CentralNic now managing failing .fan and .fans

CentralNic appears to be acting as a caretaker for the failing new gTLDs .fan and .fans.
IANA records show that a company lawyer took over as administrative contact for the pair late last week.
Asiamix Digital, the original registry, is still listed as the sponsor for both, and its ICANN registry agreement does not appear to have been reassigned.
It does not appear to be an acquisition. I hear Asiamix is basically using CentralNic’s TLD management service, as it struggles to remain alive.
CentralNic already acts as the back-end registry for both TLDs.
ICANN hit Asiamix with a breach notice for tens of thousands of dollars of unpaid fees a month ago, terminating its affiliated registrar for the same reasons around the same time.
The registry had attempted to auction off the strings a couple of years ago, unsuccessfully.
While technically based in Hong Kong, ICANN has been sending Asiamix’s compliance notices to an address in Milan, Italy.
All of Asiamix’s official web sites still appear to be non-functional. I bought the .net address listed in its IANA records to make a silly point a month ago and the equivalent .com has since expired too.
.fans has about 1,400 names in its zone file right now, while .fan never actually launched.

$55 billion bank not paying its $6,250 ICANN fees

Kuwait Finance House has become the latest new gTLD registry to get slapped with an ICANN breach notice for not paying its quarterly fees.
The company is a 40-year-old, Sharia-compliant Kuwaiti bank managing assets of $55.52 billion, according to Wikipedia. It has annual revenue in excess of $700 million.
But apparently it has not paid its fixed ICANN dues — $6,250 per quarter — for at least six months, according to ICANN’s breach letter (pdf).
KFH runs .kfh and the Arabic internationalized domain name equivalent .بيتك (.xn--ngbe9e0a) as closed, dot-brand domains.
Neither appears to have any live sites, but both appear to be in their launch ramp-up phase.
ICANN has been nagging the company to pay overdue fees since November, without success, according to its letter.
They’re the third and fourth new gTLD registries to get deadbeat breach notices this month, after .qpon and .fan and .fans.

ICANN cancels registrar audit as GDPR headaches loom

ICANN has decided to call off a scheduled audit of its registrar base, to enable registrars to focus on sorting out compliance with the General Data Protection Regulation.
The biannual audit, carried out by ICANN Compliance, was due to start in May. As you likely know by now, May 25 is GDPR Day, when the EU’s privacy law comes into full effect.
In a letter (pdf) to registrars, senior VP of compliance Jamie Hedlund said: “The April 2018 registrar audit round is on hold.”
He added: “We are reviewing the schedule, resources and risks associated with holding a single, larger audit round in autumn of 2018, as well as considering alternative approaches.”
His letter came in response to a plea (pdf) from Registrar Stakeholder Group chair Graeme Bunton, who said an audit that clashed with GDPR deadline would be an “enormous undertaking” for affected registrars.
The audits, which have been running for a few years, randomly select a subset of registries and registrars to spot-check compliance with their Registrar Accreditation Agreements and Registry Agreements.
The program looks at 20-odd areas of compliance, one of which is Whois provision.

Another failing new gTLD stopped paying its dues

Another new gTLD registry has been slapped with an ICANN breach notice after failing to pay its fees.
California-based dotCOOL, which runs .qpon, seems to be at least six months late in making its $6,250 quarterly payment to ICANN, according to the notice (pdf).
It’s perhaps not surprising. The TLD has been live since mid-2014 and yet has failed to top more than about 650 simultaneous domains under management, at least 100 of which were registry-owned.
Right now, its zone file contains about 470 domains.
It typically sells new domains in the single digits each month, with retail prices in the $15 to $20 range.
With that volume and the inferred registry fee, a full year’s revenue probably wouldn’t cover one quarter of ICANN fees.
The string “qpon” is a pun on “coupon”. The idea was that companies would use the TLD to push discount coupons on their customers.
But they didn’t.
The number of live sites indexed by Google is in the single figures and none of them are using .qpon for its intended purpose.
ICANN’s breach notice also demands the company start publishing a DNSSEC Practice Statement on its registry web site, but that seems like the least of its worries.
As a novel, non-dictionary string, I worry that .qpon may struggle to find a buyer.
Last week, .fan and .fans, both operated by Asiamix Digital, got similar breach notices from ICANN.

I just bought a new gTLD registry’s domain for $10

Are .fan and .fans the latest new gTLDs to go out of business? It certainly looks that way.
ICANN has hit the registry with a breach notice for unpaid dues and stripped it of its registrar accreditation.
In addition, its web sites no longer appear functional and I’ve just bought its official IANA-listed domain name for under $10.
Asiamix Digital is the Hong Kong-based company behind both TLDs, doing business as dotFans.
It launched .fans in September 2015, with retail pricing up around the $100 mark, but never actually got around to launching the singular variant, which it acquired (defensively?) from Rightside (now Donuts) earlier that year.
.fans had fewer than 1,400 domains in its zone file yesterday, down from a peak of around 1,500, while .fan had none.
dotFans in-house accredited registrar, Fan Domains, didn’t seem to actually sell any domains and it got terminated by ICANN (pdf) at the end of March for failing to provide basic registrar services.
And now it seems the registry itself has been labeled as a deadbeat by ICANN Compliance, which has filed a breach notice (pdf) alleging non-payment of registry fees.
While breach notices against TLD registries are not uncommon these days, I think this is the first one I’ve seen alleging non-payment and nothing else.
The notice claims that the registry’s legal contact’s email address is non-functional.
In addition, the domains nic.fans, nic.fan and dotfans.com all currently resolve to dead placeholder pages.
Meanwhile, dotfans.net, the company’s official domain name as listed in the IANA database now belongs to me, kinda.
It expired March 12, after which it was promptly placed into a GoDaddy expired domains auction. Where I just bought it for £6.98 ($9.92).

To be clear, I do not currently control the domain. It’s still in post-expiration limbo and GoDaddy support tells me the original owner still has eight days left to reclaim it.
After that point, maybe I’ll start getting the registry’s hate mail from ICANN. Or perhaps not; it seems to have been using the .com equivalent for its formal communications.
Should .fan and .fans get acquired by another registry soon — which certainly seems possible — rest assured I’ll let the domain go for a modest sum.

ICANN confirms GoDaddy Whois probe

ICANN is looking into claims that GoDaddy is in breach of its registrar accreditation contract.
The organization last week told IP lawyer Brian Winterfeldt that his complaint about the market-leading registrar throttling and censoring Whois queries over port 43 is being looked at by its compliance department.
The brief note (pdf) says that Compliance is “in receipt of the correspondence and will address it under its process”.
Winterfeldt is annoyed that GoDaddy has starting removing contact information from its port 43 Whois responses, in what the company says is an anti-spam measure.
It’s also started throttling port 43 queries, causing no end of problems at companies such as DomainTools.
Winterfeldt wrote last month “nothing in their contract permits GoDaddy to mask data elements, and evidence of illegality must be obtained before GoDaddy is permitted to throttle or deny port 43 Whois access to any particular IP address”.
It’s worth saying that ICANN is not giving any formal credibility to the complaint merely by looking into it.
But while it’s usual for ICANN to publish its responses to correspondence it has received and published, it’s rather less common for it to disclose the existence of a compliance investigation before it has progressed to a formal breach notice.
It could all turn out to be moot anyway, given the damage GDPR is likely to do to Whois across the industry in a matter of weeks.

Zero registrars pass ICANN audit

Some of the biggest names in the registrar game were among a bewildering 100% that failed an ICANN first-pass audit in the latest round of random compliance checks.
Of the 55 registrars picked to participate in the audit, a resounding 0 passed the initial audit, according to data released today.
Among them were recognizable names including Tucows, Register.com, 1&1, Google and Xin Net.
ICANN found 86% of the registrars had three or more “deficiencies” in their compliance with the 2013 Registrar Accreditation Agreement.
By far the most problematic area was compliance with sections 3.7.7.1 to 3.7.7.12 of the RAA, which specifies what terms registrars must put in their registration agreements and how they verify the contact details of their customers.
A full three quarters of audited registrars failed on that count, according to ICANN’s report (pdf).
More than half of tested registrars failed to live up to their commitments to respond to reports of abuse, where they’re obliged among other things to have a 24/7 contact number available.
There was one breach notice to a registrar as a result of the audit, but none of the failures were serious enough for ICANN to terminate the deficient registrar’s contract. Two registrars self-terminated during the process.
ICANN’s audit program is ongoing and operates in rounds.
In the current round, registrars were selected from those which either hadn’t had an audit in a couple of years, were found lacking in previous rounds, or had veered dangerously close to formal breach notices.
The round kicked off last September with requests for documents. The initial audit, which all registrars failed, was followed by a remediation phase from January to May.
Over the remediation phase, only one third of the registrars successfully resolved all the issues highlight by the audit. The remainder issued remediation plans and will be followed up on in future rounds.
The 0% pass rate is not unprecedented. It’s the same as the immediately prior audit (pdf), which ran from May to October 2016.

.feedback gTLD in breach of contract after big brand “fraud” claims

ICANN has slapped .feedback operator Top Level Spectrum with a contract breach notice after a huge complaint about alleged fraud filed by a gang of big brands.
The company becomes the third new gTLD to be hit by a breach notice, and the first to receive one as a result of losing a Public Interest Commitments Dispute Resolution Process case.
While TLS dodged the “fraud” charges on a technicality, the breach is arguably the most serious found by ICANN in a new gTLD registry to date.
The three-person PICDRP panel found TLS was in violation of the following commitment from its registry agreement:

Registry Operator will operate the TLD in a transparent manner consistent with general principles of openness and non-discrimination by establishing, publishing and adhering to clear registration policies.

But TLS dodged the more serious charges of “fraudulent” behavior, which it denied, largely on the technicality that its PICs only require it to bar its registrants from such behavior.
There’s nothing in the PICs preventing the registry from behaving fraudulently, so the PICDRP panel declined to rule on those allegations, saying only that they “may be actionable in another forum”.
The complainants, which filed their 1,800-page complaint in October, were MarkMonitor and a bunch of its clients, including Adobe, American Apparel, Best Buy, Facebook, Levi and Verizon.
They’d claimed among other things that 70% of .feedback domains were trademarked names actually registered by the registry, and that TLS had stuffed each site with reviews either paid for or scraped from services such as Yelp!.
They claimed that Free.Feedback, a free domains service hosted by an affiliated entity, had been set up to auto-populate Whois records with the names of brand owners (or whoever owned the matching .com domain) even when the registrant was not the brand owner.
This resulted in brand owners receiving “phishing” emails related to domains they’d never registered, the complainants stated.
TLS denied all all the allegations of fraud, but the PICDRP panel wound up not ruling on many of them anyway, stating:

the Panel finds that Respondent’s Registry Operator Agreement contains no covenant by the Respondent to not engage in fraudulent and deceptive practices.

The only violations it found related to the transparency of .feedback’s launch policies.
The panel found that TLS had not given 90 days notice of policy changes and had not made its unusual pricing model (which included an extra fee for domains that did not resolve to live sites) transparent.
The registry had a number of unusual launch programs, which I outlined in December 2015 but which were apparently not adequately communicated to registrars and registrants.
The panel also found that Free.Feedback had failed to verify the email addresses of registrants and had failed to make it easy for trademark owners to cancel domains registered in their names without their consent.
Finally, it also found that TLS had registered a bunch of trademark-match domain names to itself during the .feedback sunrise period:

self-allocating or reserving domains that correspond to the trademark owners’ marks during the Sunrise period constitutes a failure by the Respondent to adhere to Clause 6 of its Registration and Launch policies, versions 1 and 2. According to the policies, Sunrise period is exclusively reserved for trademark owners

TLS, in its defense, denied that it had self-allocated these names and told the panel it had “accidentally” released them into the zone file temporarily.
As a result of the PIC breaches found by the panel, ICANN Compliance has issued a breach notice (pdf) against the company.
To cure the breach, and avoid having its Registry Agreement taken away, TLD has to, by April 15:

Provide ICANN with corrective and preventative action(s), including implementation dates and milestones, to ensure that Top Level Spectrum will operate the TLD feedback in a transparent manner consistent with general principles of openness and nondiscrimination by establishing, publishing and adhering to clear registration policies;

That seems to me like it’s probably vague enough to go either way, but I’d be surprised if TLS doesn’t manage to comply.

Complaints about registrars dip in 2016

There were slightly fewer complaints about domain name registrars in 2016, compared to 2015, according to newly published ICANN data, but complaints still run into the tens of thousands.
There were 43,156 complaints about registrars to ICANN Compliance in 2016, compared to 45,926 in 2015, according to the data (pdf). That’s a dip of about 6%.
The overall volume of complaints, and the dip, can be attributed to Whois.
About three quarters of the complaints directed at registrars in 2016 were for Whois inaccuracy — 32,292 complaints in total, down from 34,740 in 2015.
The number of complaints about gTLD registries was pretty much flat at 2,230, despite hundreds of new gTLDs being delegated during the year.
The vast majority of those gTLDs were dot-brands, however, with nowhere near the same kind of potential for abuse as generally available gTLDs.
The biggest cause for complaint against registries, representing about half the total, was the Zone File Access program. I’ve filed a few of these myself, against dot-brands that decide the ZFA policy doesn’t apply to them.
Formal, published breach notices were also down on the year, with 25 breaches, four suspensions and four terminations, compared to 32 breaches, six suspensions and eight terminations in 2015.
That’s the second consecutive year the number of breach notices was down.

ICANN’s top DC lobbyist gets consumer safeguards role

ICANN has named veteran staffer Jamie Hedlund as its new senior VP for contractual compliance and consumer safeguards.
It’s a new executive team role, created by the departure of chief contract compliance officer Allen Grogan. Grogan announced his intention to leave ICANN last May, and has been working there part-time since August.
The “consumer safeguards” part of the job description is new.
ICANN first said it planned to hire such a person in late 2014, but the position was never filled, despite frequent poking by anti-spam activists.
Now it appears that the two roles — compliance and consumer safeguards — have been combined.
This makes sense, give that ICANN has no power to safeguard consumers other than the enforcement of its contracts with registries and registrars.
From the outside, it does not immediately strike me as an obvious move for Hedlund.
While his job title has changed regularly during his six or so years at ICANN, he’s mainly known as the organization’s only in-house Washington DC government lobbyist.
He played a key role in the recent IANA transition, which saw the US government sever its formal oversight ties with ICANN.
His bio shows no obvious experience in consumer protection roles.
His replacement in the government relations role is arguably just as surprising — Duncan Burns, a veteran PR man who will keep his current job title of senior VP of global communications.
The appointments seem to indicate that lobbying the US government is not as critical to ICANN in the post-transition world, and that institutional experience in the rarefied world of ICANN is a key qualifier for senior positions.