Decades-old US registrar gets a spanking

ICANN Compliance has filed a wide-ranging breach notice against an American registrar that’s been accredited for over 20 years.

Cincinnati-based Netdorm, which does business as DnsExit.com, has been handed a long list of alleged contract violations and an October 16 deadline to fix things or risk termination.

As we’ve seen regularly recently, the registrar’s apparent failures to carry out the technical migrations from Whois to RDAP and from NCC Group to DENIC for escrow services are the biggest of ICANN’s concerns.

Netdorm is also past-due on its fees and has a long checklist of administrative and transparency failures, according to the Compliance breach notice.

Despite being accredited since 2004, the company has been chugging along with fewer than 6,000 gTLD domains under management for many years. It gives away third-level subdomains for free and claims to run over a million of them.

Another registrar goes AWOL

ICANN has started takedown procedures against another registrar that appears to have disappeared from the face of the Earth.

The registrar is 0101 Internet, based in Hong Kong, not to be confused with 101 Domain, which is based in Ireland and California and a completely different company.

0101 has been around for 15 years and had a little over 1,000 domains under management at the last count, mostly .com. Its DUM peaked at over 10,000 over a decade ago but has been declining since.

Currently, its web site doesn’t reliably resolve, which may be the reason ICANN can’t find contractually required information there. Archives show the place on its site where you would usually expect to see a company name or logo, it has just said “Your Brand” for the last few years.

The main problem outlined in ICANN Compliance’s breach notice is that 0101 has not been escrowing its registrant data with DENIC, which could cause problems when its customers’ domains are migrated to a new registrar.

It also hasn’t been paying its ICANN fees, according to the notice.

0101 has until October 3 to come into compliance or risk losing its contract.

gTLD loses its second-largest registrar after breach

ICANN has terminated another registrar’s accreditation, this time putting about 10,000 domains at risk.

The registrar in question is Dubai-based Intracom Middle East, which does business at domains.gdn.

As the domain suggests, the company specialized in .gdn domain names. It had about 10,000 of them under management at the last count, sold for under a dollar each for the first year.

It was the .gdn registry’s second-biggest registrar after Dynadot.

ICANN Compliance is terminating its contract for not paying its fees, not implementing RDAP, and generally not publishing required transparency information on its web site.

As I noted in May, its web site appeared to be down, and archived versions of the site suggested it had been hacked at least once recently.

ICANN, which had been chasing Intracom for a little over a year, said it will follow the De-Accredited Registrar Transition Procedure to move the company’s remaining domain names to a new registrar.

Registrar shamed for alleged crypto abuse neglect

ICANN has given a warning to Malaysian registrar WebNic, claiming that it has turned a blind eye to abuse reports in breach of new Registrar Accreditation Agreement rules.

ICANN Compliance says the company, a subsidiary of Kuala Lumpur-based Qinetics, failed to take action to resolve abuse reports made against several domains it manages.

Online reports and databases suggest the names in question were used in phishing attacks attempting to steal cryptocurrency wallet credentials.

Compliance said it “has observed a concerning pattern regarding DNS Abuse mitigation”, saying WebNic continually drags its feet on responding to abuse reports, often only taking action after ICANN gets involved.

The breach notice adds:

The Registrar frequently issued repeated requests for evidence to abuse reporters – even when the original reports appeared actionable – and failed to fully consider information or clarifications provided by the abuse reporter, ICANN or otherwise reasonably accessible to the Registrar. In other cases, the Registrar requested evidence from the abuse reporters that did not appear to be relevant to the reported activity, causing additional delays.

WebNic is not a young, fly-by-night registrar. It’s been around a quarter century and has over 800,000 domains under management just in the gTLDs. Its parent also offers registry back-end services.

The company has until August 19 to make Compliance happy or risk termination proceedings.

.TOP promises to play nice on DNS abuse

.TOP Registry is off the ICANN naughty step, almost a year after it became the first registry to be hit by a public contract-breach notice over ICANN’s latest rules on DNS abuse.

The Org took the highly unusual step yesterday of publishing a blog post drawing attention to what it clearly sees as a big Compliance win, ahead of its public meeting in Prague later this month, at which abuse will no doubt, as usual, be a key discussion topic.

ICANN said that it has been working with .TOP for months to put in systems aimed at reducing the abuse of .top domains. It posted:

.TOP Registry expressed its commitment to maintaining compliance with the DNS Abuse obligations and continuously strengthening its abuse detection and mitigation processes through newly established collaboration channels and a structured approach designed to drive ongoing enhancement. ICANN Compliance acknowledged that the remedial measures were sufficient to cure the Notice of Breach. We noted that future violations of these requirements will result in expedited compliance action, up to and including the issuance of additional Notices of Breach.

Compliance had hit .TOP with the breach notice last year over allegations that it repeatedly ignored abuse reports submitted by security researchers, and that it was ignoring Uniform Rapid Suspension notices.

Security outfit URLAbuse later revealed it was the party that had reported .TOP to ICANN.

.TOP is a Chinese registry that sells mainly via Chinese registrars, typically at under a couple bucks retail. A non-scientific perusal of its zone files reveals that the majority of the many thousands of domains it sells every day are nothing but disposable junk — random strings of characters with no meaning in any language.

While .top is far from alone in that regard, it is the most successful at the abuse-attractive low-price-high-volume business model. Its zone grew by almost 1.2 million domains in the last 12 months — the biggest growth spurt of any TLD — and it has just shy of four million domains today.

Despite this implausibly rapid growth, ICANN says that abuse reports for .top domains started falling in April and there has been a “noticeable decrease in reported abuse”.

The Org says it will “actively monitor the effectiveness of these new [.TOP] systems and processes, the Registry Operator’s abuse rankings and their compliance with the requirements.”

The registry has told ICANN it has already “mitigated” over 100,000 abusive domain names with its new systems and processes.

Big .gdn registrar at risk

A registrar that exclusively sells .gdn domain names seems to have gone AWOL, and ICANN Compliance is on its case.

Dubai-based Intracom Middle East has been slapped with a breach notice alleging failures to operate a compliant RDAP server, publish the names of its officers, pay its ICANN fees, and escrow its registrant data.

Some of these breaches seem to be due to the fact that the company’s web site is missing in action, today returning NXDOMAIN errors, and has quite possibly been repeatedly hacked.

Archived versions of its site from last year show it was at various times a Polish risotto recipes splog, an Indian burger joint, and a manga cosplay porn site.

It’s Intracom’s second brush with Compliance. Three years ago the case was escalated to a three-month accreditation suspension for pretty much the same infractions.

Unlike most recent Compliance actions, which have been against registrars with essentially no domains under management, this times some domains are actually at risk — over 10,000 of them in fact.

Intracom specializes/d in selling .gdn domains for under a buck apiece. Apart from a few dozen registrations in a few other gTLDs, all of its 10,000 domains were in .gdn. It was once .gdn’s biggest registrar, though that’s no longer the case.

The company has been given to the end of the month to comply or risk termination.

Two deadbeat registrars get their ICANN marching orders

ICANN has terminated the registrar accreditation agreements of two Chinese companies, which appear to be under common ownership, because they didn’t pay their bills.

EJEE Group Beijing and VIP Internet Industry are both losing their contracts, effective later this month. Both have common contact details, apparently run by the same person who had another registrar terminated in 2017.

EJEE does its business at category-killer domain domain.cn, though the registration storefront appears to be broken. VIP Internet’s web site appears to be down entirely.

While both companies have sold thousands of domains in their time, both have had just one or two gTLD domains under management for the last 12 months, according to my records. No registrants will be affected, in other words.

ICANN seems to have been chasing the registrars for their overdue fees since March 2023, over two years ago, according to the termination notices.

.med is a deeply weird gTLD, but it wants to be more normal

Medistry, the .med registry with a really strange business model, is looking to normalize its practices and start competing with the cluster of healthcare-related gTLDs already on the market.

The gTLD launched in 2016 and had almost 42,000 domains under management at the last count, which may sound like a pretty decent showing for a 2012-round niche registry (comparable to the likes of .beauty and .chat).

But there are a few caveats. For starters, only one non-registry .med domain has been indexed by Google, and it redirects to a .com web site.

Delve into the .med zone file, and you’ll discover that almost all of those 42,000 domains are 12 characters long and each comprises entirely numbers and hyphens. Doesn’t sound very sexy, does it?

Furthermore, delve into the Whois, and you’ll discover that all of those domains are registered via the registry’s in-house registrar, Name Share, to an entity affiliated with the registry itself.

A couple of years ago, having not sold more than a handful of .med domain names (I’ll get to the reasons for that in a moment), Medistry seems to have decided to reinvent .med as a directory for medicines.

In the US, all human medicines approved by the Food and Drug Administration are given a National Drug Code, a 10-digit unique identifier that the manufacturers are required to print on the packaging.

So, the domain name 55150-250-50.med refers to a bupivacaine hydrochloride injection, a surgical anaesthetic made by Eugia US LLC. Almost all .med domains follow this three-part NDC structure.

The domains seem to have been registered in service of Trust.med, another entity affiliated with the registry, which says it offers supply chain management services to the US healthcare industry.

Why the DNS is the best place to store this NDC information isn’t clear to me. All the .med names I checked came back NXDOMAIN and were marked as pendingDelete in the Whois despite being months away from expiration.

So… Plan C? Sell .med domains to any Tom, Dick or Harry who wants one, on a first-come, first-served basis.

Medistry says that, as of now:

A registrant of a .med domain name can be an individual or organization. All available domain names in .med are approved for registration on a first come, first serve basis through .med accredited registrars. .med domain names can also be purchased in the domain name aftermarket.

That’s hell and gone from the mission outlined in Medistry’s 2012 new gTLD application and its current Registry Agreement with ICANN, both of which outline some of the harshest registration restrictions of any TLD.

Its current ICANN contract states, in the Public Interest Commitments:

The lone method of domain name allocation in the TLD will be by Request for Proposal (RFP) under guidelines, rules and criteria as set forth by the Advisory Board in its sole discretion.

RFP for domain name registration in the TLD will be reviewed for approval by the Advisory Board, in its sole discretion, independent of Registry Operator.

PICs are enforceable by ICANN Compliance under the rarely used PIC Dispute Resolution Process, should there be a view that a registry is violating the contract.

Could Medistry be heading into stormy waters with Compliance? The company does have form in that regard — it’s owned by the same people who run .jobs registry Employ Media.

Employ Media got into a protracted fight with ICANN in 2012 over a service called Universe.jobs, which saw it register 40,000 generic .jobs domains to a close partner in order to turn the gTLD into a structured taxonomical jobs board.

ICANN thought the service was a breach of the .jobs RA and the two parties ended up in arbitration. ICANN eventually let Universe.jobs go ahead but it fizzled out a few years later when Employ Media came to blows with its partner.

Is history repeating itself with .med’s sudden change of business model?

Medistry says that full general availability for .med names will begin on September 2, but it’s telling registrars (pdf) they can “Pre-Register any domain to guarantee registration beginning on September 2” by emailing them a list of names.

It’s also looking to on-board more registrars. As of the end of January, the only registrars to ever sell a .med domain were owned by the registry. It uses Nominet as its back-end.

.med would compete against the likes of .doctor, .surgery, .health and .clinic.

Four deadbeat registrars get terminated

ICANN has terminated the contracts of four registrars that haven’t paid their accreditation fees in years.

US-based Zoo Hosting, UK-based Nerd Origins, and China-based Mixun and Mixun Network Technology have all been canned, following public breach notices in January.

Judging by the termination notices, the registrars all stopped paying their quarterly fees between 2022 and early 2024. None of them had implemented recent ICANN policies such as RDAP adoption, the notices added.

It’s not a huge problem, as none of the four companies had ever sold a single gTLD domain name, so there are no customers to be affected.

Six more gTLDs shown the door, five may be auctioned

There are to be six fewer gTLDs on the internet, after ICANN terminated its registry contracts with two companies.

Asia Green IT System’s agreements for .pars, .shia, .tci, .nowruz and .همراه (.xn--mgbt3dhd) have been cancelled, after a lengthy compliance process, while Kerry Trading Co self-terminated .kerrylogistics.

Despite being contracted for a decade, none of AGIT’s TLDs had ever meaningfully launched. The Iranian new-year-themed .nowruz had a handful of registrations.

The registry had stopped paying CoCCA, its back-end provider, bringing it into serious breach of its Registry Agreements. It had also failed to pay its ICANN fees.

According to ICANN correspondence, after it entered into mediation with AGIT last August it came up with a secret term sheet to give the company a way out, but it breached the terms of that deal too.

All five were terminated over the Christmas period, but they could return if ICANN decides to sell them off to the highest bidder.

ICANN told the company it “will conduct an assessment and make its determination whether to transition operation of the .nowruz gTLD to a successor registry operator.”

But they all look like poison chalices. They’re all related in some way to Iran, and could raise cultural or legal sensitivities.

.shia is related to the branch of Islam, .pars is related to the language and culture of Iran and .nowruz is the Persian new year holiday.

.tci, which I can easily imagine being picked up and repurposed by a discount-names portfolio registry, was supposed to be a dot-brand for the Telecommunication Company of Iran and همراه. is the brand of its mobile phone subsidiary, meaning something like “companion”.

Neither was technically a Spec 13 dot-brand, which is usually enough to for ICANN to rule out a redelegation.

But even if ICANN decides to sell off these five dead strings to another registry under the Registry Transition Process, there’s no guarantee that will ever actually happen.

Org decided to auction failed gTLD .wed almost five years ago and there’s been no movement on that ever since. Failed .desi is in a similar situation.

.kerrylogistics was a Spec 13, and will not be transitioned, after Hong Kong based delivery company Kerry unilaterally told ICANN it no longer wished to run the TLD.

Kerry has five remaining dot-brands, including .kerryhotels and .kerryproperties, that it does not use but does not seem to want to kill off just yet.