Verisign to crack down on Chinese domains

Verisign has asked for permission to implement a more stringent regime for denying or suspending .com and .net domain names registered in China, to comply with the country’s strict licensing rules.

The changes appear to mean that customers of Chinese registrars who have not verified their identities, which Verisign says is a “very small percentage”, will be prevented from registering new domains and may lose their existing domains.

The company has filed a Registry Services Evaluation Process request with ICANN, proposing to tweak the registrant verification system it has had in place for the last five years in a few significant ways.

China has a system called Real Name Verification, whereby Chinese citizens have to provide government-issued ID when they register domains. Local, third-party Verification Service Providers such as ZDNS typically carry out the verification function for Verisign and other foreign registries.

The big change is that Verisign will no longer allow names to be registered without a valid code.

The RSEP says that attempts by China-based registrars to register domains without the required government verification code will result in the EPP create command failing, meaning the domain will not be registered.

Under the current system, outlined in a 2016 RSEP (pdf), the name is registered and Verisign presumably takes the money, but the domain is placed on serverHold status, meaning it is not published in the zone and will not resolve.

The new system will also allow Verisign to retroactively demand codes for already-registered names, when they come up for renewal or transfer, with the option to suspend or delete the names if the codes are not provided. The RSEP (pdf) states:

With regard existing domain names without the required verification codes, which currently comprise a very small percentage of domain name registrations from registrars licensed to operate in the People’s Republic of China, Verisign intends to address compliance issues with these domain names directly with registrars. Verisign reserves the right to deny, cancel, redirect or transfer any domain name registration or transaction, or place any domain name(s) on registry lock, hold or similar status

It’s not clear what a “very small percentage” means in hard numbers. A small slice of a big pie is still a mouthful.

Verisign has substantial exposure to the Chinese market. On the odd occasion when .com shrinks, it’s largely due to speculative registrations from China not being renewed, such as in the second quarter this year.

The RSEP names the service the Domain Name Registration Validation Per Applicable Law service. While it’s in theory applicable to any jurisdiction’s laws, in practice it’s all about addressing the demands of the Chinese government.

Verisign announces ANOTHER price increase as regs slide

Verisign posted a rare decrease in its .com/.net registered name base in the second quarter, but said it is going to raise its .net prices next year anyway.

The company also massively slashed its growth outlook for domain sales this year.

The annual cost of a .net name will go up 10%, the maximum permissible under its contract with ICANN, to $9.92 from February 1 next year, the registry said

Registrants will as usual be able to lock-in the current renewal fee of $9.02 for up to 10 years if they renew before the hike kicks in.

It’s the first .net price increase since 2018. The TLD has been stagnating in volume terms for several years, due no doubt in part to behavioral changes following the introduction of new gTLDs starting in late 2013.

The news came as Verisign reported that its domain base shrunk during Q2.

The company ended June with 174.3 million names under management, up 2.2% over a year earlier but down 350,000 domains compared to the end of Q1.

The split was 161.1 million for .com and 13.2 million for .net — that’s a sequential decrease of 200,000 for .com and a decrease of 200,000 for .net. Both rounded, of course.

CEO Jim Bidzos told analysts tonight that renewals were affected by a great many first-time registrations from China not renewing. General post-pandemic and macro-economic factors also played a role, he said.

The preliminary renewal rate was 75.9% compared to 76.0% a year earlier, but the number of new regs was down to 10.1 million from 11.7 million over the same period.

Verisign reported Q2 revenue up 6.8% on a year ago at $352 million, with net income of $167 million compared to $148 million. Its operating margin swelled to 67.1% percent from 64.7%.

Bidzos told analysts that the company is cutting its registered name growth prediction for the year to between 0.5% and 1.5%, a huge decrease from the already-downgraded estimate of 1.75% and 3.5% it made after the first quarter.

He said that he expects Q3 and Q4 to go much the same way as Q2.

Bidzos said he thinks the current factors affecting regs are a bump in the road and he expects things to stabilize over time.

UPDATE 2148 UTC — The article was updated to correct the comparison of the decrease in .com/.net regs.

Controversial Chinese firm among two newly revealed UNR gTLD buyers

Two more former UNR top-level domains have formally changed hands following the company’s fire sale over a year ago.

The ICANN contracts governing .llp and .help have been reassigned, the former to Intercap Registry and the latter to a new-to-the-industry Seychelles-based company called Innovation service Ltd, ICANN records show.

Intercap is a relatively known quantity, already running the .inc, .dealer and .box gTLDs.

Innovation is an entirely different kettle of fish.

The company appears to be led by a Hong Kong entrepreneur named Heng Lu, best known for making millions obtaining IPv4 addresses from Afrinic, the African Regional Internet Registry, and leasing them to clients in China for a huge profit.

Heng Lu is also the founder of Cloud Innovation Ltd, another Seychelles shell. It is currently embroiled in a string of lawsuits with Afrinic, which last year tried to revoke Cloud’s membership and therefore its IPv4 space.

The case(s) of Cloud versus Afrinic are pretty convoluted and a bit off-beat for this blog, but at one point last year it led to Afrinic’s bank accounts being frozen by the Mauritius Supreme Court, putting IP address management across the whole continent at risk.

ICANN would certainly have been aware of this already when it approved the transfer of the .help gTLD to what appears to be a related company. After the Mauritius injunction, Afrinic pleaded with ICANN for financial help, which ICANN provided.

The two transfers mean we now know the identities of the buyers of 17 of the 23 gTLD contracts UNR put up for sale in April 2021. ICANN took a long time to approve the reassignments due to worries about IP rights.

China yanks Daily Stormer domain after Buffalo mass shooting

The far-right propaganda site The Daily Stormer has lost yet another domain name, after the Chinese ccTLD registry deleted dailystormer.cn.

The Daily Stormer was among the sites the suspect in this weekend’s mass shooting in Buffalo reportedly cited as sources of his radicalization to a violent white-supremacist ideology.

Whois records show that dailystormer.cn was registered barely a month ago. The web site had previously been using a .name domain registered via a Chinese registrar, having TLD-hopped between various ccTLDs and gTLDs for years.

Today, English-language Chinese government-owned newspaper Global Times reported that the .cn domain has been taken down after registry CNNIC was alerted to the connection.

It’s no longer resolving from where I’m sitting, but Whois records indicate it was owned by Daily Stormer owner Andrew Anglin.

The web site, which cached copies show is filled with racist, sexist, homophobic and downright inaccurate posts, first ran afoul of domain registrars in 2017, when GoDaddy, Tucows and Google all kicked it out on the same day. Namecheap has also previously deleted one of its names.

It’s also been banned from ccTLDs from Albania, Austria, Iceland and Russia, along with gTLDs including .lol, .name, .red and .top.

Verisign wipes free TLDs from the world stats

The number of domain names registered globally dropped by over 25 million in the first quarter, but only because Verisign has stopped tracking .tk and its free sister ccTLDs in its quarterly estimates.

The latest Domain Name Industry Brief says that 2021 ended with 341.7 million registrations across all TLDs, substantially fewer that the 367.3 million it reported at the end of the third quarter.

But this is only because Verisign has decided to no longer count the six Pacific and African ccTLDs managed by Freenom, notably .tk, which had contributed 24.7 million names to the Q3 tally.

The report says: “the .tk, .cf, .ga, .gq and .ml ccTLDs have been excluded from all applicable calculations, due to an unexplained change in estimates for the .tk zone size and lack of verification from the registry operator for these TLDs.”

It sounds rather like there’s been another weird fluctuation in .tk’s numbers that threw off the overall trend picture again, and Verisign’s basically said “to hell with it” and decided to exclude Freenom from its reports from now on.

This means the normalized numbers for Q4 2021 — ignoring Freenom in all applicable quarters — are 341.7 million, up 3.3 million or 1.0% sequentially and up 1.6 million or 0.5% year over year, the DNIB states.

The Freenom business model is to give domains away for free, mostly, in the first instance. It makes its money by retaining and monetizing domains that either expire or, frequently, which it suspends for abuse.

.tk domains never get deleted, in other words, so counting them alongside TLDs with the industry-standard business model could give a misleading impression of the global demand for domain names.

It’s not so much that counting spam domains is bad — every TLD has a spam problem to a greater or lesser extent — but the lack of deletions can create faulty assumptions.

It’s also never been clear how Verisign and its third-party researcher, ZookNic, acquires its data on Freenom TLDs. Its .tk figure would often remain static for quarters on end, suggesting the data was only sporadically available.

I also tracked .tk’s published numbers independently for many years, and the last figure I have, from March 2019, is 41.3 million. It’s never been clear to me why the Verisign/ZookNic number has always been so much lower.

Verisign has always flagged up any oddities caused by .tk in its DNIB, and every edition has contained a footnote describing Freenom’s unusual practices.

The latest DNIB (pdf) says that .com had 160 million names, up 1.2 million, and .net had 13.4 million, down about 100,000, compared to Q3.

ccTLDs overall had 127.4 million, up about 700,000, a 0.6% sequential increase.

The ccTLD number was down by 5.3 million, or 4.0%, compared to the end of 2020, but that was due to a 9.4 million-name deletion by China’s .cn, which I noted in the second quarter and which Verisign calls a “registry-implemented zone reduction”.

Ignoring China, ccTLD names were up 4.1 million or 3.8%, the DNIB says.

Verisign only breaks out the top 10 ccTLDs separately, so the removal of .tk means that Australia’s .au is now in the top 10 list in tenth place with 3.4 million at the end of Q4. It will likely move up the ranks in the first quarter due to the release of second-level names, which has sped up its growth rate.

France’s .fr, with 3.9 million names, has now entered the overall top 10 TLDs due to .tk’s removal.

New gTLDs grew by 1.2 million names or 5.1% sequentially, but were down by pretty much the same amount annually, ending 2021 with 24.7 million names.

Registrar hit with second porn UDRP breach notice this year

A Chinese registrar group has been accused by ICANN of shirking its UDRP obligations for the second time this year.

ICANN has put Hong Kong-based DomainName Highway on notice that is in breach of its contract for failing to transfer the domain 1ockheedmartin.com to defense contractor Lockheed Martin.

The domain is a straightforward case of typosquatting, with the initial L replaced with a numeral 1. At time of writing, it still resolves to a page of pornographic thumbnail links, despite being lost in a UDRP case January 4.

Under UDRP rules, registrars have 10 days to transfer a UDRP-losing domain to the trademark owner, unless a lawsuit prevents it.

The circumstances are very similar to a breach notice ICANN issued against ThreadAgent.com over a case of BMW’s brand being cybersquatted with porn last month.

Both ThreadAgent and DomainName Highway appear to be part of the XZ.com, aka Xiamen DianMedia Network Technology Co, which is based in China but has about 20 accredited registrars based in Hong Kong.

DomainName Highway has about 30,000 gTLD domains under management.

Omicron domain sells for $5,000

The domain name omicronvariant.com, hand-registered less than six months ago, has sold for $5,000 via Sedo, raising all kinds of questions about the value and future of Covid-19 variant-related domains.

The domain, at time of writing, resolves to a Sedo parking page containing ads unrelated (for me) to the pandemic or healthcare.

It was registered in early June, just a day or two after the World Health Organization announced that it would start naming coronavirus variants after letters of the Greek alphabet.

At that time, and to this day, the delta variant is the dominant strain worldwide, and yet deltavariant.com is currently listed for sale for $2,000 at GoDaddy/Uniregistry.

It seems somebody out there is willing to bet that omicron will have the transmissibility speed and longevity to outstrip delta, become dominant, and make dropping $5,000 on the matching .com a wise investment.

Assuming non-nefarious use, I personally struggle to see the end-user value.

It appears that any .com combination of a Greek letter and the word “variant” that had not already been registered by June was quickly snapped up by speculators after WHO revealed its naming scheme.

Some domains, such as alphavariant.com and xivariant.com, were already in use by companies with web sites that predate the pandemic.

The company Nu Variant seems to have dodged a bullet — WHO skipped that letter because it’s a confusing homophone of “new” in some English dialects. It also skipped xi, as it’s a common name that happens to be shared by the premier of China, which was bad luck for the xivariant.com domainer.

All the other letters between delta and omicron have been assigned to variants that fizzled out or have failed to garner much media attention.

At this point, it seems quite possible that WHO will run out of Greek letters in a matter of months, but it reportedly has no current plan for its coronavirus nomenclature after that.

Hold on to your stats! ShortDot gets two gTLDs approved in China

ShortDot, which makes a business repurposing unwanted gTLDs for the budget end of the market, said today it has had two more horses in its stable approved for use in China.

The company said that .bond and .cyou have been given the necessary nods by Chinese authorities.

What this could mean, if history is any guide, is a sharp increase in sales for the two extensions, possibly to the extent that they materially affect overall domain industry volume stats for the next few years.

ShortDot seems to think so, saying in a press release: “Given the massive success of .icu in China, it is quite clear that .bond and .cyou will follow suit to become largely successful.”

.icu currently has about 600,000 names under management, more than half of which are registered via Chinese registrars. Its numbers are on their way down.

At its peak 18 months ago it had more than 10 times as many, about 6.6 million, due to its low pricing and popularity among Chinese speculators.

The sudden rise and wholly predictable precipitous fall of .icu has been messing with overall new gTLD industry stats for the last couple of years. No volume analysis is complete without a .icu-related asterisk.

It’s by no means assured that the same will be true of .cyou and .bond of course.

.cyou, which was originally a dot-brand matching the ticker symbol of a Chinese company, had 118,000 names under management at the end of May and 136,000 in its zone file yesterday.

Names in .cyou can be had for $2 at Namecheap and NameSilo, its top two registrars, which together hold over 70% of the market.

.bond, originally an Australian university’s dot-brand, has fewer than 5,000 names at the last count and retails for about $55 retail at the low end.

As judge freezes assets, is this OnlineNic domain portfolio really worth $70,000?

A California court has frozen the assets of beleaguered Chinese/American registrar OnlineNic, at the behest of Facebook, which is suing the company for alleged cybersquatting.

The judge in the case Friday mostly granted Facebook’s request for a temporary restraining order, banning OnlineNic from transferring money or domains out of the country.

It had discovered that the registrar had started transferring domains it has registered in its own name — about 600 of them — out of the country, to China-based Ename.

OnlineNic had told the court it could no longer afford to defend the case, and that it would shut up shop July 26.

Following Facebook’s request for a TRO, the registrar said it was merely moving the names to Ename so it could use its secondary market platform to raise $70,000 of the $75,000 needed to pay the so-called “Special Master”.

This is a court-appointed agent who had conducted a review of OnlineNic’s ticketing system records and found the company had deleted or obfuscated huge chunks of potential evidence.

OnlineNic has now told the court that it’s found a potential buyer, willing to pay $70,000 for the names in question.

This is the portfolio (pdf).

I’m no domain broker — I’m not even a domain investor — but even I have to wonder who would pay $70,000, or about $120 per name, for this junk. By sight alone, hardly any of them seem to be worth the base reg fee.

I’m guessing they’re dropped domains with traffic and/or the opportunity of selling them back to a forgetful original registrant.

Facebook’s war on privacy claims first registrar scalp

China’s oldest accredited registrar says it will shut up shop permanently next week after being sued into the ground by Facebook, apparently the first victim of the social media giant’s war against Whois privacy.

Facebook sued OnlineNIC in 2019 alleging widespread cybersquatting of its brands. The complaint cited 20 domains containing the Facebook or Instagram trademarks and asserted that the registrar, and not a customer, was the true registrant.

The complaint named ID Shield, apparently OnlineNIC’s Hong Kong-based Whois privacy service, as a defendant and was amended in March this year to add as a defendant 35.cn, another registrar that Facebook says is an alter ego of OnlineNic.

The amended complaint listed an addition 15 squatted domains, for 35 in total.

This week, OnlineNIC director Carrie Yu (aka Carrie Arden aka Yu Hongxia), told the court:

Defendants do not have the financial resources to continue to defend the instant litigation, and accordingly no longer intend to mount a defense. Defendants do not intend to file any oppositions to any pending filing… Subject to any requirements of ICANN, Defendants intend to cease business operations on July 26, 2021.

But Facebook reckons the registrar is about to do a runner to avoid paying almost $75,000 in court fees already incurred and avoid the jurisdiction of the California court where the case is being heard.

Facebook had asked for $3.5 million in penalties in a proposed judgment and OnlineNIC had not opposed.

While it presents itself as American, it appears that OnlineNIC is little more than a shell in the US.

Its official headquarters are little more than a lock-up garage surrounded by builders’ merchants in a grim, windowless facility just off the interstate near Oakland, California.

Its true base appears to be a business park in Xiamen, China, where 35.cn/35.com operates. The company has boasted in the past of being China’s first and oldest ICANN-accredited registrar, getting its foot in the door when the floodgates opened in 1999.

Facebook is now asking the court for a temporary restraining order freezing the defendants’ financial and domain assets, and for a domain broker to be appointed to liquidate its domain portfolio.

If you’re a legit OnlineNIC customer, you might be about to find yourself in a world of hurt.

OnlineNIC had just over 624,000 gTLD domains under management at the last count. 35.cn had another 200,000.

The lawsuit is one of three Facebook is currently fighting against registrars, one prong of its strategy to pressure the ICANN community to open up Whois records rendered private by EU law and consequent ICANN policy.

OnlineNIC is the low-hanging fruit of the trio and the first to be sued. It already faced cybersquatting cases filed by Verizon, Yahoo and Microsoft in 2009. The Verizon case came with a $33 million judgment.

Facebook has also sued the rather less shady registrars Namecheap and Web.com (now Newfold Digital) on similar grounds.