Police .uk domain takedowns dive in 2023

The number of .uk domain names taken down as a result of requests from law enforcement shrank substantially last year, according to the latest stats from Nominet.

The registry said today that it suspended 1,193 domains in the 12 months to October 31, down from 2,106 in the previous period. It’s a record low since Nominet started tracking the data, for the second year in a row.

As usual, alleged intellectual property violations were the biggest cause of action. The Police Intellectual Property Crime Unit had 717 names taken down, with the National Fraud Intelligence Bureau suspending 321 and the Financial Conduct Authority 116.

While police takedowns were low, domains suspended by Nominet’s proactive Domain Watch anti-phishing technology were up about 20%, from 5,005 to 5,911. Nominet said this is because the tech, which flags possible phishing domains for human review at point of registration, is getting better.

The number of domains suspended because they appeared on threat feeds doubled, from 1,108 in the 2022 period to 2,230 last year, the company said.

Cybersquatting cases in .uk have also been declining, Nominet reported earlier this month.

While correlation does not equal causation, it might be worth noting that .uk registrations overall have been on the decline for some time. There were 10.68 million .uk domains at the end of January, down from 11.04 million a year earlier.

Broker says it will sue after DNS abuse sting operation

The CEO of domain broker VPN.com is threatening to sue an online safety advocacy group after a report was published alleging the company trades in names that could be used for illegal activity.

Michael Gargiulo said he will take action against the Digital Citizens Alliance unless it removes a report that claimed one of the company’s brokers agreed to coordinate the $21,000 purchase of covidvaccinecardsforsale.com, even after being told it would be used for illegal purposes.

“[We] sadly have no choice but to sue the Digital Citizens Alliance, Executive Director Tom Galvin, their Managing Editor, and every John Doe that coordinated this fraud unless this content is removed within 48 hours from now,” Gargiulo said.

The DCA report, entitled “Peddling For Profit — How Website Retailers Enable Bad Actors to Become the Master of Illicit Domains” (pdf), is largely an attempt to highlight how domain registrars don’t vet domains for potentially illegal use before allowing them to be registered.

It’s mostly familiar nonsense, apparently written with a general audience and tabloid headlines, rather than the domain industry or tech industry, in mind.

There’s no attempt to explore the complexities of automatically determining a registrant’s intent at the point of sale and comparing it to the world’s hundreds of legal jurisdictions, it’s mainly just “Woah, GoDaddy let me register untraceablegunsforsale.com!”

Where the report differs from the norm is when it looks at the secondary market, where human beings work with buyer and seller to agree a price and transfer a domain.

With VPN, the DCA reporter posed as the potential buyer of covidvaccinecardsforsale.net and carried out an email conversation with a broker in which it was stated the domain would be used to sell “Covid cards” to “the unvaccinated”, from which one could certainly infer a nefarious purpose.

The VPN broker responded by trying to negotiate the sale of the matching .com for a higher price, the DCA report states. Later, the DCA reporter says he wants to “stay under the radar of the FTC” but VPN’s response, if any, is not reported.

Gargiulo told DI that DCA “posed as a legitimate Buyer on the original inquiry with fraudulent intent, which by their publication admission, is fraudulent and illegal in America.”

The broker in question is from outside the US and “did not understand their [DCA’s] illegal intent” he said.

“In many parts of the world including Europe, Covid cards are used for vaccinated and unvaccinated people,” he said, giving the Netherlands as an example.

“We take this matter very seriously as the characterization of our company is absolutely ridiculous in this document,” he said. “There was little-to-no journalistic integrity to verify the other side of this story by DCA and the transaction never even got remotely close to occurring.”

DCA also attempted to buy buystolencreditcards.com via broker Domain Agents, but after blatantly describing how the name would be used for crime, “the broker canceled the deal.”

DCA, as its name implies, is funded by undisclosed companies in Big Content, Big Pharma, internet security and consumer safety. It’s led by former Verisign PR man Tom Galvin.

“We will let the report speak for itself,” a DCA spokesperson said when asked for comment on the legal threat.

“Criminal” domain suspensions drop again in .uk but thousands of pandemic domains frozen

Nominet suspended thousands fewer suspected criminal domains in 2020 than last year, according to the registry’s latest annual update.

For the 12 months to the end of October, Nominet took down 22,158 domains, is down from 28,937 in the year-ago period.

As usual, suspected intellectual property crime made up almost all the takedowns — the Police Intellectual Property Crime Unit was behind 21,632 requests, down from 28,606.

Notably, despite the reported uptick in scams related to the coronavirus pandemic, the Medicines and Healthcare Products Regulatory Agency made just 13 takedown requests, down from 31.

This is perhaps due to Nominet taking a proactive approach, putting domains containing certain related keywords on hold at the point of registration. It froze 3,811 such domains this year, later releasing 1,568.

Eight domains were suspended for criminal activity related to Covid-19, the company said.

There were no suspensions related to banned “rape” domains, despite over a thousand new registrations being flagged for manual review. Nor were there any takedowns of domains hosting child sexual abuse material.

It’s the second year in a row that suspensions have been down. In the 2017/18 period Nominet took down 32,813 domains.

Guy gets 14 years for trying to steal a domain with a gun

An American man has received a sentence of 14 years in prison after being found guilty of a plot to steal a domain name at gunpoint.
Rossi Lorathio Adams II received the sentence on Monday, according to the US Attorney’s Office in Iowa, having been found guilty of “one count of conspiracy to interfere with commerce by force, threats, and violence”.
Adams, who went by the screen name Polo, attempted to obtain the domain doitforstate.com from its registrant to support a popular social media channel he managed.
When the registrant refused multiple times, Adams drove his cousin — armed with a gun and written instructions how to push the domain into Adams’ GoDaddy account — to the registrant’s house.
A fight broke out, described vividly by the US Attorney, during which both the registrant and the gunman got shot.
Both survived, and the gunman got 20 years behind bars for his role in the attack.
If there’s a moral about domaining here, I invite the reader to discover it on their own.

Cops tell Nominet to yank 16,000 domains, Nominet complies

Nominet suspended over 16,000 .uk domain names at the request of law enforcement agencies in the last year.
The registry yanked 16,632 domains in the 12 months to October 31, more than double the 8,049 it suspended in the year-earlier period.
The 2016 number was in turn more than double the 2015 number. The 2017 total is more than 16 times the number of suspended domains in 2014, the first year in which Nominet established this cozy relationship with the police.
The large majority of names — 13,616 — were suspended at the request of the Police Intellectual Property Crime Unit. Another 2,781 were taken down on the instruction of National Fraud Intelligence Bureau.
Nominet has over 12 million .uk domains under management, so 16,000 names is barely a blip on the radar overall.
But the fact that police can have domains taken down in .uk with barely any friction does not appear to be acting as a deterrent to bad actors when they choose their TLD.
The registry said that just 15 suspensions were reversed — which requires the consent of the reporting law enforcement agency — during the period. That’s basically flat on 2016.
“A suspension is reversed if the offending behavior has stopped and the enforcing agency has since confirmed that the suspension can be lifted,” the company said.
The company does not publish data on how many registrants requested a reversal and didn’t get one, nor does it publish any of the affected domains, so we have no way of knowing whether there’s any ambiguity or overreach in the types of domains the police more or less unilaterally have taken down.
It seems that the only reasons suspension requests do not result in suspensions are when domains have already been suspended or have already been transferred to an IP rights holder by court order. There were 32 of those in the last 12 months, half 2016 levels.
The separate, ludicrously onerous preemptive ban on domains that appear to encourage sexual violence resulted in just two suspensions in the last year, bringing the total new domains suspended under the rule since 2014 to just six.
Some poor bugger at Nominet had to trawl through 3,410 new registrations containing strings such as “rape” in 2017 to achieve that result, up from 2,407 last year.

ICANN boss warns against “content policing” calls

ICANN should resist attempts to turn the organization into a content regulator responsible for fighting piracy, counterfeiting and terrorism.
That’s according to CEO Fadi Chehade, speaking in Dublin yesterday at the opening ceremony of ICANN’s 54th public meeting.
His remarks have already solicited grumbles from members of the intellectual property community, which are eager for ICANN to take a more assertive role against registries and registrars.
Speaking to a packed auditorium, Chehade devoted a surprisingly large chunk of his opening address to the matter of content policing, which he said was firmly outside of ICANN’s remit.
He presented this diagram, breaking up the internet into three layers. ICANN plays in the central “logical” section but has no place in the top “societal” segment, he said.

“Where does ICANN’s role start and where does ICANN’s role stop?” Chehade posed. “It’s very clear Our remit starts and stops in this logical yellow layer. We do not have any responsibility in the upper layer.”
“The community has spoken, and it is important to underline that in every possible way, ICANN’s remit is not in the blue layer, it is not in the economic/societal layer,” he said. This is a technical organization.”
That basically means that ICANN has no responsibility to determine which web sites are good and which are bad. That’s best left to others such as the courts and governments.
Chehade recounted an anecdote about a meeting with a national president who demanded that ICANN shut down a list of terrorism-supporting web sites.
“We have no responsibility to render judgement about which sites are terrorists,” he said, “which sites are the good pharmacies, which sites are the bad pharmacies, which sites are comitting crimes, which sites are infringing copyrights…”
“When people ask us to render judgement on matters in the upper layer, we can’t.”
With that all said, Chehade added that ICANN should not shirk its duties as part of the ecosystem, whether through voluntary measures at registries and registrars or via contractual enforcement.
“Once determinations are made, how do we respond the these?” he said. “I hope, voluntarily.”
He gave the example of credit card companies that voluntarily stop doing business with web sites that have been reported to be involved in crime or spam.
The notion of registrars adhering to a set of voluntary principles was first floated by ICANN’s chief compliance officer, Allen Grogan, in a blog post earlier this month.
It was the one bone he threw to IP interests in a determination that otherwise came down firmly on the side of registrars.
Grogan had laid out a minimum set of actions registrars must carry out when they receive abuse reports, none of which contained a requirement to suspend or delete domain names.
The Intellectual Property Constituency appeared to greet Chehade’s speech with cautious optimism, but members are still pushing for ICANN to take a stricter approach to contract compliance.
In a session between the IPC and the ICANN board in Dublin this morning, ICANN was asked to make these hypothetical voluntary measures enforceable.
Marc Trachtenberg disagreed with Chehade’s credit card company example.
“The have an incentive to take action, which is the avoidance of future potential costs,” he said. “That similar incentive does not exist with respect to registries and registrars.”
“In order for any sort of voluntary standards to be successful or useful, there have to be incentives for the parties to actually comply with those voluntary standards,” he said.
“One possibility among many is a situation where those registries and registrars that don’t comply with the voluntary standards are potentially subject to an ICANN compliance action,” he said.
It’s pretty clear that this issue is an ongoing one.
Chehade warned in his address yesterday that calls for ICANN to increase its policing powers will only increase when and if its IANA contract is finally divorced from US government oversight.
Grogan will host a roundtable tomorrow at 10am Dublin time to discuss possible voluntary mechanisms that could be created to govern abuse.

Interpol wants to join the GAC

Interpol plans to apply to join ICANN’s Governmental Advisory Committee as an observer, according to ICANN.
The news came in a press release this evening, detailing a meeting between ICANN president Rod Beckstrom and Interpol secretary general Ronald Noble.
The meeting “focused on Internet security governance and enhancing common means for preventing and addressing Internet crime”. Beckstrom said in the release:

We seek the active engagement of law enforcement in our multi-stakeholder community where all parties are welcome. We recognize Interpol as an important international leader in this field. We are very pleased by its expression of interest in joining the ICANN Governmental Advisory Committee as an observer.

The GAC already has about 20 members with “observer” status, which can be granted to any intergovernmental or treaty organization.
Also in attendance at the meeting in Lyons, France, was ICANN’s new chief of security, Jeff Moss, VP of government affairs Jamie Hedlund, and Alice Jansen of its Organizational Reviews unit.
Law enforcement has been trying to get a louder voice at ICANN for some time, and calls have grown in volume given the increasing use of domain names as tools to shut down crooks.
At ICANN’s recent meeting in San Francisco, Interpol’s top cop on the child abuse imagery beat, Michael Moran, launched a withering critique of what he saw as the industry’s failure to help police the web.
Moran called for a system to be put in place for law enforcement to more easily be able to shut down peddlers of such content and more easily track the abusers.

Cyber cop wants Whois privacy shake-up

Registrars should be made to police Whois so cops can take down illegal sites faster, even if domain name prices have to go up as a result, ICANN’s Government Advisory Committee has been told.
Speaking at the GAC hearing on new gTLDs in Nairobi this afternoon, Paul Hoare of the UK’s Serious and Organised Crime Agency called for (continue reading)