ICANN gunning for Tencent over abuse claims

ICANN Compliance is taking on one of the world’s largest technology companies over claims that a registrar it owns turns a blind eye to DNS abuse and phishing.

The Org has published a breach of contract notice against a Singapore registrar called Aceville Pte Ltd, which does business as DNSPod and is owned by and shares its headquarters with $86-billion-a-year Chinese tech conglomerate Tencent.

ICANN says that DNSPod essentially has turned a blind eye to recent abuse reports, allowing phishing sites to stay online long after they were reported, and makes life difficult for people trying to report abuse.

It also has failed to upgrade from the Whois protocol to RDAP and failed to migrate its registration data escrow service provider from NCC to DENIC, according to the notice.

According to ICANN, DNSPod received abuse reports about several domains in July and August but failed to take action at all or until ICANN itself got in touch to investigate. Compliance wants to know why.

ICANN adds that the registrar seems to be requiring reporters to create user accounts and use a web form to submit their reports, even after they’ve already used the abuse@ email address.

Stricter rules on DNS abuse came into force on registrars this April. They’re now required to take action on abuse reports.

“Aceville does not appear to have a process in place to promptly, comprehensively, and reasonably investigate and act on reports of DNS Abuse,” the notice reads.

ICANN has given DNSPod until October 11 to answer its questions or risk escalation.

While DNSPod says it has been around for 17 years, it only received its ICANN accreditation in 2020. Since then, it’s grown to almost 200,000 domains under management in gTLDs.

It’s primarily a DNS resolution service provider, saying it hosts over 20 million domains, and does not appear to operate as a retail registrar in the usual sense.

Owner Tencent may not be a household name in the Anglophone world, but it’s the company behind some of China’s leading social media brands, including QQ and WeChat, as well as a formidable force in gaming and one of the world’s richest companies in any sector.

It’s the second huge Chinese tech firm to find itself publicly shamed by ICANN in recent months. Compliance went after Tencent’s primary competitor, Alibaba, on similar grounds in March. Alibaba has since resolved the complaints.

Alibaba off the naughty step

Chinese registrar Alibaba is no longer at risk of losing one of its ICANN accreditations, according to a notice on the Org’s web site.

Alibaba.com Singapore E-Commerce, one of Alibaba’s four registrars, failed to respond to abuse reports and missed ICANN payments, according to its March breach notice.

But the company has now provided ICANN with documents sufficient to bring it back into compliance with its contract, according to the notice.

Alibaba has over six million domains under management across its three active accreditations, making it one of the largest registrars to come under the scrutiny of ICANN Compliance.

Spammy .loan makes Alibaba fastest-growing and fastest-shrinking registrar in June

Chinese registrar Alibaba was both the fastest-growing and fastest-shrinking registrar in June, purely due to its dalliance with hundreds of thousands of cheap .loan domain names.
Stats compiled by DI from the latest monthly registry reports show that Alibaba’s Singapore-based registrar — which has only been active for a year — grew its domains under management by 720,669 in June, almost four times as many as second-placed NameCheap.
The huge increase was due to Alibaba’s DUM in .loan doubling in June, going from from 621,851 to 1,274,532. Another 50,000 extra domains came from .win.
Both .loan and .win are run by registry GRS Domains, the company that replaced Famous Four Media as manager of the Domain Venture Partners gTLD portfolio.
According to SpamHaus, .loan has a “badness” of just shy of 90%, based on a sample size of 45,000 observed domains. SpamHaus has .win at almost 39% bad.
GRS has promised to turn its portfolio around and cut off its deep-discounting promotions effective August 20. The June figures reflect a time when discounts were still in place.
The Singapore Alibaba had DUM of 1,771,730 at the end of June.
At the bottom end of the June league table was a second Alibaba accrediation, Beijing-based Alibaba Cloud Computing (aka HiChina or net.cn), which had a net DUM loss of 266,411, after seeing 345,268 deletes in .loan (along with 45,000 deletes in .xyz and 35,000 in .xin).
The second biggest loser was AlpNames, which is owned by the same people as Famous Four, which deleted over 114,000 names in the month. The vast majority of these names were in FFM/GRS gTLDs, including .loan.
The main, earliest Alibaba accreditation, Alibaba Cloud Computing (Beijing), which has zero exposure to new gTLDs, grew by 69,794 domains to end June as the seventh fastest-growing registrar with DUM of 7,672,594.
As of a couple weeks ago, Alibaba has a fourth ICANN accreditation, Alibaba Cloud US LLC, but that obviously does not figure into the June numbers.
Here’s the top 10 registrars for June by DUM growth:
[table id=52 /]
And the bottom 10:
[table id=53 /]
You may notice that in both tables the net change column is not equal to the sum of adds and net transfers minus deletes. This is because, per ICANN contract, domains still in their five-day Add Grace Period are counted in DUM but not in adds, so many adds slip over into the following month.

.CLUB sees spam double after China promotion

.CLUB Domains has seen the amount of spam in .club double a month after seeing a huge registration spike prompted by a deep discount deal.
The registry saw its domains under management go up by about 200,000 names over a few days in early August, largely as a result of a promotion at Chinese registrar AliBaba.
AliBaba sold .club domains for CNY 3 ($0.44) during the promotion, helping it overtake GoDaddy as the top .club registrar.
At that time, spam tracker SpamHaus was reporting that 17.9% of the .club domains it was seeing in the wild were being used in spam.
Today, that number is 35.4%, almost double the August 7 level. SpamHaus does not publish the actual number of spammy domains for .club; that honor is only bestowed upon the top 10 “bad” TLDs.
Correlation does not equal causation, of course. There could be factors other than the AliBaba promotion that contributed to the increase, but I believe there’s probably a link here.
.CLUB chief marketing officer Jeff Sass told DI:

When registrars have domains “on sale”, there is always the chance that low-cost domains will be attractive to abusers. We monitor abuse proactively, and respond promptly to complaints, as well as monitor our registrar partners collectively and individually.

It’s almost certainly unfair of me to single out fluctuations in .club here, rather than take a comparative look at multiple TLDs. There are certainly many worse TLDs per SpamHaus’ statistics — .men leads among the gTLDs, with 87.2% spam.
But, given the industry truism that cheaper domains leads to more abuse, I think such a large increase correlating with such a successful promotion is a useful data point.