We grassed up .TOP, says free abuse outfit

A community-run URL “blacklist” project has claimed credit for the complaints that led to .TOP Registry getting hit by an ICANN Compliance action earlier this week.

.TOP was told on Tuesday that it has a month to sort of its abuse-handing procedures or risk losing the .top gTLD, which has over three million domains.

ICANN said the company had failed to respond to an unspecified complainant that had reported multiple phishing attacks, and now the source of that complaint has revealed itself in a news release.

URLAbuse says it was the party that reported the attacks to .TOP, which according to ICANN happened in mid April.

“Despite repeated notifications, the .TOP Registry Operator failed to address these issues, prompting URLAbuse to escalate the matter to ICANN,” URLAbuse said, providing a screenshot of ICANN’s response.

URLAbuse provides a free abuse blocklist that anyone is free to incorporate into their security setup. Domain industry partners include Radix, XYZ.com and Namecheap.

First registry gets breach notice over new abuse rules

.TOP Registry allegedly ignored reports about phishing attacks and has become the first ICANN contracted party to get put on the naughty step over DNS abuse rules that came into effect a few months ago.

ICANN has issued a public breach notice claiming that the registry, which runs .top, has also been ignoring the results of Uniform Rapid Suspension cases, enabling cybersquatting to take place.

The notice says that .TOP breached new rules, which came into effect April 5, that require it to act on reports of DNS abuse (such as malware or phishing attacks) by suspending the domains or referring them to the responsible registrar.

The registry didn’t do this with respect to a report of April 18, concerning “multiple .top domain names allegedly used to conduct phishing attacks”. It didn’t even read the report until contacted by ICANN, according to the notice.

As of yesterday, only 33% of the phishing domains have been suspended by their registrars, some three months after the attacks were reported, ICANN says.

Compliance is also concerned that .TOP seems to be ignoring notices from Forum, the company that processes URS cases, requiring domains to be locked within 24 hours when they’ve been hit with a charge of cybersquatting.

The registry “blatantly and repeatedly violated” these rules, according to ICANN.

.TOP has been given until August 15 to get its act together or risk having its Registry Agreement suspended or terminated.

The registry has about three million .top domains under management, having long been one of the most successful new gTLDs of the 2012 round in volume terms. It typically sells domains very cheaply, which of course attracts bad actors.

Four more gTLDs in emergency measures

ICANN has thrown four more gTLDs into the Emergency Back-End Registry Operator program, presumably as a prelude to terminating their registry’s contracts in a few weeks.

Asia Green IT System’s .pars, .shia, .tci and .همراه (.xn--mgbt3dhd) are all going EBERO, meaning Nominet will take over their operation on ICANN’s behalf.

Not that they need much operation, given that all four, which all connect in some way to Iran and Iranian culture, were unlaunched and dormant, with no third-party registrations.

The four TLDs, along with AGIT’s .nowruz, which went into EBERO last week, had been running on CoCCA’s back-end, but it sounds rather like the registry forgot to pay its bills, causing CoCCA to disable its services.

That led to functions such as Whois going offline, triggering a breach of the ICANN Registry Agreement. A day of Whois downtime in one week gives ICANN grounds to get Nominet involved and move towards termination.

A breach notice issued a couple weeks ago gave AGIT until the end of the month to come back into compliance or risk termination. That escalation now appears inevitable.

AGIT almost got to run .islam and .halal, but had its applications rejected after protests from governments of Muslim-majority country. Somehow, .shia did not receive the same outcry.

ICANN takes over gTLD after Whois failures

ICANN has swooped to take over operation of a new gTLD after it missed its strict thresholds for Whois availability.

.nowruz, originally operated by Istanbul-based Asia Green IT System, is now in the Emergency Back-End Registry Operator program, meaning its essential functions will be carried out by Nominet.

The gTLD is the Latinized version of the word for the Persian new year holiday. It has barely a dozen domains under management and is the only one of AgitSys’s five gTLDs with any registrations.

The company’s other gTLDs — .pars, .shia, .tci and .همراه (.xn--mgbt3dhd) — were also all found to have breached their registry agreements, but as they have no third-party domains where was no need for the EBERO, ICANN said.

The takeover follows a rapidly issued notice last week, in which ICANN Compliance accused AgitSys of a range of breaches of contract.

It seems AGIT went into breach with ICANN after its back-end provider, CoCCA, terminated its contract after a “breach” earlier this year. CoCCA said it had been turning off services ever since the contract ended.

.nowruz becomes the third gTLD from the 2012 round to go into emergency measures, the others being .desi and .wed, which went EBERO seven years ago.

ICANN said it planned to auction off .wed in 2021, but nothing has come of that plan yet.

Five gTLDs at risk as registry goes AWOL

The chance of five new gTLDs themed around the Middle East ever going live has substantially decreased after the registry seemed to disappear and got hit by a third ICANN breach notice.

The registry is Istanbul-based Asia Green IT System, which goes by AGIT or AgitSys, and the five gTLDs are .nowruz (Iranian New Year), .pars (refers to Persia/Iran), .shia (a branch of Islam), .tci (an outsourced dot-brand for the Telecommunication Company of Iran) and .همراه (.xn--mgbt3dhd, means “comrade” in Persian).

According to ICANN, the company is failing to provide Whois, data escrow and has not filed its monthly transaction reports since February. It is also past due with its ICANN fees, according to the breach notice.

The turnaround for the breach notice was incredibly fast. ICANN appears to have noticed that the Whois failures met the “RDAP-RDDS emergency threshold” — which is 24 hours of downtime in a single week — on Friday, called the registry the same day, and issued the breach notice on Monday.

The technical breaches may or may not be related to the fact that the company appears to have disappeared from the internet. None of its NIC sites resolve for me today, and its agitsys.com company web site returns a 404.

These things were also true in 2019, when AGIT received its first breach notice, which was later resolved. It received a second notice a year ago, which it also later resolved.

Only .nowruz, the only one of the five to launch, appears to have any third-party registrations in its zone file, counting in the single figures and all apparently defensive. I could get one of them to resolve, so the DNS appears to be functional.

AGIT used CoCCA as its back-end. CoCCA said that it terminated its contract with AGIT after a “breach” earlier this year and has been turning off features ever since.

RDAP, WHOIS, Reporting and Escrow deposits have been disabled by CoCCA incrementally.

ICANN has given AGIT until the end of the month to come back into compliance or risk having its contracts terminated.

This article was updated July 8 with comment from CoCCA.

Alibaba off the naughty step

Chinese registrar Alibaba is no longer at risk of losing one of its ICANN accreditations, according to a notice on the Org’s web site.

Alibaba.com Singapore E-Commerce, one of Alibaba’s four registrars, failed to respond to abuse reports and missed ICANN payments, according to its March breach notice.

But the company has now provided ICANN with documents sufficient to bring it back into compliance with its contract, according to the notice.

Alibaba has over six million domains under management across its three active accreditations, making it one of the largest registrars to come under the scrutiny of ICANN Compliance.

Alibaba hit with ICANN breach notice

One of the companies in the Alibaba Group, China’s biggest registrar and one of the largest technology companies in the world, has been handed a breach notice, containing a long list of complaints including abuse failures and non-payment of fees, by ICANN Compliance.

Alibaba.com Singapore E-Commerce, one of Alibaba’s four accredited registrars, failed to respond to abuse reports and failed to respond to ICANN’s requests for information about its failure to respond to abuse reports, the notice claims.

The breach notice will likely to be the last to be sent out for claims under the current version of the Registrar Accreditation Agreement. In two days, April 5, stricter domain takedown rules approved earlier this year will become effective on all registrars.

The abuse claims seem to cover four domains in .com and .vip that look like typos that could have been used in phishing attacks.

ICANN Compliance says that Alibaba also hasn’t published the names of its officers or its redemption fees, as the RAA also requires. It says the registrar also owes it an unspecified amount of past-due fees.

The chronologies reported in the notice claim Alibaba has been giving Compliance the run-around, failing to respond to calls and emails, since early November.

All four registrars in the Alibaba Group have the same published email and phone details, but it’s not clear whether the same ones are listed in ICANN’s internal directory.

Alibaba.com Singapore is one of four accredited registrars owned by Alibaba, the Chinese e-commerce giant. The parent is not short of a bob or two, reporting revenue equivalent to $126 billion last year. It can afford to pay its ICANN fees.

Of the three Alibaba registrars that have domains the “Singapore” one is the smallest, with about 660,000 domains under management. The other two have 3.2 million and 2.6 million domains to their accreditations.

The company has been told it has until April 17 to come back into compliance or risk getting terminated.

ICANN cans Freenom

Controversial free-domains company Freenom has lost its ICANN accreditation, signalling the end of its life as a gTLD registrar.

Org said that as of November 25, Freenom (aka OpenTLD) will no longer be able to sell or renew any domains.

The termination follows the company’s failure to resolve or respond to three separate breach notices, covering dozens of infractions, that Compliance sent between September and October.

Real damage to registrants was caused — many could not rescue their expired domains or transfer names to another registrar.

The company has 16,521 gTLD domains under management at the end of July, according to the most-recent registry transaction reports. They will now be moved to a more-reliable registrar under ICANN’s De-Accredited Registrar Transition Procedure.

Freenom may have been a small fish in the gTLD space, but it gave away tens of millions of free domains in five ccTLDs it controlled, mostly to spammers and other ne’er-do-wells.

It was recently reported that it has lost or is losing its deals with these ccTLDs, notably .tk, after their governments became aghast at how badly they were being abused.

Freenom spanked for holding Olympics domain hostage

Freenom has been hit by its third ICANN contract-breach notice in under a month, this time because the organizers of the 2024 Paris Olympics could not transfer a domain out to another registrar.

The registrar, formally OpenTLD, failed to take off the ClientTransferProhibited status from the domain club2024.tickets, preventing the registrant from transferring it, ICANN claims.

Digging through my database and Whois records, it looks like the organizing committee of Paris 2024 used Freenom to defensively register 10 .tickets domain names related to its Le Club Paris 2024 marketing initiative in July 2020.

They were the only .tickets domains Freenon has ever sold.

When they came up for renewal last year, the Paris committee instead transferred nine of them out to local registrar Gandi, where they remain. The 10th domain was not transferred for some reason.

ICANN says Freenom is in violation of the Transfer Policy by failing to unlock the domain without a good reason. Additionally, the domain doesn’t show up in Whois queries on Freenom’s web site, despite still being in the zone file.

Compliance has given the registrar until November 7 to come back into compliance or risk losing its accreditation.

Freenom is already working under two active breach notices, which ICANN said it has not yet responded to. The deadline on the earlier, September 20 notice has already passed, so ICANN could escalate any day.

Freenom gets yet another ICANN breach notice

ICANN Compliance is really up in Freenom’s face now, filing yet another contract-breach notice against its registrar arm barely a week after the last one.

The September 29 notice adds three new tickets to the 12 in the September 20 notice I wrote about last month. It’s the sixth notice OpenTLD has received since 2015.

The cases are similar to those in the previous missive. ICANN wants proof that the registrar has been complying with the Transfer Policy and the Expired Registration Recovery Policy.

It seems some Freenom customers have had difficulty transferring their names out of the company’s control, and have been unable to restore their domains after accidentally allowing them to expire.

It still also owes ICANN past-due fees, the notice reiterates.

The notice covers complaints from June and July. The company has until October 20 to comply or risk losing its accreditation. The claims in the earlier notice give it until October 11.

Freenom is the company that runs a dwindling collection of free-to-register ccTLDs, notably .tk. It has not allowed registrations on its site all year, blaming technical issues. It’s also being sued by Facebook owner Meta over alleged cybersquatting.