First registrar “breached” UDRP lock rule

ICANN has charged a registrar with failing to abide by “cyberflight” rules for the first time.
Visesh Infotecnics did not lock down e-campaigner.com within two days of it being hit by a UDRP a couple of weeks ago, ICANN said in a compliance notice (pdf) on Thursday.
Visesh is based in India and does business as Signdomains.com. It has roughly 5,000 gTLD domains under management.
The transfer lock rule became ICANN consensus policy binding on all registrars last July, following four years of policy and implementation work.
It’s designed to prevent cybersquatters switching registrars when a UDRP lands in their inbox, a practice known as cyberflight.
The registrant of e-campaigner.com did not in fact change registrars, judging by Whois records.
The UDRP appears to have been filed in late January by a currently undisclosed entity. Signdomains put the domain on client-hold status February 8, according to Whois records.
This is the first time ICANN has publicly accused a registrar of failing to abide by the policy.
ICANN also says that the registrar does not display Whois data in the correct format on its web site, and that it owes some accreditation fees.
It has until March 3 to rectify these alleged breaches.

Patent troll hits registrars with $60m shakedown

A patent troll that claims it invented email reminders has launched a shakedown campaign against registrars that could be worth as much as $62 million.
WhitServe LLC, which beat Go Daddy in a patent lawsuit last year, is now demanding licenses from registrars that could add as much as $0.50 to the cost of a domain name.
According to registrar sources, registrars on both sides of the Atlantic have this month been hit by demands for hundreds of thousands or millions of dollars in patent licensing fees.
The legal nastygrams present thinly veiled threats of litigation if the recipients decline to negotiate a license.
WhitServe is a Connecticut-based IP licensing firm with connections to NetDocket, which provides software for tracking patent license annuities.
It owns US patents 5,895,468 and 6,182,078, both of which date back to the late 1990s and cover “automating delivery of professional services”.
Basically, the company reckons it invented email reminders, such as those registrars send to registrants in the weeks leading up to their domain registration expiring.
Three years ago, GoDaddy, defending itself against WhitServe’s 2011 patent infringement lawsuit, compared the “inventions” to the concept putting “Don’t forget to pick up milk” notes on the fridge: utterly obvious and non-patentable.
In December 2012, GoDaddy implied WhitServe used its patent expertise and exploited a naive 1990s USPTO to obtain “over-broad” patents.
It was trying “to monopolize the entire concept of automatic Internet reminders across all industries, including domain name registrars”, according to a GoDaddy legal filing.
But the market-leading registrar somehow managed to lose the case, opting to settle last August after its last defense fell apart, for an undisclosed sum.
Now, WhitServe is using that victory to shake loose change out of the pockets of the rest of the market.
It’s told registrars that GoDaddy and Endurance International (owner of Domain.com, BigRock and others) are both currently licensing its patents.
The deal it is offering would see registrars pay $0.50 for every domain they have under management, a number that seems to be based on .com registry numbers reported by Verisign.
The fee would be reduced to $0.30 per name for each name over one million, and $0.20 for each name over five million, I gather. That’s still more than registrars pay in ICANN fees.
If WhitServe were to target every .com registrar (which I do not believe it has, yet) its demands could amount to as much as $62 million industry-wide, given that .com is approaching 125 million names right now.
It’s not clear whether these fees are expected to be one-time payments or recurring annual fees.
It’s a trickier predicament for registrars than the usual patent shakedown, because registrars are legally obliged under their contracts with ICANN to send email reminders in a variety of circumstances.
The Expired Registration Recovery Policy requires them to email renewal reminders to customers at least twice before their registrations expire.
There’s also the Whois Data Reminder Policy, which obliges registrars to have their customers check the accuracy of their Whois once a year.
These are not services registrars are simply able to turn off to avoid these patent litigation threats.
Whether registrars will take this lying down or attempt to fight it remains to be seen.

Pirates lose privacy rights under new ICANN rules

People operating piracy web sites would have a harder time keeping their personal information private under new ICANN rules.
ICANN’s GNSO Council last night approved a set of recommendations that lay down the rules of engagement for when trademark and copyright owners try to unmask Whois privacy users.
Among other things, the new rules would make it clear that privacy services are not permitted to reject requests to reveal a domain’s true owner just because the IP-based request relates to the content of a web site rather than just its domain name.
The recommendations also contain safeguards that would allow registrants to retain their privacy if, for example, their safety would be at risk if their identities were revealed.
The 93-page document (pdf) approved unanimously by the Council carries a “Illustrative Disclosure Framework” appendix that lays out the procedures in some depth.
The framework only covers requests from IP owners to proxy/privacy services. The GNSO was unable to come up with a similar framework for dealing with, for example, requests from law enforcement agencies.
It states flatly:

Disclosure [of the registrant’s true Whois details] cannot be refused solely for lack of any of the following: (i) a court order; (ii) a subpoena; (iii) a pending civil action; or (iv) a UDRP or URS proceeding; nor can refusal to disclose be solely based on the fact that the Request is founded on alleged intellectual property infringement in content on a website associated with the domain name.

This fairly explicitly prevents privacy services (which in most cases are registrars) using the “we don’t regulate content” argument to shoot down disclosure requests from IP owners.
Some registrars were not happy about this paragraph in early drafts, yet it remains.
Count that as a win for the IP lobby.
However, the new recommendations spend a lot more time giving IP owners a quite strict set of guidelines for how to file such requests in the first place.
If they persistently spam the registrar with automated disclosure requests, the registrar is free to ignore them. They can even share details of spammy IP owners with other registrars.
The registrar is also free to ignore requests that, for example, don’t give the exact or representative URL of an alleged copyright infringement, or if the requester has not first attempted to contact the registrant via an email relay service, should one be in place.
The registrant also gets a 15-day warning that somebody has requested their private details, during which, if they value their privacy more than their web site, they’re able to relinquish their domain and remain anonymous.
If the registrant instead uses that time to provide a good reason why they’re not infringing the requester’s rights, and the privacy service agrees, the request can also be denied.
The guidelines would make it easier for privacy service operators to understand what their obligations are. By formalizing the request format, it should make it easier to separate legit requests from the spurious requests.
They’re even allowed to charge IP owners a nominal fee to streamline the processing of their requests.
While these recommendations have been approved by the GNSO Council, they need to be approved by the ICANN board before becoming the law of the ‘net.
They also need to pass through an implementation process (conducted by ICANN staff and GNSO members) that turns the recommendations into written procedures and contracts which, due to their complexity, I have a hunch will take some time.
The idea is that the rules will form part of an accreditation program for privacy/proxy services, administered by ICANN.
Registrars would only be able to use P/P services that agree to follow these rules and that have been accredited by ICANN.
It seems to me that the new rules may be quite effective at cracking down on rogue, “bulletproof” registrars that automatically dismiss piracy-based disclosure requests by saying they’re not qualified to adjudicate copyright disputes.

ICANN confirms domain privacy is for all

Commercial entities will not be excluded from buying domain privacy services, ICANN’s GNSO Council has confirmed.
The Council last night voted unanimously to approve a set of recommendations that would make it compulsory for privacy and proxy services to be accredited by ICANN for the first time.
The recommendations govern among other things how privacy services are expected to behave when they receive notices of trademark or copyright infringement.
But missing is a proposal that would have prevented the use of privacy for “transactional” web sites, something which caused a great deal of controversy last year.
The newly adopted recommendations clearly state that nobody is to be excluded from privacy on these grounds.
The Council voted to adopt the final, 93-page report of the Privacy and Proxy Services Accreditation Issues (pdf) working group, which states:

Fundamentally, P/P services should remain available to registrants irrespective of their status as commercial or non-commercial organizations or as individuals. Further, P/P registrations should not be limited to private individuals who use their domains for non-commercial purposes.

The minority view that web sites that process financial transactions should not be able to use privacy came from intellectual property, anti-abuse and law enforcement community members.
However, opponents said it would infringe the privacy rights of home business owners, bloggers, political activists and others.
It could even lead to vicious “doxing”-related crimes, such as “swatting”, where idiots call in fake violent crime reports against rivals’ home addresses, some said.
It also turned out, as we revealed last November, that 55% of US presidential candidates operate transactional web sites that use privacy on their domains.
Two separate registrar initiatives, one backed by the Electronic Frontier Foundation, started letter-writing campaigns that resulted in over 20,000 comments being received on the the PPSAI’s initial report last July.
Those comments are acknowledged in the PPSAI final report that the GNSO Council just approved.
The adopted recommendations (which I’ll get into in a separate article) still have to be approved by the ICANN board of directors and have to undergo an implementation process that puts the rather broad policies into concrete processes and procedures.

Instagram paid Chinese cyberquatter $100,000 for instagram.com, Facebook lawsuit reveals

Facebook has sued a Chinese cybersquatter for trying to renege on a five-year-old deal that saw it buy the domain instagram.com for $100,000.
The lawsuit, filed in California last week, claims that a family of known cybersquatters, based in Guangdong, is trying to have the purchase invalidated by a Chinese court.
The company, which acquired Instagram for $1 billion in 2012, wants the court to rule that the domain deal was legal, preventing the cybersquatters retaking control of the domain.
Photo-sharing app Instagram launched in October 2010 using the domain instagr.am.
At that time, instagram.com was owned by a US-based domain investor, but it was bought by Zhou Weiming about a month later.
Zhou, Facebook says, was the now-dead father of three of the people it is suing, and the husband of the fourth.
When Zhou purchased the domain, Instagram had become wildly popular, well on the way to hitting the million-user mark in December 2010.
Instagram had applied for the US trademark on its name in September 2010, less than a month before its launch.
The company made the decision to pay $100,000 for the domain in January 2011.
The Whois information for instagram.com changed from Zhou Weiming to Zhou Murong, apparently his daughter, around about the same time, though the registrant email address did not change.
The purchase was processed by Sedo, according to a copy of the deal filed as evidence (pdf).
Now, Murong’s mother and sisters are suing her and Instagram in China, claiming she did not have the authority to sell the domain, according to Facebook’s complaint.
Facebook claims the Chinese suit is a “sham” and that the whole Zhou family is acting in concert.
The company wants the California court to declare that the sale was valid, and that registrar MarkMonitor should not be forced to transfer the domain back to the Zhous.
Facebook in 2014 won a 22-domain UDRP case against Murong Zhou, related to typos of its Instagram trademark.
Read the full California complaint as a PDF here.

Top 2015 new gTLD sale looks like cybersquatting

One of the top secondary market domain sales of 2015, as reported by Sedo, appears to be a case of somebody selling a domain matching a trademark to the trademark’s owner.
According to a press release yesterday, the domain basic-fit.fitness was the third-priciest reportable new gTLD domain sale handled by Sedo last year.
It went for €7,949 ($8,634).
Given that it’s not intrinsically an attractive-looking domain, I tried to figure out why it sold.
Judging by Whois records, the buyer is the corporate owner of Basic-Fit, a chain of over 300 gyms in four European countries.
It has at least one trademark on “Basic-Fit”.
The original registrant, according to records cached by DomainTools, was a Belgian web designer.
The domain seems to have changed hands around May last year. In April, it spent a couple of weeks under Whois privacy.
The domain was registered August 27, 2014, the day .fitness exited its Early Access Period and domains were available at regular prices.
It seems the same Belgian web designer owns several more new gTLD domain names matching brands that are parked with Sedo and available to buy instantly.
Many are .immo (“.realestate”) domains matching the brands of Belgian real estate firms. There are also a few .beer domains under his name matching the brands of breweries and beers in the UK, US and Czech Republic.
It’s not unheard of for web developers to register domains on behalf of clients. It’s rather less common for them to then list them for sale, with buy-now prices, on domain marketplaces.
Looks dodgy to me.

More on my Twitter.sucks reg

If you were reading on Friday, you’ll know that I brought about the registration of the domain twitter.sucks and took charge of a web site hosted at that address.
I hinted that there was a little more to the story, but couldn’t get into it.
The first part of the story is here.
What I didn’t mention was that twitter.sucks was in my This.sucks account for probably less than 10 minutes before I removed it.
I have no beef with Twitter and no particular desire to moderate a .sucks discussion forum.
After removing twitter.sucks from my account, I noticed that This.sucks again gave me the option to “register” a free .sucks domain.
So I experimentally “registered” thisdotsucks.sucks too.
Again, the domain started resolving, showed up in Whois, and the associated WordPress site went live within seconds.
At this point, I discovered that I had admin privileges for both twitter.sucks and thisdotsucks.sucks sites simultaneously.
Suspecting that I may have found a bug that would allow anyone to register an essentially unlimited number of free and potentially trademark-matching .sucks domains, I informed This.sucks of my findings in the interest of responsible bug disclosure and ended my blog post prematurely.
Late Friday, This.sucks spokesperson Phil Armstrong told me that it wasn’t a bug after all.
He said that the company allows one “do-over”. So if you register a name for free, then delete it, you get another one for free.
He also said that WordPress admin privileges for domains removed from user accounts expire after a period (I had admin rights for the twitter.sucks web site for roughly 48 hours after I deleted it from my account.)
Right now, the domain twitter.sucks still exists, registered to This.sucks as before, as does the associated web site. I have no idea if another user has taken over its administration or if it’s in some kind of limbo state.
All I know is that it’s nothing to do with me any more.

How I just registered Twitter.sucks for free in just five clicks

This morning, I caused the registration of and was given control of a web site at twitter.sucks.
I didn’t pay a thing, though I did — by checking a box linked to hidden terms and conditions — promise to pay $10,000 if I was later determined to be working for Twitter.
Ordinarily, registering a .sucks domain would have cost me over $200.
The controversial This.sucks service (which may share ownership with .sucks registry Vox Populi) has gone live and is giving out 10,000 .sucks web sites for free.
Users, who can sign up merely by connecting their Facebook or LinkedIn accounts, are able to cause This.sucks to register names on their behalf.
They are then immediately given limited control over a WordPress blog hosted at that domain, though not to the associated name servers or Whois records.
It’s actually quite a slick, streamlined service, that could quite easily dramatically increase the number of active .sucks site overnight.
But it’s going to cause no end of headaches for trademark owners.
Earlier this week, you may recall DI reporting that This.sucks seemed to have registered the .sucks names matching the brands of Twitter, Adobe, Goldman Sachs and Justin Timberlake.
It seems that this may have been a test of the This.sucks service, as I was tipped off last night that twitter.sucks was no longer registered.
Here’s how I got control over the twitter.sucks web site in just FIVE clicks.
This.sucks has a domain availability query box, just like a regular registrar. I looked up “twitter”:

Seeing that the domain was available, I went through the two-click process of allowing This.sucks to use my Facebook login credentials.

Obviously, while I used a genuine Facebook account, I see no reason why I couldn’t have used a fake one.
After connecting, I was bounced back to This.sucks and was given the ability to register twitter.sucks in a single click.

I also had to check a box confirming:

I’m a free-thinking individual, not a corporate yes-man. I agree to the terms and conditions and any penalties which may apply.

Clicking either of the T&C links, or hovering over the question mark, will introduce you to the concept of a $10,000 penalty.

That’s right — by causing This.sucks to register a .sucks domain, you agree to pay $10,000 if the company decides, in its “sole discretion” that you are affiliated with the matching trademark owner. The terms state:

Site Runners on this.sucks must be individuals who have no affiliation with the subject matter of the Site. You can’t be running the Site on behalf of a company, entity or anyone who is the subject of the Site.
As a Site Runner you agree that if you are found by this.sucks, in our sole discretion, to be in violation of this principal, that a $10,000 USD payment to This.sucks will immediately become due and payable. You will also no longer be a Site Runner with us. Your Site may also be given to a different Site Runner to run.
If you think a Site is being run by someone acting on behalf of the subject of the Site, please email us at whistleblower@this.sucks

Given that Twitter’s lawyers are probably going to hate me for doing this, I felt pretty confident in accepting this risk.
In addition, at this point This.sucks has not asked me for any payment information. If they want $10,000 off of me, they can take a hike, I figure.
So I clicked the “Register Now” button.
Bam! In under 10 seconds the domain name twitter.sucks existed in DNS, in Whois, and there was a simple WordPress web site there that I, to a significant extent, controlled.
The domain is registered to This.sucks, which makes it clear on its web site FAQ that its users — or “Site Runners” — do not actually own the domains they cause to be registered.

As administrator of the WordPress site, I am able to create and update blog posts as well as change the appearance by switching between a limited selection of themes. I can also edit and delete comments and manage registered users.
There’s a little bit more to my story — which I cannot get into for now.
For the moment, it must suffice to say that this is a whole new world for famous brand owners.
They can either pay the roughly $2,000 required to defensively register their brand in .sucks, or they can try to sneak through a free (or $0.99 per month) registration at This.sucks at the risk of being billed $10,000 if they get rumbled.

Twitter and Justin Timberlake targeted by This.sucks

This.sucks, a company with close ties to .sucks registry Vox Populi, has started registering domain names matching famous brands to itself.
Twitter, along with singer Justin Timberlake, software maker Adobe and investment bank Goldman Sachs all saw their matching .sucks domains registered by This.sucks on Friday, according to the .sucks zone file and Whois queries.
The domains twitter.sucks, goldmansachs.sucks, justintimberlake.sucks and adobe.sucks currently resolve in browsers, but only to a password-protected web site.
New York-based This.sucks says its service is in beta. It plans to give 10,000 .sucks domains away for free, and to sell them for as little as $12 per year. Its business model has not been revealed.
That’s a deep discount from their regular $250 suggested retail price, which rises to $2,500 for domains matching famous brands.
Technically, the company should have just paid around $10,000 for the four brand-matching domains it has just registered.
But it is broadly suspected that This.sucks shares ownership with Vox Populi, the .sucks registry operator, which would make this a case of the right hand paying the left.
As we uncovered in October, Vox Populi originally hosted This.sucks’ web sites and the CEO of Momentous, which founded Vox Pop, paid for its web site to be developed.
The two companies also share a physical address and a Cayman Islands lawyer.
Vox Pop has denied any involvement in This.sucks, saying it’s just another customer.
It will be interesting to see how long it takes for one of the four affected brands to file a UDRP or URS complaint on these new domains.
As far as I can tell, the .sucks namespace currently has an unblemished UDRP record.
Unlike rival Top Level Spectrum, which runs .feedback, neither Vox Pop nor This.sucks has revealed any plans to use brands belonging to third parties as part of their services.
TLS has said it plans to sell 5,000 branded .feedback domains to a third party after its sunrise period ends next month.
It has already registered fox.feedback to itself as one of its special 100-domain pre-sunrise registry allowance.
Since we last reported on .feedback a month ago, the registry appears to have also registered the names of all the current US presidential candidates — such as donaldtrump.feedback and hillaryclinton.feedback — to itself.
The sites are all live, as is santaclaus.feedback, which seeks commentary on the “fictional” character.

How one registrar allegedly dodges ICANN Compliance

A Chinese registrar has been accused by ICANN of playing games to avoid complying with Whois policy.
In a breach notice from ICANN Compliance last week, Beijing-based 35 Technology is told that it has failed to verify Whois records as required by its accreditation agreement.
The domain in question was shoesbbalweb.com, which DomainTools’ archived screenshots show was once used to sell branded running shoes.
I understand that 35 is believed to have suspended the domain when ICANN first referred a Whois accuracy complaint to it.
It is then said to have un-suspended the domain, without any change to the Whois record, as soon as ICANN closed the complaint.
The breach notice (pdf) instructs 35 to:

Provide records and information demonstrating that 35 Technology took steps to verify and validate the Whois information of the domain name since 23 March 2015, or provide ICANN with an explanation why the domain name suspension was removed without verifying and validation Whois information

The switcheroo appears to have been brief enough that its suspended state was not recorded by DomainTools.
ICANN has a monitoring program, however, that randomly spot-checks previously complained-about domains for ongoing compliance.
The registrar, which does business at 35.com, is not tiny. It had over 450,000 domains under management, in legacy gTLDs and a handful of Chinese-script new gTLDs, at the last count.
It has until the end of the month to explain itself or risk termination.