Nominet to give nod to .uk privacy services

Nominet plans to start accrediting proxy/privacy services in .uk domain names, and to make it easier to opt-out of having your full contact details published in Whois.
The proposed policy changes are outlined in a consultation opened this morning.
“We’ve never recognized privacy services,” director of policy Eleanor Bradley told DI. “If you’ve registered a .uk with a privacy service, we consider the privacy service to be the registrant of that domain name.”
“We’ve been pretending almost that they didn’t exist,” she said.
Under the proposed new regime, registrars would submit a customer’s full contact details to Nominet, but Nominet would publish the privacy service’s information in the domain’s Whois output.
Nominet, getting its hands on the customer data for the first time, would therefore start treating the end customer as the true registrant of the domain.
The company says that introducing the service would require minimal work and that it does not intend to charge registrars an additional fee.
Currently, use of privacy services in .uk is pretty low — just 0.7% of its domains, up from 0.09% a year ago.
Bradley said such services are becoming increasingly popular due to some large UK registrars beginning to offer them.
One of the reasons for low penetration is that quite a lot of privacy is already baked in to the .uk Whois database.
If you’re an individual, as opposed to a “trading” business, you’re allowed to opt-out of having any personal details other than your name published in Whois.
A second proposed reform would make that opt-out available to a broader spectrum of registrants, Nominet says.
“We’ve found over the last few years that it’s quite a hard distinction to draw,” Bradley said. “We’ve had some criticisms for our overly strict application of that.”
In future, the opt-out would be available according to these criteria:

i. The registrant must be an individual; and,
ii. The domain name must not be used:
a) to transact with customers (merchant websites);
b) to collect personal data from subjects (ie data controllers as defined in the Data Protection Act);
c) to primarily advertise or promote goods, services, or facilities.

The changes would allow an individual blogger to monetize her site with advertising without being considered a “trading” entity, according to Nominet.
But a line would be drawn where an individual collected personal data on users, such as email addresses for a mailing list, Bradley said.
Nominet says in its consultation documents:

Our continued commitment to Nominet’s role as the central register of data will enable us to properly protect registrants’ rights, release contact data where necessary under the existing exemptions, and maintain public confidence in the register. It acknowledges that some registrants may desire privacy, whilst prioritising the core function of the registry in holding accurate records.

The proposals are open for comments until June 3, which means they could potentially become policy later this year.

Comment Tagged: .uk, nominet, privacy, whois

Rightside to release 20,000 two-character domains

A week from now, new gTLD registry Rightside is to release over 20,000 two-character domain names.
The releases will come across all of its delegated gTLDs, but exclude letter-letter combinations.
Only letter-number, number-letter and number-number combinations will be available, following ICANN’s partial lifting of the ban on two-character domains back in December.
Strings such as “a1”, “2b” and “69” will presumably become available.
Rightside said the domains will be sold on a first-come, first-served basis, with prices ranging from $200 to $50,000.
The registry has almost 30 delegated new gTLDs, including .auction, .software, .lawyer, .sale and .video.
If you’re interested, set your alarms for 1700 UTC on March 18. That’s when all 20,000 drop.
Two-letter domains are still reserved, pending the outcome of ICANN’s government-delayed release process.

5 Comments Tagged: ICANN, new gTLDs, rightside, two-character

Adware dominating popular new gTLD ranks

Afilias’ .kim has become the latest victim (beneficiary?) of adware, as robo-registrations boost the gTLD’s zone file and apparent popularity.
It’s the latest new gTLD, after .xyz and .country, to see its rankings soar after hundreds of gibberish, bulk-registered domains started being used to serve ads by potentially unwanted software.
.kim is today the 4th most-popular new gTLD, with 85 domains in the top 100,000 on the internet and 264 in the top one million.
A month ago, it had a rank of 223, with just 16 domains in the top one million.
The domain names involved — gems such as oatmealsmoke.kim, vegetableladybug.kim and tubhaircut.kim — have seen a boat-load of traffic and rocketing Alexa rank.
The reason for the boost seems to be a one-off bulk registration of about 1,000 meaningless .kim domain names in early February, which now appear to be being used to serve ads via adware.
In this chart (click to enlarge), we see .kim’s zone file growth since the start of 2015.

The spike on February 5, which represents over 1,000 names, is the date almost all of the .kim names with Alexa rank were first registered.
They all appear to be using Uniregistry as the registrar and its free privacy service to mask their Whois details.
These domains often do not resolve if you type them into your browser. They’re also using robots.txt to hide themselves from search engines.
But they’ve been leaving traces of their activity elsewhere on the web, strongly suggesting their involvement in adware campaigns.
It seems that the current (ab?)use of .kim domains is merely the latest in a series of possibly linked campaigns.
I noted in January that gibberish .country domains — at the time priced at just $1 at Uniregistry — were suddenly taking over from .xyz in the popularity charts.
The following three charts, captured from DI PRO’s TLD Health Check, show how the three TLDs’ Alexa popularity rose and fell during what I suspect were related adware campaigns..
First, .xyz, which was the first new gTLD to show evidence of having robo-registrations used in adware campaigns, saw its popularity spike at the end of 2014 and start of 2015:

Next, Minds + Machines’ .country, which saw its zone file spike by 1,500 names around January 6, starts to see its Alexa-ranked total rocket almost immediately.
.country peaks around February 9, just a few days after the .kim robo-registrations were made.

Finally, as .country’s use declines, .kim takes over. Its popularity has been growing day by day since around February 13.

I think what we’re looking at here is one shadowy outfit cycling through bulk-registered, throwaway domain names to serve ads via unwanted adware programs.
It seems possible that domains are retired when they become sufficiently blocked by security countermeasures, and other domains in other TLDs are then brought online to take over.
None of this necessarily reflects badly on any of the new gTLDs in question, or even new gTLDs as a whole, of course.
For starters, I’ve reason to believe that TLDs such as .eu and .biz have previously been targeted by the same people.
The “attacks”, for want of a better word, are only really noticeable because the new gTLDs being targeted are young and still quite small.
It takes much longer to build up genuine popularity for a newly launched web site than it does to merely redirect exist captive traffic to a newly registered domain.
What it may mean, however, is that .kim and .country are going to be in for statistically significant junk drops about a year from now, when the first-year registrations expire.
For .kim, 1,000 names is about 14% of its current zone file. For .country, it’s more like a quarter.
The daily-updated list of new gTLD domains with Alexa rank can be explored by DI PRO subscribers here. The charts in this post were all captured from the respective TLD’s page on TLD Health Check.

2 Comments Tagged: .country, .kim, .xyz, adware, Minds + Machines, new gTLDs, rewardzone, security, uniregistry, xyz.com

.porn now the biggest new gTLD sunrise

.porn and .adult have taken the crown of the most-subscribed new gTLD sunrise periods to date.
The two ICM Registry spaces opened up for registrations from users of the Trademark Clearinghouse on March 2.
A little over a week later, the company tells DI that both gTLDs have individually exceeded the previous sunrise record holder.
My understanding is that .london was the new gTLD with the most sunrise registrations, selling just over 800 names to TMCH customers during its combined sunrise/landrush, which ended last July.
ICM revealed in a webinar last week that it expected its new gTLDs to have to biggest sunrise numbers to date.
“Both .porn and .adult will have exceeded that [.london] number comfortably,” ICM president Stuart Lawley confirmed to DI today.
.adult is “almost neck and neck” with .porn, Lawley said.
The numbers are still pretty small compared to ICM’s 2003-round gTLD, .xxx, which had over 80,000 sunrise applications in October 2011.
They’re also pretty small compared to the TMCH’s overall number of registrations, which at the last public disclosure was a little under 35,000.
But ICM has another couple opportunities for trademark owners to defensively register that may work out cheaper.
First, from April 6 to April 30 companies that bought non-resolving “blocked” names in the .xxx Sunrise B will be able to block the same strings in .porn and .adult.
ICM says registrars are offering discounts for five-year blocks.
Then, from May 6 to May 31 the Domain Matching program starts. That’s open to any .xxx registrant, defensive or otherwise, but not to those with .xxx Sunrise B blocks.

2 Comments Tagged: .adult, icm registry, new gTLDs, porn, sunrise, tmch, trademarks, xxx

.xxx to sell at .com prices to pump .porn launch

ICM Registry is to offer .xxx domain names at dramatically reduced prices, which could be in line with .com pricing at some registrars, for the month of April.
At least one registrar plans to offer .xxx names at about $13 for the duration of the offer.
.porn and .adult are set to go to general availability June 4. Before then, there will be a series of launch phases aimed at giving trademark owners and .xxx registrants plenty of opportunity to defensively register.
One phase, Domain Matching, will run from May 6 to May 31.
During DM, owners of .xxx names will be able to get their matching .porn and .adult domains (assuming they haven’t been claimed in the prior sunrise periods) at a reduced fee.
The discount period in April will enable registrants to pre-qualify for .porn’s Domain Matching by buying .xxx names at a much reduced price.
.porn and .adult prices during general availability are expected to be the same as in .xxx, which retails for around $100 ($62 going to ICM).
I don’t know what ICM’s registry fee during the discount period is, but the registrar EnCirca said it plans to sell a bundle of .xxx, .porn and .adult for $39 during April, which works out to $13 each.
EnCirca and 101domain appear to be pricing DM for a registration in a single TLD at about $19.
ICM’s gesture follows its admission in November that .xxx registrants would not get the free, perpetual block of matching .porn and .adult names that the registry had originally planned to offer.
The company has run a deep-discount program once before, in May 2013, when it sold .xxx at .com prices and saw 13,136 adds, compared to 1,131 in the previous month.

Comment Tagged: .adult, domain matching, encirca, icm registry, porn, xxx

Europeans digging new gTLD more than Americans?

Are European registrants more likely to register new gTLD domain names than those in the US and elsewhere?
That’s the view of Tucows, which sees more new gTLD action from its European OpenSRS resellers than it does from others.
In a blog post last week, OpenSRS blogger Gustavo Arruda noted that Americans are still stuck in a .com mindset:

Our European resellers are leading the charge. We expected the European market to be more open to new gTLDs and that prediction proved correct. It’s a market used to ccTLDs so having a couple hundred more new gTLDs was not a big deal.
North American resellers are lagging behind. It continues to be a very .COM-centric market that is still skeptical about too much choice.
South American and Asian resellers complain about the English-centric nature of new gTLDs. A lot of the new gTLDs we have launched do not make sense in these markets so adoption has been slow.

The post came as OpenSRS recorded its 100,000th new gTLD domain sale.
One reason for the Euro-slant in the market could be the relatively good performance of city gTLDs, most of which are European, and which are easily grasped concepts for buyers familiar with ccTLDs.
Hover, Tucows’ retail registrar, is geo-targeting which TLDs it offers visitors. As DI is based in London, I get offered .london domains prominently when searching for domains there.
The only US geo-gTLDs available to date are .vegas and .nyc.

2 Comments Tagged: hover, new gTLDs, opensrs, tucows

Donuts bought .reise

Donuts has been confirmed by a German news site as the new owner of .reise, which was auctioned by its previous owner last week.
It was the first time a live gTLD had been sold at auction.
The deal, which is believed to have cost Donuts at least $400,000, means the company now owns .reise and .reisen.
Both mean “.travel”. According to my GCSE German skillz, last exercised 22 years ago, .reisen is a verb and .reise is a noun, but .reisen is also the plural of the noun .reise.
I believe this means that Donuts is the first company to own both the plural and singular forms of a new gTLD string.
Heise Online reports that former registry Dotreise was forced to sell up due to competition from Donuts.
Donuts’ .reisen has over 4,000 names in its zone file, compared to .reise’s 1,300. It’s a small market so far, but Donuts has the lion’s share.
The article notes that Donuts got a better position in ICANN’s prioritization draw in late 2012, meaning it got to market slightly earlier. Donuts also sells for a much lower price.
I doubt time to market was as much of a factor as price.
But it might be interesting to note that while Donuts’ advantage was just six days in terms of contract-signing, that lead had been extended to six weeks by the time .reise was delegated.
Donuts, which has more experience than any other company when it comes to the transition to delegation process, managed to hit general availability two weeks sooner than .reise, even though Donuts’ sunrise period was twice as long.

1 Comment Tagged: .reise, .reisen, auctions, donuts, dotreise, ICANN, new gTLDs

ICANN wins .hotels/.hoteis confusion appeal but has to pay up anyway

The proposed new gTLDs .hotels and .hoteis are too confusingly similar to coexist on the internet.
That’s the result of an Independent Review Process decision this week, which denied .hotels applicant Booking.com’s demand to have ICANN’s string confusion decision overturned.
But the IRP panel, while handing ICANN a decisive victory, characterized the string confusion and IRP processes as flawed and said ICANN should have to pay half of the panel’s $163,000 costs.
Booking.com filed the IRP a year ago, after the new gTLD program’s String Similarity Panel said in February 2013 that .hotels was too similar to rival Despegar Online’s proposed .hoteis.
.hoteis is the Portuguese translation of .hotels. Neither string was contested, so both would have been delegated to the DNS root had it not been for the confusion decision.
In my view, the String Similarity Panel’s decision was pretty sound.
With an upper-case i, .hoteIs is virtually indistinguishable from .hotels in browsers’ default sans-serif fonts, potentially increasing the ease of phishing attacks.
But Booking.com, eager to avoid a potentially costly auction, disagrees with me and, after spending a year exhausting its other avenues of appeal, filed an IRP in March 2013.
The IRP decision was handed down on Tuesday, denying Booking.com’s appeal.
The company had appealed based not on the merits of the SSP decision, but on whether the ICANN board of directors had acted outside of its bylaws in establishing an “arbitrary” and opaque SSP process.
That’s because the IRP process as established in the ICANN bylaws does not allow appellants to changed a decision on the merits. IRP panels are limited to:

comparing contested actions of the Board to the Articles of Incorporation and Bylaws, and with declaring whether the Board has acted consistently with the provisions of those Articles of Incorporation and Bylaws.

The IRP panel agreed that the SSP process could have been fairer and more transparent, by perhaps allowing applicants to submit evidence to the panel and appeal its decisions, saying:

There is no question but that that process lacks certain elements of transparency and certain practices that are widely associated with requirements of fairness.

But the IRP panel said Booking.com was unable to show that the ICANN board acted outside of its bylaws, highlighting the limits of the IRP as an appeals process:

In launching this IRP, Booking.com no doubt realized that it faced an uphill battle. The very limited nature of the IRP proceedings is such that any IRP applicant will face significant obstacles in establishing that the ICANN Board acted inconsistently with ICANN’s Articles of Incorporation or Bylaws. In fact, Booking.com acknowledges those obstacles, albeit inconsistently and at times indirectly.
…
Booking.com has failed to overcome the very obstacles it recognizes exist.

The IRP panel quoted members of ICANN’s New gTLD Program Committee extensively, highlighting comments which questioned the fairness of the SSP process.
In contrast to usual practice, where the losing party in an IRP bears the costs of the case, this panel said the $163,000 costs and $4,600 filing fee should be split equally between ICANN and Booking.com:

we can — and we do — acknowledge certain legitimate concerns regarding the string similarity review process raised by Booking.com, discussed above, which are evidently shared by a number of prominent and experienced ICANN NGPC members.
…
In view of the circumstances, each party shall bear one-half of the costs of the IRP provider

Booking.com and Despegar will now have to fight it out for their chosen strings at auction.
The full decision can be read in PDF format here. Other documents in the case can be found here.
The TL;DR version: ICANN wins because it has stacked the appeals deck in its favor and the IRP process is pretty much useless, so we’re going to make them pay up for being dicks.

5 Comments Tagged: .hoteis, .hotels, booking.com, despegar, ICANN, irp, new gTLDs, string confusion