Adware dominating popular new gTLD ranks

Afilias’ .kim has become the latest victim (beneficiary?) of adware, as robo-registrations boost the gTLD’s zone file and apparent popularity.
It’s the latest new gTLD, after .xyz and .country, to see its rankings soar after hundreds of gibberish, bulk-registered domains started being used to serve ads by potentially unwanted software.
.kim is today the 4th most-popular new gTLD, with 85 domains in the top 100,000 on the internet and 264 in the top one million.
A month ago, it had a rank of 223, with just 16 domains in the top one million.
The domain names involved — gems such as oatmealsmoke.kim, vegetableladybug.kim and tubhaircut.kim — have seen a boat-load of traffic and rocketing Alexa rank.
The reason for the boost seems to be a one-off bulk registration of about 1,000 meaningless .kim domain names in early February, which now appear to be being used to serve ads via adware.
In this chart (click to enlarge), we see .kim’s zone file growth since the start of 2015.

The spike on February 5, which represents over 1,000 names, is the date almost all of the .kim names with Alexa rank were first registered.
They all appear to be using Uniregistry as the registrar and its free privacy service to mask their Whois details.
These domains often do not resolve if you type them into your browser. They’re also using robots.txt to hide themselves from search engines.
But they’ve been leaving traces of their activity elsewhere on the web, strongly suggesting their involvement in adware campaigns.
It seems that the current (ab?)use of .kim domains is merely the latest in a series of possibly linked campaigns.
I noted in January that gibberish .country domains — at the time priced at just $1 at Uniregistry — were suddenly taking over from .xyz in the popularity charts.
The following three charts, captured from DI PRO’s TLD Health Check, show how the three TLDs’ Alexa popularity rose and fell during what I suspect were related adware campaigns..
First, .xyz, which was the first new gTLD to show evidence of having robo-registrations used in adware campaigns, saw its popularity spike at the end of 2014 and start of 2015:

Next, Minds + Machines’ .country, which saw its zone file spike by 1,500 names around January 6, starts to see its Alexa-ranked total rocket almost immediately.
.country peaks around February 9, just a few days after the .kim robo-registrations were made.

Finally, as .country’s use declines, .kim takes over. Its popularity has been growing day by day since around February 13.

I think what we’re looking at here is one shadowy outfit cycling through bulk-registered, throwaway domain names to serve ads via unwanted adware programs.
It seems possible that domains are retired when they become sufficiently blocked by security countermeasures, and other domains in other TLDs are then brought online to take over.
None of this necessarily reflects badly on any of the new gTLDs in question, or even new gTLDs as a whole, of course.
For starters, I’ve reason to believe that TLDs such as .eu and .biz have previously been targeted by the same people.
The “attacks”, for want of a better word, are only really noticeable because the new gTLDs being targeted are young and still quite small.
It takes much longer to build up genuine popularity for a newly launched web site than it does to merely redirect exist captive traffic to a newly registered domain.
What it may mean, however, is that .kim and .country are going to be in for statistically significant junk drops about a year from now, when the first-year registrations expire.
For .kim, 1,000 names is about 14% of its current zone file. For .country, it’s more like a quarter.
The daily-updated list of new gTLD domains with Alexa rank can be explored by DI PRO subscribers here. The charts in this post were all captured from the respective TLD’s page on TLD Health Check.

2 Comments Tagged: .country, .kim, .xyz, adware, Minds + Machines, new gTLDs, rewardzone, security, uniregistry, xyz.com

.porn now the biggest new gTLD sunrise

.porn and .adult have taken the crown of the most-subscribed new gTLD sunrise periods to date.
The two ICM Registry spaces opened up for registrations from users of the Trademark Clearinghouse on March 2.
A little over a week later, the company tells DI that both gTLDs have individually exceeded the previous sunrise record holder.
My understanding is that .london was the new gTLD with the most sunrise registrations, selling just over 800 names to TMCH customers during its combined sunrise/landrush, which ended last July.
ICM revealed in a webinar last week that it expected its new gTLDs to have to biggest sunrise numbers to date.
“Both .porn and .adult will have exceeded that [.london] number comfortably,” ICM president Stuart Lawley confirmed to DI today.
.adult is “almost neck and neck” with .porn, Lawley said.
The numbers are still pretty small compared to ICM’s 2003-round gTLD, .xxx, which had over 80,000 sunrise applications in October 2011.
They’re also pretty small compared to the TMCH’s overall number of registrations, which at the last public disclosure was a little under 35,000.
But ICM has another couple opportunities for trademark owners to defensively register that may work out cheaper.
First, from April 6 to April 30 companies that bought non-resolving “blocked” names in the .xxx Sunrise B will be able to block the same strings in .porn and .adult.
ICM says registrars are offering discounts for five-year blocks.
Then, from May 6 to May 31 the Domain Matching program starts. That’s open to any .xxx registrant, defensive or otherwise, but not to those with .xxx Sunrise B blocks.

2 Comments Tagged: .adult, icm registry, new gTLDs, porn, sunrise, tmch, trademarks, xxx

.xxx to sell at .com prices to pump .porn launch

ICM Registry is to offer .xxx domain names at dramatically reduced prices, which could be in line with .com pricing at some registrars, for the month of April.
At least one registrar plans to offer .xxx names at about $13 for the duration of the offer.
.porn and .adult are set to go to general availability June 4. Before then, there will be a series of launch phases aimed at giving trademark owners and .xxx registrants plenty of opportunity to defensively register.
One phase, Domain Matching, will run from May 6 to May 31.
During DM, owners of .xxx names will be able to get their matching .porn and .adult domains (assuming they haven’t been claimed in the prior sunrise periods) at a reduced fee.
The discount period in April will enable registrants to pre-qualify for .porn’s Domain Matching by buying .xxx names at a much reduced price.
.porn and .adult prices during general availability are expected to be the same as in .xxx, which retails for around $100 ($62 going to ICM).
I don’t know what ICM’s registry fee during the discount period is, but the registrar EnCirca said it plans to sell a bundle of .xxx, .porn and .adult for $39 during April, which works out to $13 each.
EnCirca and 101domain appear to be pricing DM for a registration in a single TLD at about $19.
ICM’s gesture follows its admission in November that .xxx registrants would not get the free, perpetual block of matching .porn and .adult names that the registry had originally planned to offer.
The company has run a deep-discount program once before, in May 2013, when it sold .xxx at .com prices and saw 13,136 adds, compared to 1,131 in the previous month.

Comment Tagged: .adult, domain matching, encirca, icm registry, porn, xxx

Europeans digging new gTLD more than Americans?

Are European registrants more likely to register new gTLD domain names than those in the US and elsewhere?
That’s the view of Tucows, which sees more new gTLD action from its European OpenSRS resellers than it does from others.
In a blog post last week, OpenSRS blogger Gustavo Arruda noted that Americans are still stuck in a .com mindset:

Our European resellers are leading the charge. We expected the European market to be more open to new gTLDs and that prediction proved correct. It’s a market used to ccTLDs so having a couple hundred more new gTLDs was not a big deal.
North American resellers are lagging behind. It continues to be a very .COM-centric market that is still skeptical about too much choice.
South American and Asian resellers complain about the English-centric nature of new gTLDs. A lot of the new gTLDs we have launched do not make sense in these markets so adoption has been slow.

The post came as OpenSRS recorded its 100,000th new gTLD domain sale.
One reason for the Euro-slant in the market could be the relatively good performance of city gTLDs, most of which are European, and which are easily grasped concepts for buyers familiar with ccTLDs.
Hover, Tucows’ retail registrar, is geo-targeting which TLDs it offers visitors. As DI is based in London, I get offered .london domains prominently when searching for domains there.
The only US geo-gTLDs available to date are .vegas and .nyc.

2 Comments Tagged: hover, new gTLDs, opensrs, tucows

Donuts bought .reise

Donuts has been confirmed by a German news site as the new owner of .reise, which was auctioned by its previous owner last week.
It was the first time a live gTLD had been sold at auction.
The deal, which is believed to have cost Donuts at least $400,000, means the company now owns .reise and .reisen.
Both mean “.travel”. According to my GCSE German skillz, last exercised 22 years ago, .reisen is a verb and .reise is a noun, but .reisen is also the plural of the noun .reise.
I believe this means that Donuts is the first company to own both the plural and singular forms of a new gTLD string.
Heise Online reports that former registry Dotreise was forced to sell up due to competition from Donuts.
Donuts’ .reisen has over 4,000 names in its zone file, compared to .reise’s 1,300. It’s a small market so far, but Donuts has the lion’s share.
The article notes that Donuts got a better position in ICANN’s prioritization draw in late 2012, meaning it got to market slightly earlier. Donuts also sells for a much lower price.
I doubt time to market was as much of a factor as price.
But it might be interesting to note that while Donuts’ advantage was just six days in terms of contract-signing, that lead had been extended to six weeks by the time .reise was delegated.
Donuts, which has more experience than any other company when it comes to the transition to delegation process, managed to hit general availability two weeks sooner than .reise, even though Donuts’ sunrise period was twice as long.

1 Comment Tagged: .reise, .reisen, auctions, donuts, dotreise, ICANN, new gTLDs

ICANN wins .hotels/.hoteis confusion appeal but has to pay up anyway

The proposed new gTLDs .hotels and .hoteis are too confusingly similar to coexist on the internet.
That’s the result of an Independent Review Process decision this week, which denied .hotels applicant Booking.com’s demand to have ICANN’s string confusion decision overturned.
But the IRP panel, while handing ICANN a decisive victory, characterized the string confusion and IRP processes as flawed and said ICANN should have to pay half of the panel’s $163,000 costs.
Booking.com filed the IRP a year ago, after the new gTLD program’s String Similarity Panel said in February 2013 that .hotels was too similar to rival Despegar Online’s proposed .hoteis.
.hoteis is the Portuguese translation of .hotels. Neither string was contested, so both would have been delegated to the DNS root had it not been for the confusion decision.
In my view, the String Similarity Panel’s decision was pretty sound.
With an upper-case i, .hoteIs is virtually indistinguishable from .hotels in browsers’ default sans-serif fonts, potentially increasing the ease of phishing attacks.
But Booking.com, eager to avoid a potentially costly auction, disagrees with me and, after spending a year exhausting its other avenues of appeal, filed an IRP in March 2013.
The IRP decision was handed down on Tuesday, denying Booking.com’s appeal.
The company had appealed based not on the merits of the SSP decision, but on whether the ICANN board of directors had acted outside of its bylaws in establishing an “arbitrary” and opaque SSP process.
That’s because the IRP process as established in the ICANN bylaws does not allow appellants to changed a decision on the merits. IRP panels are limited to:

comparing contested actions of the Board to the Articles of Incorporation and Bylaws, and with declaring whether the Board has acted consistently with the provisions of those Articles of Incorporation and Bylaws.

The IRP panel agreed that the SSP process could have been fairer and more transparent, by perhaps allowing applicants to submit evidence to the panel and appeal its decisions, saying:

There is no question but that that process lacks certain elements of transparency and certain practices that are widely associated with requirements of fairness.

But the IRP panel said Booking.com was unable to show that the ICANN board acted outside of its bylaws, highlighting the limits of the IRP as an appeals process:

In launching this IRP, Booking.com no doubt realized that it faced an uphill battle. The very limited nature of the IRP proceedings is such that any IRP applicant will face significant obstacles in establishing that the ICANN Board acted inconsistently with ICANN’s Articles of Incorporation or Bylaws. In fact, Booking.com acknowledges those obstacles, albeit inconsistently and at times indirectly.
…
Booking.com has failed to overcome the very obstacles it recognizes exist.

The IRP panel quoted members of ICANN’s New gTLD Program Committee extensively, highlighting comments which questioned the fairness of the SSP process.
In contrast to usual practice, where the losing party in an IRP bears the costs of the case, this panel said the $163,000 costs and $4,600 filing fee should be split equally between ICANN and Booking.com:

we can — and we do — acknowledge certain legitimate concerns regarding the string similarity review process raised by Booking.com, discussed above, which are evidently shared by a number of prominent and experienced ICANN NGPC members.
…
In view of the circumstances, each party shall bear one-half of the costs of the IRP provider

Booking.com and Despegar will now have to fight it out for their chosen strings at auction.
The full decision can be read in PDF format here. Other documents in the case can be found here.
The TL;DR version: ICANN wins because it has stacked the appeals deck in its favor and the IRP process is pretty much useless, so we’re going to make them pay up for being dicks.

5 Comments Tagged: .hoteis, .hotels, booking.com, despegar, ICANN, irp, new gTLDs, string confusion

Neustar set to lose contract that provides HALF its revenue

Neustar has been devastated by the news that it is likely to lose a US government contract that provides almost half of its annual revenue.
The US Federal Communications Commission yesterday recommended that Telcordia Technologies take over the Local Number Portability Administrator contract, which Neustar has held since 1997.
The service is basically North America’s centralized phone number registry. It’s not directly related to its domain name businesses.
In 2014, the deal was worth $474.8 million to Neustar, or 49% of its annual revenue.
On the news, the company’s share price fell off a cliff, losing almost 20% of its value before recovering slightly to end the day almost 12% down.
Neustar expressed dismay and anger in a press release, saying the FCC was putting the security of the US phone system at risk:

Although apparently the LNPA is used to port numbers, it is also critical for technology migrations, mergers and acquisitions, disaster recovery, accurate 911 location, and is the only authoritative database for the proper call completion of 11 billion voice calls and text messages each day. The recommendation misunderstands the operating system and would harm public safety, law enforcement, fundamentally burden small carriers, and disrupt service for 12 million consumers — all in pursuit of theoretical savings for a few carriers, which Neustar believes will be dwarfed by the costs and risks of transition.

Switching to Telcordia is currently only a recommendation that FCC commissioners must approve, and Neustar said it will “review all of its options”.
The LNPA deal is due to expire June 30 this year.
Neustar’s domain business — or “security services” as the company calls it — comprises DNS resolution, the registries for .us, .biz and .co, and the back-end registry for many new gTLDs. It brought in revenue of $140.3 million in 2014.
According to Reuters, Neustar is currently talking to advisers about the potential sale of the company, which is currently listed on the New York Stock Exchange, to private equity.
The potential buyers are reportedly waiting for the award of the number portability contract before sealing the deal.

Comment Tagged: lnpa, neustar

Live gTLD .reise sold at auction

The first auction of a live new gTLD resulted in a sale, I can reveal.
Dotreise’s .reise, which is German for “.travel”, changed hands in an auction managed by Applicant Auction last Friday.
Unfortunately, I haven’t been able to identify the winning bidder or the winning bid, but the winner’s identity will inevitably be revealed sooner or later.
Applicant Auction had said there was to be a $400,000 starting bid on the gTLD.
.reise has been general availability since August but has only about 1,300 names in its zone file. It retails for up to $180 a year.
If the TLD’s new owner is not Donuts, the company will find itself competing with Donuts’ much cheaper and more popular .reisen.

2 Comments Tagged: .reise, applicant auction, auction, new gTLDs

Tucows and Namecheap exit $14m .online deal

Tucows and Namecheap have both pulled out of their joint venture with Radix to run the .online registry.
Tucows revealed the move, which will see Radix run .online solo, in a press release yesterday.
Both Tucows and Namecheap are registrars, whereas Radix is pretty much focused on being a registry nowadays.
While financial terms have not been disclosed, Tucows CEO Elliot Noss had previously said that each of the three companies had funded the new venture to the tune of $4 million to $5 million.
I estimate that this puts the total investment in the deal — which includes the price of winning .online at auction — at $13 million to $14 million.
Noss has also hinted that the gTLD sold for much more than the $6.8 million paid for .tech.
.online has not yet been delegated.

Comment Tagged: .online, auction, namecheap, new gTLDs, radix, tucows

More security issues prang ICANN site

ICANN has revealed details of a security problem on its web site that could have allowed new gTLD registries to view data belonging to their competitors.
The bug affected its Global Domains Division customer relationship management portal, which registries use to communicate with ICANN on issues related to delegation and launch.
ICANN took GDD down for three days, from when it was reported February 27 until last night, while it closed the hole.
The vulnerability would have enabled authenticated users to see information from other users’ accounts.
ICANN tells me the issue was caused because it had misconfigured some third-party software — I’m guessing the Salesforce.com platform upon which GDD runs.
A spokesperson said that the bug was reported by a user.
No third parties would have been able to exploit it, but ICANN has been coy about whether any it believes any registries used the bug to access their competitors’ accounts.
ICANN has ‘fessed up to about half a dozen crippling security problems in its systems since the launch of the new gTLD program.
Just in the last year, several systems have seen downtime due to vulnerabilities or attacks.
A similar kind of privilege escalation bug took down the Centralized Zone Data Service last April.
The RADAR service for registrars was offline for two weeks after being hacked last May.
A phishing attack against ICANN staff in December enabled hackers to view information not normally available to the public.

1 Comment Tagged: gdd, ICANN, new gTLDs, security, vulnerability