Epik’s meltdown is a ticking time-bomb for ICANN

There are many ways ICANN could eventually wind up shutting down flailing registrar Epik, but it might face a nightmare of its own when it does.

Epik appears to have been suffering from serious cash-flow problems for the last several months, with some customers still complaining this week that they haven’t been paid money owed as far back as September.

It’s facing a lawsuit by a customer who says he’s owed over $300,000 over a failed domain purchase, accusations that it’s been running its escrow service without the proper paperwork, and claims that current and former executives may have “embezzled” customer money.

It’s an absolute dumpster fire that so far shows little sign of being extinguished, but unfortunately there’s very little about the situation that appears to be in ICANN’s Compliance wheelhouse.

ICANN Compliance has the right to terminate a company’s accreditation — its ability to sell gTLD domains — if that registrar breaches the terms of the Registrar Accreditation Agreement that all registrars must sign.

The RAA does not cover the secondary market, or escrow or store credit services like Epik’s doomed “Masterbucks”.

Ironically, ICANN would stand a better chance of shutting Epik down if its Whois service crashed, or if the registrar for some reason failed to publish an abuse contact on its web site.

However, if Epik is treating its ICANN fees the same way customers say it’s treating their funds, it can expect a nastygram or six from Compliance, if it has not done so already.

Most cases where ICANN ultimately terminates a registrar’s accreditation begin when Compliance gets a note from the bean-counters that somebody hasn’t been paying their quarterly invoices.

Typically, this serves as a tip-off that the registrar is having problems, so Compliance audits the company to see where else it might be in breach, often discovering other minor or major infractions it can add to the docket.

Epik paid ICANN just shy of $150,000 in its last-reported fiscal year to June 30, 2022. If its current cash-flow problem has caused it to miss an ICANN payment in the three quarters since then, Compliance could be another very powerful creditor knocking at its door.

Another way ICANN could bring out the deaccreditation hammer is if Epik suffers unfavorable court rulings related to financial mismanagement. The RAA specifically allows termination if a court finds a registrar committed “fraud” or “a breach of fiduciary duty”.

The customer lawsuit Epik is currently facing could make such a finding, if it reaches trial and things don’t go Epik’s way.

Perhaps a more immediate concern is that the RAA contains another clause allowing termination if a registrar “is disciplined by the government of its domicile for conduct involving dishonesty or misuse of funds of others”.

I am not a lawyer, but I can see an argument being made that this might have happened already.

As Domain Name Wire reported in February, the Insurance Commissioner of Epik’s home state of Washington recently fined the company $10,000 for selling its DNProtect service as an “insurance” product without the proper licences.

Does this count as being “disciplined by the government of its domicile for conduct involving dishonesty”? Legally, I don’t know.

DNW reports in the same article that the Washington state attorney general has been tipped off about Epik’s escrow service, which is also a regulated industry in which Epik apparently does not have the necessary paperwork to operate.

I’m soothsaying here, of course, but any future disciplinary action from Epik’s local AG could well give ICANN Compliance another deaccreditation trigger to pull.

There are multiple excuses Compliance could find to shitcan Epik over the coming months, but let’s look at the downside for ICANN if it does.

Epik has built itself up in recent years as the go-to “free speech” registrar. It’s welcomed, even courted, multiple registrants that have had their domains banished from other registrars for their sites’ controversial content.

That pretty much always means “far-right” content, of course.

Most recently, it took the business of kiwifarms.net, a forum accused of allowing member to doxx and issue death threats against transgender rights activists.

It’s previously been associated with domains for similarly controversial registrants including Andrew Tate, Infowars, 8chan, Gab and The Daily Stormer.

When Monster was replaced by current CEO Brian Royce last September, the company made a big deal about how the new guy and the old guy were aligned on the free speech issue. Royce has subsequently echoed those thoughts.

Given the narrative Epik has created around itself, can you imagine how a certain section of the online public, namely the fringe of the American right-wing, would react if ICANN essentially shut down the “free speech registrar”?

ICANN has for many years faced misinformed criticism that it has the power to take down web sites it does not agree with, that it acts as a gatekeeper for the internet, that it is or risks becoming the internet’s “content police”.

If ICANN were to deaccredit Epik, removing its ability to sell most domain names, it would be incredibly easy to construct a narrative that a bunch of Californian liberals are trying to destroy “free speech” by taking down loads of right-leaning web sites.

It wouldn’t be true, of course, but the notion would only need to be propagated by a clueless Congressperson, a disingenuous podcast host, or a sustained social media campaign, before ICANN’s very raison d’être came under focus by people who don’t particularly care about facts.

Epik customer exodus started when Monster quit

Domain registrants started leaving Epik in droves when CEO Rob Monster quit last year and serious allegations of financial mismanagement emerged, an analysis of the numbers shows.

Epik’s total gTLD domains under management began to free-fall in September 2022, dropping by more than 70,000 by the end of the year, almost all as a result of customers transferring their domains to other registrars.

Data from registry transaction reports I compiled shows Epik peaking at around 808,000 domains across all gTLDs at the end of August, having gone up every month that year.

But DUM started tumbling when Monster quit and customers started reporting problems extracting funds from their accounts in mid-September. Epik dropped to 792,000 domains that month, with 780,000 in October, 767,000 in November and 733,000 at the end of the year.

Transfers from Epik to other registrars also went up in September, almost doubling from the 9,500 domains reported in August to 16,000, a level of customer bleed it maintained until December, when it rocketed up to almost 23,000.

Most of the losses were of course in .com, but .net, .org and .xyz also saw big downsides.

The drop in revenue won’t help the company extract itself from its current dire straits. It’s publicly admitted it’s having difficulty paying its customers, some of whom complain they’re owed tens or hundreds of thousands of dollars.

Epik is facing a customer lawsuit, the prospect of a probe by its local state attorney general over its unlicensed escrow service, and recently had to shut down its unlicensed “insurance” service after a settlement with the Washington state insurance regulator.

Whoever runs its Twitter account has been pointing the finger of blame at Monster, saying the company, which it refers to as “Epik 2.0” is trying to move “out of a monster’s shadow”.

In recent days it’s tweeted reassurances that customers will eventually be made whole, legal threats against Monster (believed to still be non-executive chair) and, yesterday, expressions of a desire to “connect” with Monster and explore “alternative paths”.

Epik sued over financial meltdown

Domain registrar Epik has been sued by a customer who says he is owed $327,000 over an aborted secondary market purchase.

Matthew Adkisson says he paid the sum to Epik to buy the domain nourish.com from a third-party seller, with Epik paid $27,000 for its escrow service.

However, Adkisson alleges, the sale fell through and when he asked Epik for his money back he was given the runaround for months.

His lawsuit describes a scheme whereby Epik, former CEO Rob Monster and current CEO Brian Royce were using supposedly escrowed funds for general corporate — and possibly even personal — purposes.

There are even alleged Ponzi-like elements, with funds from new customers being used to pay off debts to former customers.

The suit describes it as a “widespread and illegal fraudulent scheme — replete with misrepresentations, embezzlement, and misappropriation”.

Similar complaints of this nature have been made against Epik for months, with many buyers and sellers struggling to get paid.

The suit, which suggests it believes some of Epik’s actions may have been criminal, lists eight counts including breach of contract, fraud and racketeering. Adkisson wants his money back, as well as unspecified damages.

You can read the complaint here (pdf). Hat tip to John Berryhill.

Kiwi Farms domain lands at Epik

The primary domain for the controversial web forum Kiwi Farms, kicked out by Cloudfare at the weekend, has been transferred to Epik.

Whois records show the domain kiwifarms.net landed at Epik in the last hour or so. It’s still using Cloudflare’s name servers at the time of writing, so it’s still resolving to a “blocked” message from its old registrar.

Cloudflare blocked the name, reluctantly, on Saturday, citing “an imminent and emergency threat to human life”, believed to refer to a transgender activist and Twitch streamer targeted for death threats by Kiwi Farms users.

The site, whose users reportedly bully, doxx and swat trans people, has been linked to three suicides since it was launched in 2013.

The question for Epik and its new CEO now is whether they let the domain stay under its roof, or whether the same concerns cited by Cloudflare make it too toxic to touch.

UPDATE 1724 UTC: Not long after this post was published, the domain started using Epik’s name servers.

Cloudflare blocks anti-trans site for “emergency threat to human life”

Internet infrastructure provider Cloudflare has “blocked” a site it provides domain services to after identifying “an imminent and emergency threat to human life”.

The company said on Saturday that it has reluctantly stopped providing services to Kiwi Farms, a web forum whose users reportedly bully and carry out doxxing and swatting attacks on transgender people and activists.

Visitors to kiwifarms.net are now presented with a message from Cloudflare stating: “Due to an imminent and emergency threat to human life, the content of this site is blocked from being accessed through Cloudflare’s infrastructure.”

A linked blog post explaining the decision said:

This is an extraordinary decision for us to make and, given Cloudflare’s role as an Internet infrastructure provider, a dangerous one that we are not comfortable with. However, the rhetoric on the Kiwifarms site and specific, targeted threats have escalated over the last 48 hours to the point that we believe there is an unprecedented emergency and immediate threat to human life unlike we have previously seen from Kiwifarms or any other customer before.

The move is likely linked to a campaign by a trans Twitch streamer, who reportedly has been campaigning for Cloudflare to drop the site after multiple threats to her life, including a recent swatting (where armed police are tricked into showing up at your door).

Last week, the company had tried to explain its continued support for the domain by stating that one two previous occasions it has blocked sites, authoritarian governments have used that precedent to try to get human rights sites pulled.

At this stage, it appears that Cloudflare is using its status as the site’s DNS provider to implement the block. It’s still the domain’s registrar, and so far the Whois record does not reflect an attempt to move it elsewhere.

The domain was registered with DreamHost until last year, but was asked to leave following the suicide of a software developer, one of three suicides reportedly linked to Kiwi Farms users’ behavior.

Could Epik be its next destination? The company is a strong proponent of free speech, but even it has a line when it comes to violence. This could be Epik’s new CEO‘s first big test.

Epik replaces Monster with younger clone

Epik has replaced CEO Rob Monster with a younger model whose Twitter feed suggests could be every bit as controversial.

The company announced today that Brian Royce, who seems to have joined the company as an executive VP last month, is taking the corner office. Monster will stay on as non-executive chairman.

Royce appears to be a newcomer to the domain name industry, but ideologically very much in tune with Monster.

A glance at his Twitter feed for the last three months reveals he dislikes liberals, gun control, murder victim George Floyd, abortion rights, Joe Biden, wokeness, US attorney general Merrick Garland, Rep Alexandria Ocasio-Cortez, universal healthcare, Beto O’Rourke, mask-wearing and providing support to Ukraine.

It shows that he likes Christians, free speech, conservative politicians and, at least in May before Donald Trump started being publicly investigated, the police.

“Epik will continue to stand for free speech. It is extremely important to me to see core values of freedom, truth and liberty reflected in all we do at Epik,” Monster said in a press release.

“I am concerned about free speech as I look at what is happening across America. People are actively trying to silence people like Joe Rogan, Dave Chappelle and Chris Rock just for talking and telling jokes,” Royce said.

“More conversations, more speech, more debate—that is what makes people more informed and more compassionate,” he said.

Epik’s line on free speech has seen it become the registrar of choice for many controversial figures and organizations, often those asked to leave their original registrars due to their far-right or violent views.

Cancelled misogynist Andrew Tate moves domain to (drumroll)… Epik!

Andrew Tate has become the latest high-profile controversy magnet to move his domain to Epik, at the end of a week that saw him thoroughly “cancelled” over reportedly violently misogynistic speech.

Tate, a former kick-boxer and reality TV contestant who made his money through a large social media following and an online course called Hustler’s University, reportedly told Fox News host Tucker Carlson yesterday:

When they go to cancel you, ladies and gentlemen, it comes hard and fast. You lose your Facebook, then your Instagram, then your Gmail, your Discord, then your website hosting, your domain name, like then your payment processor, and your bank.

Tate reportedly had his accounts on Facebook, YouTube, Instagram and Tiktok deleted this week. He was getting banned so much it briefly became a meme.

The domain name in question appears to be cobratate.com, based on his apparent nickname “Cobra”, and it appears to still be in his possession, although he has changed registrars.

Up until an hour or two ago the name was managed by Tucows, via United-Internet-owned reseller Fasthosts, but the Whois record now shows it’s with Epik.

It’s not clear right now whether he jumped or, as he implied to Fox, was pushed. Tucows tells me it had not received any complaints about the site, had not investigated, and had not asked Tate to leave. I’ve asked United for comment.

Epik has over the last few years become the safe-haven registrar of choice for people and groups who become internet persona non grata, typically those with far-right or violent views, such as Infowars, 8chan, Gab and The Daily Stormer.

Epik buys DNForum, explores member ownership options

Controversial registrar Epik has acquired DNForum and says it is thinking about ways to make the site member-owned.

DNForum is a forum targeted mainly at domain investors. It competes with NamePros and has seen multiple sets of owners over the last few years.

Posting on DNForum, Epik CEO Rob Monster said he hopes to improve industry communication, interoperability and commercial opportunities — registrars will be welcome to pitch their promotions to users.

He said that Epik is “actively investigating a legally compliant way to turn DNForum into a member owned community based on crypto token”.

While popular with domainers, Epik has attracted controversy in recent years for soliciting and welcoming the business of domain names that have been “cancelled” elsewhere due to political extremism.

Whether this laissez-faire stance on free speech will extend to DNForum’s moderation practices in future remains to be seen.

Gun nut site crashes at Epik after GoDaddy shoots it down

A site for American gun enthusiasts has switched registrars, moving its domain to Epik — apparently with the consent of CEO Rob Monster — after GoDaddy turfed it out for allegedly inciting violence.

According to a GoDaddy statement at the weekend, the registrar had received complaints about content on AR15.com — that’s the name of a gun popular with spree killers — and determined it “incited violence”.

It informed the domain’s owner the same day, January 8, two days after the Capitol Hill riots, giving him 24 hours to remove the offending content.

It’s not clear what the content in question was, but given the timing and the fact that the site is a scarily popular forum with largely user-generated content, it’s not difficult to imagine.

AR15.com’s owner, identified in a video as GoatBoy, claims that by the time he received the email from GoDaddy, the forum’s moderators had already removed the posts on the grounds that the site also has a policy against incitement to violence.

But GoDaddy disagrees, saying the content could still be found after its supposed removal. It took down the domain on January 11. It said in a statement:

We do not take action on complaints that would constitute censorship of content that represents the exercise of freedom of speech and expression on the Internet. In instances where a site goes beyond the mere exercise of these freedoms, however, and crosses over to promoting, encouraging, or otherwise engaging in violence, as was the case with AR15.com, we will take action.

The AR15.com domain is now hosted by Epik, which has in recent years made a name for itself as a refuge for sites frequented by those with far-right views, such as 8chan, Gab and Parler.

GoatBoy says in the video embedded below: “I had the privilege of speaking with some of the guys on the executive staff, including the owner of Epik. Their views really align well with ours. They’re very pro First Amendment and very pro Second Amendment.”

Westerdal offloads two more gTLDs to Donuts

Donuts has bulked out its gTLD portfolio yet again, acquiring two more strings from Fegistry and Top Level Spectrum.

ICANN records show that it recently took over the contracts for .observer and .realty.

They’re both launched, active TLDs. Both selling registries are backed by investor Jay Westerdal.

.observer was bought dormant by TLS from the British newspaper of the same name in 2016 and launched the following year with .com-competitive prices.

TLS has been marketing it as a place for news organizations, though it’s unrestricted. Registrations plateaued at about 1,000 a couple of years ago and haven’t seen much movement since.

.realty is a different story.

Fegistry paid ICANN $5,588,888 at a public auction — beating Donuts, in fact — in 2014, and launched it in 2017 with a roughly $300-a-year retail price.

It’s been cruising along with about 2,200 names under management for the last couple of years, until this September and early October, when its zone file shot up to almost 18,000 domains.

This seems to have been the result of a $0.99 promotion at Epik, which has since ended.

One would have to assume that the vast majority of those new domains will be speculative and are unlikely to renew at the full $300 reg fee a year from now.

While the contracts changed hands in late October, it’s inconceivable that Donuts was not aware of the quality of the recent registrations.

It’s not the first time Westerdal’s businesses have sold to Donuts, which took .contact off Top Level Spectrum’s hands in April 2019. That gTLD entered general availability this week.

It’s also handed off responsibility for .forum to MMX, which plans to launch it with a puzzling $1,000 price tag next March, although TLS is still listed as the ICANN contractor.

TLS still runs the controversial gripe site TLD .feedback, along with the unlaunched head-scratcher .pid.

Fegistry is still fighting for .hotel, along with rival applicants, in ICANN’s quasi-judicial Independent Review Process.