Two legit registrars held to account for lack of abuse tracking

ICANN Compliance’s campaign against registrars that fail to respond to abuse reports continued last week, with two registrars hit with breach notices.
The registrars in question are Above.com and Astutium, neither of which one would instinctively bundle in to the “rogue registrar” category.
Both companies have been told they’ve breached section 3.18.1 of their Registrar Accreditation Agreement, which says: “Registrar shall take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.”
Specifics were not given, but it seems that people filed abuse reports with the registrars then complained to ICANN when they did not get the response they wanted. ICANN then was unable to get the registrars to show evidence that they had responded.
Both companies have until February 12 to come back into compliance or risk losing their accreditations.
Domain investor-focused Above.com had over 150,000 gTLD domains on its books at the last official count. UK-based Astutium has fewer than 5,000 (though it says the current number, presumably including ccTLD names, is 53,350).
It’s becoming increasingly clear that registrars under the 2013 RAA are going to be held to account by ICANN to the somewhat vague requirements of 3.18.1, and that logging communications with abuse reports is now a must.

New ccTLDs may have to block name collisions

ICANN is thinking about expanding its controversial policy on name collisions from new gTLDs to new ccTLDs.
The country code Names Supporting Organization has been put on notice (pdf) that ICANN’s board of directors plans to pass a resolution on the matter shortly.
The resolution would call on the ccNSO to “undertake a study to understand the implications of name collisions associated with the launch of new ccTLDs” including internationalized domain name ccTLDs, and would “recommend” that ccTLD managers implement the same risk mitigation plan as new gTLDs.
Because ICANN does not contract with ccTLDs, a recommendation and polite pressure is about as far as it can go.
Name collisions are domains in currently undelegated TLDs that nevertheless receive DNS root traffic. In some cases, that may be because the TLDs are in use on internal networks, raising the potential of data leakage or breakages if the TLDs are then delegated.
ICANN contracts require new gTLDs to block such names or wildcard their zones for 90 days after launch.
Some new gTLD registry executives have mockingly pointed to the name collisions issue whenever a new ccTLD has been delegated over the last year or so, asking why, if collisions are so important, the mitigation plan does not apply to ccTLDs.
If the intent was to persuade ICANN that the collisions management framework was unnecessary, the opposite result has been achieved.

Jeff Neuman quits Neustar for Valideus

Neustar’s top domain name guy is moving to UK new gTLD consultancy Valideus.
Jeff Neuman, who’s been with Neustar for over 15 years, will become Valideus’ senior vice president for North America, starting this coming Monday, according to Valideus managing director Nick Wood.
I don’t know who’s replacing him at Neustar, where he’s been in charge of the company’s domain name business for the last couple of years, overseeing the company’s business as a registry back-end provider and registry for New York’s .nyc new gTLD.
Neuman was previously Neustar’s longstanding VP of policy, a role which also saw him heavily involved in ICANN’s GNSO Council and Neustar’s application for and launch of .biz, back in 2000.
He’s been quite a pivotal and sometimes outspoken figure over the years.
Valideus is the new gTLD service provider sister company to Com Laude, the brand-focused registrar. It provides application consulting and ongoing registry/registrar management for dot-brand gTLD applicants and registries, Amazon among them.
I gather that Neuman will remain based in the US, as his new job title implies.

.gay is gay enough after all? ICANN overturns community panel decision

One of the applicants for .gay has won a significant battle in the fight for the controversial new gTLD.
In a shock move, a committee of ICANN’s board of directors has overturned the rejection of dotgay LLC’s Community Priority Evaluation, ordering that the case should be re-examined by a new panel of experts.
As you may recall, dotgay’s CPE was kicked out in October after the Economist Intelligence Unit panel decided that the company’s defined community was too broad to be described by “gay” as it included a lot of people who aren’t gay, such as straight people.
The decision — which I thought was probably correct — caused an uproar from dotgay’s myriad supporters, which include dozens of international equal rights and gay community organizations.
dotgay filed a Request for Reconsideration, ICANN’s cheapest but least reliable form of appeal, and today found out it actually won.
ICANN’s Board Governance Committee, which handles the RfR process, this week ruled (pdf):

The BGC concludes that, upon investigation of Requester’s claims, the CPE Panel inadvertently failed to verify 54 letters of support for the Application and that this failure contradicts an established procedure. The BGC further concludes that the CPE Panel’s failure to comply with this established CPE procedure warrants reconsideration. Accordingly, the BGC determines that the CPE Panel Report shall be set aside, and that the EIU shall identify two different evaluators to perform a new CPE for the Application

The successful RfR appears to be based on a technicality, and may have no lasting impact on the .gay contention set.
Under the EIU’s process rules: “With few exceptions, verification emails are sent to every entity that has sent a letter(s) of support or opposition to validate their identity and authority”.
It seems that the EIU was sent a bundle of 54 letters of support for dotgay, but did not email the senders to verify they were legit. The BCG wrote:

Over the course of investigating the claims made in Request 14-44, ICANN learned that the CPE Panel inadvertently did not verify 54 of the letters of support it reviewed. All 54 letters were sent by the Requester in one correspondence bundle, and they are publicly posted on ICANN’s correspondence page.36 The 54 letters were deemed to be relevant by the EIU, but the EIU inadvertently failed to verify them.

If an applicant wins a CPE it means all the other applicants are automatically excluded, and the door is now open for the EIU to rethink its earlier decision.
So do competing applicants Rightside, Minds + Machines and Top Level Design now have genuine cause for concern? Not necessarily.
CPE applicants need to score at least 14 out of 16 available points in order to win, and dotgay only scored 10 points in its original evaluation.
Crucially, the EIU panel said that because the “community” as defined by dotgay included transgender, intersex, asexual and straight “allies” of equal rights, it was too broad to score any of the available four points on the “Nexus” criteria.
The BCG could find no fault with the EIU’s determination on Nexus, so even if dotgay’s letters of support are verified according to procedure, it would not necessarily lead to dotgay picking up any more Nexus points.
The BCG wrote on Nexus: “Requester’s substantive disagreement with the CPE Panel’s conclusion does not support reconsideration”.
However, given that the EIU is going to do the entire CPE all over again with new panelists, it seems entirely possible that dotgay could win this time.

NCC buys Open Registry for up to $22.6m — a gTLD registry now owns part of the TMCH

NCC Group has acquired registry back-end provider Open Registry in a deal that could be worth as much as £14.9 million ($22.6 million).
The deal means that NCC, which runs the new gTLD .trust via subsidiary Artemis Internet, now owns a back-end, a registrar and a piece of the Trademark Clearinghouse, in addition to its original core domain business of providing data escrow services to registries.
According to NCC, the acquisition is for a minimum of £7.9 million ($12 million), with the rest to be paid over three years if Open Registry meets performance targets.
Open Registry had revenue of €3.7 million ($4.3 million) in 2014, turning a profit of €15,000 ($17,300).
Its core business is as a back-end provider for new gTLD applicants. It has about 20 on its books, mostly European dot-brands and cities.
Part of the company’s business is CHIP, the Clearinghouse of Intellectual Property, which along with IBM and Deloitte runs the ICANN-sanctioned TMCH, which all new gTLD registries must use in their Sunrise and Trademark Claims launch periods.
It also owns a small registrar, Nexperteam, which has about 8,000 domains under management.
The Benelux company employs eight people.
Open Registry’s founding CEO Jean-Christophe Vignes joined Artemis as head of domain operations in 2013.

ICANN audit claims two more registrar scalps

Two tiny registrars — WebZero and Black Ice Domains — have had their registrar accreditations terminated for a failure to respond to a routine ICANN audit.
Israel-based Black Ice had just a couple thousands gTLD domains under management; US-based WebZero had fewer than 100.
Both registrars stood accused of not providing documents to ICANN in response to an audit, per their Registrar Accreditation Agreements.
ICANN will now look for a registrar or registrars to take over these registrars’ domains.

A quarter of registrar’s names are “illicit pharmacies”

One in four of the domain names registered with the registrar NetLynx are linked to current, past or potential future rogue drug sites, according to online pharmacy monitor LegitScript.
The Mumbai-based registrar was hit with a breach notice by ICANN Compliance last week, over an alleged failure to investigate an abuse complaint about a single customer domain, tnawsol24h.com.
NetLynx did not adequately respond to ICANN’s calls from November 26 to January 5, according to the notice (pdf).
While ICANN did not identify the source or nature of the complaint, according to LegitScript it was filed by the UK Medicines and Healthcare products Regulatory Agency and it claimed that the domain was being used as a “rogue internet pharmacy”.
LegitScript did some research into NetLynx’s domains under management and now claims that it is not an isolated case.
Company president John Horton blogged:

at least a quarter of the registrar’s business is dependent on rogue Internet pharmacy registrations, with roughly 3,000 of the 12,000 domain names under the registrar’s portfolio taggable as current, past or “holding sites” for illicit online pharmacies.

Horton clarified for DI that the 3,000 number is extrapolated from the fact that LegitScript managed to categorize 1,820 out of the 7,000 NetLynx domains it could find as problematic.
Of those, 820 were “online and active” rogue pharmacies, he said. He gave canadian-drug-pharmacy.com, pills-delivery.net and pillsforlife.net as examples.
Another 780 were hosting rogue pharmacies in the past but have since been shut down, he said.
Finally, LegitScript categorized 220 as “meeting known patterns” for “holding sites” where illicit pharmacies may be launched in future. Horton said:

many of the spam pharma organizations use “holding domain names” (not all are online at any one time), so if the website was NOT currently online, we looked to a variety of data — known domain name patterns, screenshots, known rogue name servers, known rogue IP addresses, etc. — to determine the likelihood that a domain name is likely to be a rogue Internet pharmacy, and gave NetLynx the benefit of the doubt if there was any lack of certainty

LegitScript classifies online pharmacies as “rogue” if they offer to ship medicines without a prescription to people in jurisdictions where prescriptions are required.
Horton is now calling for ICANN to look into terminating NetLynx’s accreditation.

.top says Facebook shakedown was just a typo

Jiangsu Bangning Science & Technology, the .top registry, is blaming a typo for a Facebook executive’s claim that it wanted $30,000 or more for facebook.top.
Information provided to the ICANN GNSO Council by Facebook domain manager Susan Kawaguchi yesterday showed that .top wanted RMB 180,000 (currently $29,000) for a trademarked name that previously had been blocked due to ICANN’s name collisions policy.
But Mason Zhang, manager of the registry’s overseas channel division, told DI today that the price is actually RMB 18,000 ($2,900):

We were shocked when seeing that our register price for TMCH protected names like Facebook during Exclusive Registration Period is changed from “eighteen thousand” into what is written, the “one hundred and eighty thousand”.
I think that might be a type mistake from our side, and we checked and we are certain that the price is CNY EIGHTEEN THOUSAND.

The 18,000-yuan sunrise fee is published on the registry’s official web site, as I noted yesterday.
The registry email sent to Facebook is reproduced in this PDF.
I wondered yesterday whether a breakdown in communication may to be blame. Perhaps I was correct.
While $3,000 is still rather high for a defensive registration, it doesn’t stink of extortion quite as badly as $30,000.
Still, it’s moderately good news for Facebook and any other company worried they were going to have to shell out record-breaking prices to defensively register their brands.

Here’s how the new number two new gTLD got so big so quick

Attentive DI readers will recall my journalistic meltdown last week, when I tried to figure out how the Chinese new gTLD .网址 managed to hit #2 in the new gTLD zone file size league table, apparently shifting a quarter of a million names in a week.
Well, after conversations with well-placed sources here at NamesCon in Las Vegas this week, I’ve figured it out.
.网址 is the Chinese for “.url”.
Its rapid growth — hitting 352,000 names today — can be attributed primarily to two factors.
First, these weren’t regular sales. The registry, Knet, which acquired original applicant Hu Yi last year, operates a keyword-based navigation system in China that predates Chinese-script gTLDs.
The company has simply grandfathered its keyword customers into .网址, I’m told.
The keyword system allows Latin-script domains too, which explains the large number of western brands that appear in the .网址 zone.
The second reason for the huge bump is the fact that many of the domains are essentially duplicates.
Chinese script has “traditional” and “simplified” characters, and in many cases domains in .网址 are simply the traditional equivalents of the simplified versions.
I understand that these duplicates may account for something like 30% of the zone file.
I’ve been unable to figure out definitively why the .网址 Whois database appeared to be so borked.
As I noted last week, every domain in the .网址 space had a Knet email address listed in its registrant, admin and technical contact fields.
It seems that Knet was substituting the original email addresses with its own when Whois queries were made over port 43, rather than via its own web site.
Its own Whois site (which doesn’t work for me) returned the genuine email addresses, but third-party Whois services such as DomainTools and ICANN returned the bogus data.
Whether Knet did this by accident or design, I don’t know, but it would have almost certainly have been a violation of its contractual commitments under its ICANN Registry Agreement.
However, as of today, third-party Whois tools are now returning the genuine Whois records, so whatever the reason was, it appears to be no longer an issue.

The new massive number two new gTLD has me paralyzed with confusion

The Chinese-script gTLD .网址 powered to the number two spot in the new gTLD rankings by zone file size this week, but it’s doing some things very strangely.
.网址 is Chinese for “.site”, “.url” or “.webaddress”.
The registry is Hu Yi Global, ostensibly a Hong Kong-based registrar but, judging by IANA’s records, actually part of its Beijing-based back-end Knet.
I’m going to come out and admit it: even after a few hours research I still don’t know a heck of a lot about these guys. The language barrier has got me, and the data is just weird.
These are the things I can tell you:

• .网址 has 352,727 domains in its zone file today, up by about a quarter of a million names since the start of the week.
• The names all seem to be using knet.cn name servers
• I don’t think any of them resolve on the web. I tried loads and couldn’t find so much as a parking page. Google is only aware of about eight resolving .网址 pages.
• They all seem to have been registered via the same Chinese registrar, which goes by the name of ZDNS (also providing DNS for the TLD itself).
• They all seem to be registered with “nameinfo@knet.com” in the email address field for the registrant, admin and technical contacts in Whois, even when the registrants are different.
• That’s even true for dozens of famous trademarks I checked — whether it’s the Bank of China or Alexander McQueen, they’re all using nameinfo@knet.cn as their email address.
• I’ve been unable to find a Whois record with a completed Registrant Organization field.
• Nobody seems to be selling these things. ZDNS (officially Internet Domain Name System Beijing Engineering Research Center) is apparently the only registrar to sell any so far and its web site doesn’t say a damn thing about .网址. The registry’s official nic.网址 site doesn’t even have any information about how to buy one either.
• ZDNS hasn’t sold a single domain in any other gTLD.
• News reports in China, linked to from the registry’s web site, boast about how .网址 is the biggest IDN TLD out there.

So what’s going on here? Are we looking at a Chinese .xyz? A bunch of registry-reserved names? A seriously borked Whois?
Don’t expect any answers from DI today on this one. I’ve been staring at Chinese characters for hours and my brain is addled.
I give up. You tell me.