ICANN hit by DDoS attack

If you noticed ICANN’s web site acting sluggishly or failing to respond at all last week, now you know why.

The site at icann.org was hit by a distributed denial of service attack on September 3 through September 4, according to a brief statement on the Org’s now-functional site.

ICANN identified a Distributed Denial of Service (DDoS) event that occurred on www.icann.org on 3 Sept. 2024. The situation was mitigated and service to ICANN’s website was restored on 4 Sept. 2024.

No additional information has yet been released on the size, duration or possible motivations behind the attack.

It’s the first security incident ICANN has judged significant enough to publicly disclose in over two years.

Russia calls for ICANN to split from US

The Russian government has called on ICANN to further distance itself from US legal jurisdiction, complaining that the current war-related sanctions could prevent its companies from applying for new gTLDs.

In recent comments, Russia said that “no single state or group of states should have the right to interfere in the operation of critical Internet infrastructure and/or the activities of ICANN, including the mechanisms for legal regulation of ICANN’s operations”.

It added that it is “necessary… to prepare by the ICANN community and stakeholders proposals for measures or mechanisms that can make ICANN less dependent on one state”.

The call came in comments filed in ICANN’s public comment period on the terms and conditions of the new gTLD program’s Applicant Support Program and Registry Service Provider Evaluation Program.

The Ts&Cs contain a clause requiring applicants to abide by all US economic sanctions, such as those overseen by the Office of Foreign Assets Control, which has sanctioned Russian entities since the 2022 invasion of Ukraine.

Russia’s comment was filed late and has not been published or analysed by ICANN in the usual way. Instead, it was appended to the summary report (pdf) prepared by ICANN staff.

It’s not the only war-related beef Russia has with ICANN right now. The government has also complained (pdf) that about 400 domains registered by Russian entities, including airports and airlines, in the .aero gTLD have been suspended.

The .aero registry, aerospace industry IT service provider SITA, is headquartered in Switzerland but the contracting entity is a US-based subsidiary.

According to OFAC, domain registration services are exempt from the US sanctions. That has not stopped several domain registries and registrars ceasing business with Russians on moral grounds.

ICANN told Russia to file a complaint about SITA with its Compliance department. SITA has not yet responded to a request for comment.

Calls for ICANN to distance itself from the US have been coming for over two decades, usually from America’s opponents, and did not stop when the Org severed its formal ties with the 2016 IANA transition.

ICANN to be director light for months

ICANN’s board of directors will be down one person for six months or more after last month’s unexpected resignation of Katrina Sataki.

The ccNSO, which selected Sataki and is charged with picking her successor, does not expect to be able to name a new director until well into next year, and the vacant seat will stay vacant until then.

The ccNSO Council said it will open nominations for three weeks beginning September 10, but does not expect to hold the election until February 2025, “following the completion of due diligence on the nominee(s) by a professional firm”.

If the election is hotly contested, a second ballot could take place in March.

After the result is confirmed, it will need to be approved by ICANN’s sovereign Empowered Community before the new director can take their seat. Sataki’s seat could be empty for six or seven months.

The Council said that nominations from the Latin America and Caribbean region will not be accepted because the ccNSO’s other appointed director, Patricio Poblete, a Chilean, is from that region.

Sataki resigned with immediate effect August 23 citing personal reasons. Technically, her successor is to carry out her remaining term, which ends in November, but practically that is of course not possible.

Chinese registrars back in trouble after porn UDRP suspension

A collection of six registrars in the XZ.com stable are back on the ICANN naughty step, facing more Compliance action just a couple of years after a sister company was suspended over UDRP failures.

ICANN has published breach notices against DotMedia and five other registrars under common ownership, claiming that they are failing to send their registration data to the correct escrow provider.

Since last year, registrars have been obliged to escrow their data to DENIC, which replaced NCC Group as ICANN’s sole provider. Escrow is important as it helps make sure registrants keep their domains if a registrar goes out of business.

The six DotMedia registrars have failed to make this transition despite months of hand-holding from ICANN, according to the breach notices. Compliance has been on their case since at least April.

The registrars are among 20 that appear to be under common management, almost all based in Hong Kong and using xz.com as their primary storefront, and it’s not clear why only six accreditations have been found in breach.

The whole group appears to be on the skids in terms of registration volume. The main accreditation, US-registered MAFF Inc, once had around 600,000 gTLD names under management, but that’s down to around 60,000 in the latest registry reports. The others have a few thousand each, having suffered similar percentage declines.

Another member of the group, ThreadAgent.com, was actually suspended for months in 2022 after it failed to transfer two domains lost in cybersquatting complaints under the UDRP to BMW and Lockheed Martin.

The six registrars have until September 25 to come back in compliance or face further action.

Sataki quits ICANN board

Katrina Sataki has abruptly resigned from the ICANN board of directors.

In a letter last week to the ICANN brass and to the Country Code Names Supporting Organization, which elected her to the post three years ago, Sataki wrote:

I am writing to hand in my resignation as a member of the Board of Directors at ICANN, effective immediately for personal reasons. After careful consideration I regretfully see no other option and need to step down to allow another nominee from the ccNSO to fully commit to this work.

She apologized to the ccNSO for the suddenness of her departure.

Sataki, the CEO of Latvia’s .lv ccTLD registry, had served almost one full three-year term on the board, but had been reelected by the ccNSO for a second term due to begin this November.

The ccNSO is expected to open a call for nominations for her replacement this week.

The replacement would serve out Sataki’s remaining term, which has just over two months left on the clock, though it seems likely they would be appointed simultaneously also to serve a full term of their own.

For those keeping score on this kind of thing, the ICANN board now comprises five women and fourteen men (or 10 men if you only count the voting members), with CEO/director Sally Costerton also due to be replaced by a man in December.

ICANN homes in on new gTLD application fee

ICANN has narrowed down the expected application fee for the next round of new gTLDs, and while it’s towards the lower end of previous guidelines, it’s still much higher than in 2012.

The bog-standard base application fee is now expected to be $220,000, according to a draft document circulated by ICANN.

That’s up on the $185,000 applicants paid in 2012, but it’s at the less-pricey end of the $208,000 to $293,000 range ICANN outlined at its meeting in Rwanda this June.

But the base fee is simply to get your foot in the door. It’s accompanied by an à la carte menu of additional services incurring additional fees, some of which were part of the base fee in 2012.

Because the new gTLD program is being run on a cost-recovery basis, the fee is set according to how many applications ICANN expects to receive, which is rather speculative and based largely on anecdotal evidence.

That predicted number is now 1,500, down on the 1,930 actual applications received in 2012.

The $220,000 fee is the lowest up-front fee that applicants would have to pay, and does not include extra payments they would have to make in the event of contention, additional evaluations or objections.

There are 10 different additional fees that could be incurred by applicants, including one that’s new to me — an “Occupancy fee” which the document says is “for lingering applications”.

I can’t help but think that this is an attempt to avoid a repeat of Nameshop, which applied for the banned string .idn in 2012 and continues to refuse to admit defeat, withdraw its application, and get its refund.

The new ICANN document notes that this proposed squatters’ rent is still open to discussion, but other fees, while not given a price tag yet, appear more likely to become a reality.

It seems dot-brand applicants will have to pay extra fees for their Spec9 and Spec13 exemptions, which allow them to work outside the usual registrar channel and allocate names only to themselves.

Applicants for community gTLDs and geographic strings would also pay extra fees.

There’s also the chance that the base fee could go up before the application window opens, depending on the outcome of some still-unconfirmed parts of the application process, such as the mechanism to address name collision risk. This alone could add thousands to each applicant’s bill.

The good news is that if the next round is significantly over-subscribed and ICANN makes back the $70 million it reckons the program cost, it plans to offer rebates to applicants dependent on how much extra cash it has received.

The draft document also includes estimates for the cost of the Registry Service Provider Evaluation Program, which enables RSPs to get the ICANN seal of approval before pitching their services to new gTLD applicants.

Also priced on a cost-recovery basis, this program is still expected to cost a maximum of $92,000 per RSP, with the costs potentially falling if more than 50 RSPs apply to be accredited.

ICANN has a pretty good idea that the roughly 45 companies currently providing back-end registry services for gTLDs will probably use the RSP program. If a large number of startups or ccTLD registries want to get involved too, that would bring the price down.

Uzbekistan gets its first ICANN registrar

A registrar in Uzbekistan has become the first in the country to receive its official ICANN accreditation, according to the latest records.

Tashkent-based Suvan.net, which does business as @host.uz (ahost.uz), currently specializes in the local .uz ccTLD, where it appears to be the leading registrar by some margin.

The company already sells gTLD domains too, albeit as a reseller. It claims to have over 30,000 customers.

ICA finally comments on .com pricing talks

With the latest public debate about whether Verisign is ripping off registrants with its .com pricing now into its third month, one voice has been conspicuously absent.

But the Internet Commerce Association, which represents domain investors and domaining registrars, has now publicly called for .com wholesale fees to continue to be capped and Verisign’s profit margins to be tempered.

Issuing a statement late last week, the ICA revealed that it has participated in talks with the US National Telecommunications and Information Administration regarding its upcoming renewal of the .com Cooperative Agreement.

ICA said it is “encouraging NTIA to focus on ensuring that price caps have some relation to both the cost of operating the .com registry and a reasonable, if not healthy operating margin”, adding:

We believe that it in the absence of actual competitive market forces determining price, it is crucial that an economic study be conducted to determine what a reasonable price would be for .com registrations, having regard to the costs of operating the .com registry on behalf of ICANN while also taking into consideration the need to make a reasonable profit from the exclusive license. As a trade association focused on Internet commerce, although we are generally uncomfortable with determining prices by any method other than via a competitive marketplace, this method is the next best thing in the circumstances.

The statement completely ignores Verisign’s attempt to preemptively flip the debate on its opponents when it recently claimed that the true price gouging occurs in the “unregulated” retail and secondary markets.

The .com pricing debate first came back into the public sphere in July, when three campaign groups called on NTIA to cancel the Cooperative Agreement and allow the .com registry contract to be open for competitive bidding.

The agreement, terms of which routinely make their way into ICANN’s Registry Agreement with Verisign, allow the company to raise prices 7% in four of each six-year term, options Verisign habitually exercises.

The result is a .com registry that generates the company operating margins in excess of 60%, returning mountains of cash to investors.

Three Republican lawmakers then raised the issue with NTIA and NTIA later said that it intended to renew the Cooperative Agreement, but that it had invited Verisign to talks focused on pricing.

In apparently coordinated statements, both parties said the talks would also extend to pricing in the retail channel and secondary market, which should have made ICA members nervous.

Verisign even put out a lengthy statement calling out registrars and domain investors for selling .com domains at hugely inflated prices, conveniently ignoring the facts that the registrar market is genuinely competitive and that domainers shoulder the risk that the domains they pay annual rent to Verisign for very probably will not ever sell.

Verisign’s arguments are sufficiently flawed that it’s perhaps surprising on the face of it that ICA’s new statement completely fails to address or challenge them.

The fact that Verisign is prepared to throw its most dedicated customers under the bus without too much fear of retaliation — something it does every time .com pricing comes up for debate — is perhaps indicative of its market power.

It’s the only dealer in town, and it knows it can say whatever it wants about the crackheads who frequent its corner.

Unstoppable reveals gTLD bid doomed to fail

It’s finally happened. Somebody has announced an application for a new gTLD that will almost certainly fall foul of ICANN’s rules and be rejected.

The would-be applicant is Farmsent, a United Arab Emirates startup that is building a blockchain-based marketplace for farmers and buyers of farm produce, and its domains partner is Unstoppable Domains.

Unstoppable said last week that the two companies are launching .farms domains on Unstoppable’s alternative naming system, and that an ICANN application for a proper gTLD is in the works.

The company said it “will be collaborating with Farmsent to plan and strategize for the next ICANN gTLD application, further solidifying .farms in the wider domain ecosystem”.

The problem is that .farms will likely be banned under the rules set out in ICANN’s Applicant Guidebook for the next round, unless the current draft recommendations are completely rewritten or rejected.

ICANN is to be told to reject applications for the plural and singular variants of existing gTLDs in the next round, and .farms is of course the plural of .farm, which is one of the few hundred names in Identity Digital’s stable.

The draft recommendations would merely require for ICANN to be informed that an applied-for string is a single or plural variant of an existing gTLD in the same language and check in a dictionary to confirm that is indeed the case.

In the case of .farm and .farms, I doubt the dictionary verification would realistically even be needed — though I’d bet checking that box would be at least one billable hour for somebody — as it’s a pretty clear-cut case of a bannable clash.

The ICANN staff/community working group drafting the recommendations has spent a huge amount of time arguing about the language of the plurals rule. It’s a surprisingly tricky problem, especially when ICANN is terrified of being seen as a content regulator.

RDRS usage stabilizing?

Usage of ICANN’s experimental Registration Data Request Service may have hit what might in future pass for normal levels, with not a massive amount of fluctuation across several key statistics for the last few months.

But ICANN’s latest monthly stats report, published late last week, shows that July was the worst month so far in terms of closed Whois data disclosure requests, dipping into double digits for the first time since its launch in late 2023.

There were 164 disclosure request in July, down from 169 in June but up on May’s low point of 154. The mix of requester types tilted towards IP owners — 40% versus a lifetime average of 33% — while law enforcement was down.

Only 97 requests were closed during the period, a third consecutive all-time low down from 134 in June and 140 in May. Approved requests were at 22.72% while denied requests were at 65.79%, a slight improvement in terms of the approved/denied mix compared to June.

It took a bit longer to get a request approved in July — 9.3 days on average versus 6.59 in June and a lifetime average of 7.19 days. The median time-to-approval since launch is still two days.

Getting a request denied took about half as long in the period — 10.7 days versus 19.46 in June. The median value is also still two days.

Two new, smaller registrars — one Chinese, one Moroccan — joined the project, and none quit, leading to a total of 92. Registrar coverage remained at 59% of registered gTLD domains.

The number of RDRS queries for domains held at unsupported registrars was down at 27.86% compared to a lifetime average of 29.7% but up against June’s 23.31%.