How the world’s biggest brands use new gTLDs

DomainIncite PRO is excited to reveal the results of the domain name industry’s first in-depth study into how the world’s biggest brands use new generic top-level domains.
In March and April 2012, we surveyed the domain name ownership and usage patterns of the world’s 100 most-valuable brands — representing over $1.2 trillion in brand value, according to Interbrand — in six gTLDs introduced since 2001.
As well as confirming the long-held belief that brand owners see little value in defensive registrations — many not even choosing to benefit from residual traffic — the survey also revealed which brands are more likely to develop their sites, which are most vulnerable to cybersquatting, and which appear to care the least about enforcing their brands.
We also examined how “cybersquatters” use the domain names they register, with some surprising results.
Privacy/proxy registration is not nearly as prevalent as many believe, our study found, and a significant portion of registrants have made no effort to monetize the domains they own that match famous brand names.
This extensive, fully illustrated report includes:
A comparison of defensive registration trends across 100 brands in six new gTLDs. How many domains are owned by the respective brands and how many are owned by third parties? How many are reserved by the registry and how many are still available for registration?

A breakdown of usage trends by gTLD in .asia, .biz, .info, .jobs, .mobi and .pro. When brand owners register domains in new gTLDs, how likely are they to develop content on those domains, and what can new gTLD registries do to encourage this desirable behavior?
An analysis of cybersquatting behavior in over 100 domain names registered to entities other than the brand owner. How much do brand owners have to worry about their brands being impaired by damaging behavior such as redirection to competing web sites or porn?
Full survey results. Subscribers have full access to the survey results, which include details of which brand-domains belong to third parties, which exhibit potentially damaging behavior, and which are currently available for registration.
DI PRO subscribers can click here for the full report.
Non-subscribers can learn how to subscribe instantly here.

2 Comments Tagged: cybersquatting, ICANN, new gTLDs, trademarks

Did a university just pay $3,000 for its .xxx domain?

The domain name sju.xxx has changed hands for $3,000 on Sedo.
It’s the first .xxx domain I recall popping up in Sedo’s sales feed.
However, I think there’s a pretty good chance it’s a damage-mitigation move by an American university.
SJU is the acronym used by Saint Joseph’s University in Philadelphia, PA. The college uses sju.edu as its primary domain.
Knowing how paranoid universities have been about protecting their reputations in .xxx, and given that the sale came in just below the price of a cheap UDRP, I suspect we’re looking at a defensive move.
The Whois record for the domain is currently under privacy protection. Until recently, it belonged to one Jay Camina. It resolves to a suggestive Go Daddy parking page.

2 Comments Tagged: icm registry, saint joseph's university, sedo, sju.xxx, xxx

First TAS security bug details revealed

The data leakage bug in ICANN’s TLD Application System was caused when applicants attempted to delete files they had uploaded, the organization has revealed.
In his latest daily update into the six-day-old TAS downtime, chief operating officer Akram Atallah wrote this morning:

ICANN’s review of the technical glitch that resulted in the TLD application system being taken offline indicates that the issue stems from a problem in the way the system handled interrupted deletions of file attachments. This resulted in some applicants being able to see some other applicants’ file names and user names.

This sounds rather like an applicant’s file names may have become visible to others if the applicant attempted to delete the file (perhaps in order to upload a revised version) and the deletion process was cut off.
Speculating further, this also sounds like exactly the kind of problem that would have been exacerbated by the heavy load TAS was under on April 12, as lots of applicants simultaneously scrambled to get their gTLD bids finalized to deadline.
Rather than being a straightforward web app, TAS is accessed via Citrix XenApp virtual machine software, which provides users with an encrypted tunnel into a Windows box running the application itself.
As you might expect with this set-up, performance issues have been observed for weeks. Every applicant logged into TAS last Thursday reported that it was running even more slowly than usual.
A security bug that only emerged under user load would have been relatively tricky to test for, compared to regular penetration testing.
But ICANN had some good news for applicants this morning: it thinks it will be able to figure out not only whose file names were leaked, but also who they were leaked to. Atallah wrote:

We are also conducting research to determine which applicants’ file names and user names were potentially viewable, as well as which applicants had the ability to see them.

This kind of disclosure would obviously be beneficial to applicants whose data was compromised.
It may also prove surprising and discomfiting to some applicants who were unwittingly on the receiving end of this confidential data but didn’t notice the rogue files on their screens at the time.
ICANN still plans to provide an update on when TAS will reopen for business this Friday. It will also confirm at the time whether it is still targeting April 30 for the Big Reveal.

1 Comment Tagged: data leakage, ICANN, new gltds, security, tas

US reopens IANA contract re-bid

ICANN’s key contract with the US government is open for proposals again, a month after ICANN was told its first bid wasn’t up to the expected standards.
The US National Telecommunications and Information Administration yesterday posted a revised request for proposals, looking for a new IANA contractor.
The IANA contract is what gives ICANN its operational powers over the domain name system root database.
Based on a quick comparison of the new RFP with the old, there have been few notable, substantial changes, giving little indication of why ICANN’s previous response fell short.
The RFP has a strong emphasis on accountability, transparency, separation of ICANN/IANA powers, conflicts of interest and the “global public interest”, as before.
While many of the requirements have been edited, clarified or shifted around, I haven’t been able to spot any major additions or subtractions.
The RFP now envisages a contract running from October 1, 2012 until September 30, 2015, with two two-year renewal options, bringing the expiry date to September 30, 2019.
The deadline for responses is May 31.
The current contract had been due to expire at the end of March but the NTIA unexpected extended it by six months just before ICANN’s meeting in Costa Rica kicked off last month.
The NTIA said it canceled the first RFP “because we received no proposals that met the requirements” but neither it nor ICANN has yet provided any specifics.
Over a month ago, at an ICANN press conference in Costa Rica, CEO Rod Beckstrom said: “We were invited to have a debriefing with [the NTIA] to learn more about this. Following that discussion we will share any information we are allowed to share.”
Since then, no additional information has been forthcoming.
The new RFP can be read here. For comparison, the old version can be downloaded here.

1 Comment Tagged: department of commerce, iana, ICANN, ntia

New gTLD filing deadline delayed again

It looks like new gTLD applicants are in for more delays after ICANN announced that it will not reopen its TLD Application System tomorrow as planned.
In a statement tonight, chief operating officer Akram Atallah said that the recently discovered data leakage vulnerability has been fixed, but the fix is still being tested.

We believe that we have fixed the glitch, and we are testing it to make sure.
ICANN is committed to reopening the application system as soon as we can confirm that the problem has been resolved and we have had proper time for testing.
We also want to inform all applicants, before we reopen, whether they have been affected by the glitch. We are still gathering information so we can do that.
Accordingly, the application system will not reopen tomorrow.

ICANN shut down TAS last Thursday, just 12 hours before the new gTLD application filing deadline, after discovering a persistent bug that allowed some applicants to see the names of files uploaded by other applicants.
It had planned to open TAS again tomorrow and close it on Friday. However, that’s looking increasingly unlikely.
Atallah said that ICANN “will provide an update on the timing of the reopening no later than Friday, 20 April at 23.59 UTC.”
While ICANN said yesterday that it was still targeting April 30 for its Big Reveal event, subject to change, that’s now looking like an ambitious goal.

3 Comments Tagged: data leakage, ICANN, newgTLDs, security, tas

ICANN will alert gTLD security bug victims

ICANN plans to inform each new top-level domain applicant whether they were affected by the security vulnerability in its TLD Application System, according to its latest update.
The organization has also confirmed that it is still targeting April 30 for the Big Reveal day, when it publishes (deliberately) the gTLDs being applied for and the names of the applicants.
This morning’s TAS status update, penned by chief operating officer Akram Atallah, does not add much that we did not already know about the data leakage bug. It states:

An intensive review has produced no evidence that any data beyond the file names and user names could be accessed by other users.
We are currently reviewing the data to confirm which applicants were affected. As soon as the data is confirmed, we will inform all applicants whether they were affected.

ICANN staff and outside consultants have been working all weekend to figure out what went wrong, who it affected, and how it can be fixed.
The organization still intends to announce tonight whether it has fixed the problem to the point where it’s happy to reopen TAS to registered users tomorrow. It’s also sticking to is Friday extended submission deadline.

1 Comment Tagged: data leakage, ICANN, new gTLDs, security, tas, vulnerability

MyTLD has spare TAS accounts for new gTLDs

The new gTLD consultancy MyTLD has some ICANN TLD Application System slots going begging.
If for some reason you need to file a gTLD application and you haven’t already registered in TAS, this is what MyTLD says it is now offering:

(i) gTLD application writing and submission (ii) TAS account for the gTLD application (iii) Newly formed company corresponding to the TAS account

The company is marketing it as a bundled service.
MyTLD is most closely associated with the most prominent .music application. It’s run by Music.us owner Constantine Roussos and former ICANN internationalized domain name expert Tina Dam.
The offer is fleshed out a bit more on MyTLD’s blog.
I hear the company was shopping these TAS slots around privately prior to April 12 too, so I don’t think that it is an effort to capitalize on the security-related delays ICANN is currently experiencing.
However, one has to ask why the offer is only being publicized after the original official deadline for new gTLD applications has already passed.
TAS is expected to re-open for business on Tuesday, and close on Friday.

4 Comments Tagged: .music, ICANN, music.us, mytld, new gTLDs

ICANN reopens defensive registration debate

ICANN’s board of directors wants more policy work done on the problem of defensive domain name registrations.
In a resolution passed at a meeting on Tuesday, the board’s newly created New gTLD Program Committee, made up exclusively of non-conflicted directors, said it:

directs staff to provide a briefing paper on the topic of defensive registrations at the second level and requests the GNSO to consider whether additional work on defensive registrations at the second level should be undertaken

The decision was made following the debate about “defensive” gTLD applications ICANN opened up in February, prompted by a letter from US Department of Commerce assistant secretary Larry Strickling.
That in turn followed the two Congressional hearings in December, lobbied for and won by the Association of National Advertisers and its Coalition for Responsible Internet Domain Oversight.
So this week’s decision is a pretty big win for the intellectual property lobby. It’s managed to keep the issue of stronger second-level trademark protection in new gTLDs alive despite ICANN essentially putting it to bed when it approved the new gTLD program last June.
The GNSO could of course decide that no further work needs to be done, so the champagne corks should probably stay in place for the time being.
At the same meeting on Tuesday, the ICANN board committee voted to disregard the GNSO Council’s recent decision to grand extra protections to the International Olympic Committee, Red Cross and Red Crescent movements. The rationale for this decision has not yet been published.

2 Comments Tagged: cybersquatting, ICANN, new gTLDs, trademarks

ICANN knew about TAS security bug last week

ICANN has known about the data leakage vulnerability in its TLD Application System since at least last week, according to one new top-level domain applicant.
The applicant, speaking to DI on the condition of anonymity today, said he first noticed another applicant’s files attached to his gTLD application in TAS last Friday, April 6.
“I could infer the applicant/string… based on the name of the file,” said the applicant.
He immediately notified ICANN and was told the bug was being looked at.
ICANN revealed today that TAS has a vulnerability that, in the words of COO Akram Atallah, “allowed a limited number of users to view some other users’ file names and user names in certain scenarios.”
The actual contents of the files are not believed to have been visible.
But other applicants, also not wishing to be identified, today confirmed that they had uploaded files to TAS using file names containing the gTLD strings they were applying for.
It’s not yet known how many TAS users were able to see files belonging to others, or for how long the vulnerability was present on the system.
However, it now does not appear to be something that was accidentally introduced during yesterday’s scheduled TAS maintenance.
This kind of data leakage could prove problematic — and possibly expensive — if it alerted applicants to the existence of competing bids, or caused new competing bids to be created.
ICANN shut down TAS yesterday and does not expect to bring it back online until Tuesday.
The window for filing applications, which had been due to close yesterday, has been extended until 2359 UTC next Friday night.
April 14 Update
ICANN today released a statement that said in part:

we are sifting through the thousands of customer service inquiries received since the opening of the application submission period. This preliminary review has identified a user report on 19 March that appears to be the first report related to this technical issue.
Although we believed the issues identified in the initial and subsequent reports had been addressed, on 12 April we confirmed that there was a continuing unresolved issue and we shut down the system.

1 Comment Tagged: data leakage, ICANN, new gTLDs, security, tas

It’s worse than you thought: TAS security bug leaked new gTLD applicant data

The bug that brought down ICANN’s TLD Application System yesterday was actually a security hole that leaked data about new gTLD applications.
The vulnerability enabled TAS users to view the file names and user names of other applicants, ICANN said this morning.
COO Akram Atallah said in a statement:

We have learned of a possible glitch in the TLD application system software that has allowed a limited number of users to view some other users’ file names and user names in certain scenarios.
Out of an abundance of caution, we took the system offline to protect applicant data. We are examining how this issue occurred and considering appropriate steps forward.

Given the level of secrecy surrounding the new gTLD application process, this vulnerability ranks pretty highly on the This Is Exactly What We Didn’t Want To Happen scale.
It’s not difficult to imagine scenarios in which a TAS user name or file name contains the gTLD string being applied for.
This is important, competition-sensitive data. If it’s been leaked, serious questions are raised about the integrity of the new gTLD program.
How long was this vulnerability present in TAS? Which applicants were able to look at which other applicants’ data? Did any applicants then act on this inside knowledge by filing competing bids?
If it transpires that any company filed a gTLD application specifically in order to shake down applicants whose data was revealed by this vulnerability, ICANN is in for a world of hurt.

7 Comments Tagged: data leakage, ICANN, new gTLDs, security, tas