Single-letter .com lawsuit thrown out of court

A domainer trying to lay claim to all remaining unregistered single-character .com and .net domain names has had his lawsuit against ICANN thrown out of court for a third time.

Bryan Tallman of VerandaGlobal.com (dba First Place Internet) reckons he is owed the rights to domains such as 1.com and a.net because he registered the matching second-level domains in the non-Latin versions of both gTLDs.

His original lawsuit, filed two years ago, stated that he paid Verisign, via registrar CSC Global, $25,285 for 1.닷넷 on the understanding that this would give him exclusive rights to 1.com and 1.net, which would be worth many millions of dollars.

.닷넷 is Verisign’s transliteration of .net in the Hangul script. Tallman registered dozens of other single-character Latin domains in internationalized domain name .com/.net transliterated gTLDs, thinking he could later get the .com/.net equivalents.

His argument was pretty flimsy, based primarily not on ICANN policy but on an ambiguously worded letter from Verisign to ICANN.

The first complaint was rejected by the Los Angeles Superior Court in March 2024. Tallman amended his complaint, but this was also thrown out this January. Tallman plodded on, regardless, with a third amended complaint.

This time, the judge has run out of patience. Last month, he threw out the lawsuit entirely, with no leave to amend, saying Tallman did not have standing to sue as he had failed to show that he had any contractual relationship with ICANN at all.

With a few grandfathered exceptions such as x.com, owned by Elon Musk, all single-character .com and .net domain names have been reserved from reservation since the 1990s for stability reasons that are probably no longer particularly applicable.

A move by Verisign to experimentally auction o.com to a motivated buyer fizzled out a few years ago, likely indirectly due to the likely buyer’s relationship to a sexy Russian spy.

Three applicants qualify for cheapo gTLDs

Three organizations have been given ICANN’s approval to apply for new gTLDs next year at a deeply discounted rate.

All three are non-profit or nongovernmental organizations, ICANN said. Two come from the Asia-Pacific region and one comes from Europe.

The identities of the applicants have not and will not be disclosed — to publish their names would likely tip the applicants’ hands in terms of what strings they intend to apply for, inviting competition.

The Applicant Support Program offers non-profit entities worldwide or small businesses in non-developed nations a discount of 75% to 85% on the base $227,000 application fee, along with a selection of other benefits.

As of today, there are 45 active applications, ICANN said. Seven come from Africa, 14 from Asia-Pac, five from Europe, two from Latin America, and 12 from North America. Another five haven’t said where they’re based yet.

According to July 23 stats, only five applications — three of which presumably have now been approved — had been fully submitted and were in review.

In the 2012 round, there were only three ASP applications and only one, from the company that now runs .kids, was successful in obtaining the discount.

The window for ASP applications closes in November.

Blockchain crisis looming for new gTLD next round

New gTLD applicants could face more of a threat from blockchain-based alternative naming systems next year than perhaps they first thought.

ICANN is coming under pressure to give additional rights to the owners of top-level strings that act like TLDs on blockchains, potentially adding friction — and six figures of extra costs — to applications for matching strings.

In the recently closed public comment period on the current draft Applicant Guidebook, two blockchain naming firms focused on the risk posed from name collisions should a gTLD get delegated that matches a blockchain TLD.

More importantly, ICANN’s influential Security and Stability Advisory Committee expressed the same views.

Alexander Urbelis, general counsel and CISO of Ethereum Name Service, said in his comments that many operators of alt-TLDs will apply for their DNS matches in next year’s application round, adding:

ICANN should consider that a new gTLD, for which an identical string already exists in an alternative name space, should be considered a compromised asset, and that delegating such gTLDs may subject ICANN, and applicants, to substantial liability. In addition to the technical issues posed by name collision, such delegations could also result in consumer confusion, difficulties with resolving queries (particularly as access to alternative names is increasingly integrated into mainstream web browsers), security risks, and broken authentication systems

Shifting gears, Urbelis then goes on to espouse the exactly opposite view to what you might expect from an operator of a blockchain naming system:

We urge ICANN to ensure that operators of strings in alternative names spaces are not given preferential treatment in the upcoming new gTLD application round, either deliberately or inadvertently. Such operators should not be rewarded for choosing to operate outside of ICANN governance and policies, particularly when the results of such preferential treatment could be so devastating for the stability of the DNS, as well as consumer trust in the new gTLD program and the DNS itself.

However, he concludes that alt-TLDs should be considered during the application process, specifically when ICANN’s evaluators conduct the String Similarity Evaluation.

we note that the string similarity evaluation does not appear to account for strings that may exist in alternative name spaces that are not under ICANN governance. Given the proliferation of such strings and alternative name spaces in recent years, ICANN should not ignore their existence by considering string similarity within only the ICANN-governed DNS, particularly due to the technical issues outlined above in connection with name collision.

Currently, this evaluation stage only looks at similarity to existing TLDs, some strings blocked by policy, and other applied-for strings.

If Urbelis’ advice were taken on board, an application for .clown, for example, could find itself ruled similar to alt-TLD .down, which is on the Handshake naming system and available at some registrars.

ENS runs .eth as a blockchain TLD. While the company claims over 1.6 million names registered there, .eth can never make it to the consensus DNS because ETH is the protected three-letter code for Ethiopia and therefore blocked by a Guidebook policy that is pretty much locked-in.

Unstoppable Domains, which markets dozens of alt-TLDs, focused on name collisions in its brief comment to ICANN, seeking extra clarity in how the collision assessors will decide whether a string is “high risk”.

The current AGB says evaluators will look at both quantitative data — measurements of traffic for non-existent TLDs to the root servers for example — and unspecified “qualitative” factors. Unstoppable’s head of operations Michael Campagnolo wrote:

If ICANN wants to help applicants to assess their risk pre-application submission, examples and sources of qualitative evidence should be described and made available to applicants prior to, and in a reasonable amount of time before the opening of the application window, similar to the quantitative information.

The subtext here, it appears, is that Unstoppable wants to know if non-DNS qualitative factors, such as the existence of an alt-TLD matching an applied-for string, will be taken into account.

That’s a good question, and as the AGB currently stands it appears to be up to the Technical Review Team that will conduct the name collision evaluation on each application.

The Name Collision Analysis Project working group, which came up with most of the current name collision rules, seemed to have mostly ignored alt-TLDs in its work due to difficulty and timing.

Unstoppable points out that applicants with strings deemed at high risk of collisions could incur extra fees of $100,000 to $150,000, on top of the $227,000 standard application fee, so the extra clarity on the rules could avoid applicants having to reach deeper into their pockets.

While ICANN is adept at ignoring or merely paying lip service to self-serving public comments filed by commercial entities, it is bound by its bylaws to take the advice of its Advisory Committees seriously.

Comments filed by the 17-member SSAC will carry more weight, and SSAC is warning that collisions between DNS and non-DNS naming systems could raise security risks, promote instability, and create user confusion.

SSAC’s SAC130 (pdf) — formal Advisory Committee advice — makes four recommendations related to name collisions. One is:

The AGB should explicitly state that the TRT is allowed to include evaluating potential collisions with known, widely used alternative naming systems and other external sources, as these can create foreseeable security and stability risks for DNS users.

If ICANN adopts the SSAC recommendations, it seems the TRT will be encumbered with the heavy burden of figuring out how, when and why an alt-TLD and an applied-for gTLD create risks so unacceptable that the applied-for string should be blocked.

Another question that has been raised in recent weeks is whether alt-TLD operators should be able to use mechanisms such as Community Priority Evaluation and Community Objection to secure their TLDs or disrupt other applications.

Could Unstoppable, for example, claim that its cohort of .wallet alt-TLD registrants constitute a protected “community” and thus get a priority approval?

The company could certainly try, but experts in the policy-making community and ICANN staff seem to think the point-based CPE mechanism is designed in such a way to make such a claim incredibly difficult to back up.

ICANN will consider all of the public comments over the coming weeks and months before making changes, if any, to the AGB.

There are hundreds of thousands of alt-TLDs out there — over 6,000 are even carried by a handful of ICANN-accredited registrars — but it’s not clear how many are actually used.

With that in mind, should ICANN offer additional protections to blockchain-based alt-TLDs, many new gTLD applicants would face the very real risk of additional friction and huge extra costs.

ICANN looking at new bulk reg rules

ICANN seems set to start creating more rules governing DNS abuse, including limits on bulk registrations and more tracking of registrants.

A small team of GNSO volunteers have put together a list (pdf) of dozens of proposed policy change areas, covering everything from registrant data accuracy to pricing to API access to getting ICANN Compliance to be more proactive.

While most of the ideas in the team’s analysis received a broad range of views, it settles on three areas, all related to bulk registration of abusive domains, that it thinks are ripest for further policy work.

The first is “Associated Domain Checks”. The small team think it’s worth looking into whether registrars should have to investigate proactively domains registered by known abusive registrants.

The group also thinks it’s worth looking into better industry information-sharing about domain generation algorithms, which bad actors use to create vast numbers of gibberish names that can be used in spam runs, phishing attacks, or botnets.

Finally, the group thinks rules around API access to registrar platforms should be looked at, given that bulk-registered abusive domains often seem to use APIs to programmatically obtain thousands of throwaway domains in seconds.

The small team thinks a Policy Development Process looking at just these three issues could be completed relatively quickly and the community could address the remaining issues later.

Whether the recommendations go to a PDP is now up to the GNSO Council, which will vote on the matter this Thursday. Assuming the vote passes, which seems likely, ICANN staff would then have to prepare a formal Issue Report, setting out the scope of future work, if any.

A PDP would likely take years to complete.

The three priority topic areas reflect closely the Governmental Advisory Committee advice coming out of June’s ICANN 83 public meeting. Both small team and GAC heavily source ICANN’s INFERMAL research and a recent NetBeacon white paper as their inspirations.

Wine producers worried about new gTLDs

American vintners are worried that someone might steal their protected regional names in the next new gTLD round.

The Napa Valley Vintners has written to ICANN to “express strong opposition to the creation of any generic top-level domain
(gTLDs) that uses our distinctive name.”

The trade association asks that the names of wine-producing areas of the States be added to the Reserved Names List in the new gTLD program’s Applicant Guidebook.

That list currently is limited to the names of intergovernmental organizations, NGOs, and Red Cross/Crescent related entities.

The NVV points out that the names of wine-producing regions are protected by US law — you can’t say your wine comes from Napa unless it was in fact made there.

According to Wikipedia, there are 276 protected American Viticultural Areas in 34 states. More than half are in California.

Some of these names actually have a small degree of protection already, but only accidentally. The string “Napa” would be considered a protected geographic string until the current AGB rules, for example, but only if somebody wanted to run .napa as a city-gTLD.

The issue of protecting wine-related geographic indicators has come up at ICANN before. While it was processing the applications for .wine and .vin in 2014, there was a protracted bust-up in the Governmental Advisory Committee about whether they should go ahead.

Several European governments pressed ICANN to ban or delay .wine, now an Identity Digital gTLD, until promises were made about protecting names like “Champagne” and “Rioja” at the second level.

France in particular got very pissed off, but ultimately objections were dropped after the registry made some kind of deal with the wine-makers.

The NVV letter is cc’d to the federal government’s Alcohol and Tobacco Tax and Trade Bureau, presumably to send the message that the group is not messing about.

The letter (pdf) is addressed to “The Honorable Sally Costerton”, under the apparent assumption that she’s still ICANN’s acting CEO. That hasn’t been true for the last eight months. Also, as lovely as she is, I’m not sure she qualifies for that particular honorific.

Goodyear tires of its dot-brand

For the record, I’m not proud of that headline. It doesn’t even work in British English. But if I hadn’t done it, some of you would have complained, and I want you to be happy.

Rubber company Goodyear has become the latest new gTLD registry operator to tell ICANN to terminate a dot-brand.

In this case, it’s not the company’s primary, .goodyear, but rather .dunlop, the brand of one of its tire-making subsidiaries.

The company did not give ICANN a reason for the self-termination; the Dunlop brand appears to be alive and well.

Neither .goodyear nor .dunlop have any registered domains. Dunlop and Goodyear both use .eu and .com domains for their primary web sites.

ICANN’s “review of reviews” kicks off

The ICANN community has kicked off its “review of reviews”, a hopefully brief exercise in navel-gazing designed to free ICANN from even more navel-gazing over the longer term.

The seven supporting organizations and advisory committees have put forth a proposal, which ICANN’s top brass has accepted, for a Review of Reviews Cross Community Group (RoR CCG) that will seek to rescue ICANN from the quagmire of introspection into which it has sunk in recent years.

ICANN’s bylaws, written when the Org got divorced from the US government a decade ago, call for more than half a dozen reviews — of stuff like accountability, competition, security and Whois — most of which are on five-year cycles.

But the institutional lethargy that has consumed ICANN for the last decade, coupled with an already heavy volunteer workload, has meant that the reviews sometimes miss deadlines and still haven’t been fully implemented by the time the next cycle comes around.

The new CCG is being set up to see what can be done to terminate this vicious cycle. A charter document (pdf) sent to ICANN this week reads:

The purpose of the CCG is to manage a fundamental evaluation of the following reviews set out in the ICANN Bylaws, as a whole system, including their implementation, and propose a refreshed system of reviews.

Its timeline is ambitious. The group hopes to have some proposals ready to show the community by ICANN 86, less than a year from now. By ICANN standards that’s pretty much Ludicrous Speed.

The CCG will have a limited membership: two members from each SO and AC, two ICANN staffers and two members of the board for a total of 18. Anyone will be able to passively observe the mailing list and teleconferences.

The draft CCG charter has been accepted by ICANN chair Tripti Sinha. It’s expected that the group will hold public sessions this October in Dublin at ICANN 84.

Huge registrars flee from RDRS

Ten notable domain registrars have abandoned ICANN’s pilot Registration Data Request Service, substantially reducing its usefulness.

In June, 10 accredited registrars pulled their support for the voluntary service, which is designed to give law enforcement, IP owners, and security researchers an easier way to request unredacted Whois records.

Team Internet is out, taking with it its registrars 1API, Internet BS, Key-Systems GmbH, Key-Systems LLC, Moniker, RegistryGate and TLD Registrar Solutions.

Newfold Digital exited with Network Solutions, Register․com, and PublicDomainRegistry․com.

The sum of all this is that there are now 78 participating registrars, compared to 88 at the end of May, and they now only represent 47% of all registered gTLD domains, down from 54%.

That’s the lowest level of participation since RDRS launched in late November 2023 and the first time it’s dropped below half of all registered gTLD domains.

Usage of RDRS has dropped to a whole new low. There were only 68 requests for Whois records in June, down from the previous low of 91 in March.

Perhaps counter-intuitively, the number of searches that resulted in “Registrar Not Supported” errors remained static at 16%, tying for the lowest ratio across the entire pilot to date.

ICANN’s Governmental Advisory Committee recently said it wants ICANN to consider making RDRS mandatory for all registrars.

Aug 7 Correction: this article originally erroneously stated that Corporation Service Company had removed one registrar and added another. In fact, the registrar in question had simply changed its name. I apologise for the error.

Namecheap loses attempt to bring back .org price caps

ICANN seems to have won a big victory in its ongoing tussle with Namecheap over price caps for .org and .info domains.

A California court ruled late last week that it cannot force ICANN into pricing talks with the registries for the two gTLDs, denying a motion that Namecheap filed back in April.

The dispute dates back to 2019, when ICANN removed price caps from Public Interest Registry’s .org registry contract, which had limited PIR to 10% annual increases.

Namecheap used ICANN’s own Independent Review Process accountability mechanism to challenge this decision and won, kinda, in 2022.

The IRP panel found ICANN had breached its bylaws and issued “recommendations” such as commissioning an economic report into price caps, deciding if price caps should return, and if so then talking to the registries about bringing them back.

When there’d been little action by early 2024, Namecheap sued to get the backing of the court for the IRP decision. It was successful, with the court ruling this February that the IRP findings were valid.

In the meantime, ICANN had obtained its economist’s report and passed a resolution stating that it should not bring price caps back to the two registry contracts.

But Namecheap had a final crack at getting the court to force ICANN into price cap. In a motion this April, it asked the court to instruct ICANN to “approach the registry operators for .ORG and .INFO to agree to some form of price control”.

The court didn’t buy its arguments, however, last week denying Namecheap’s requests on the grounds that ICANN had in fact considered the IRP panel’s recommendations:

Namecheap provides evidence that ICANN in fact did consider the Panel’s recommendations, and thus Plaintiff admits that ICANN did not reject any of the Panel’s findings, so as correctly stated by ICANN, “there is nothing for this Court to enforce.”

In the six years since the price caps were lifted, non-profit PIR has not raised .org prices, while for-profit Identity Digital has raised .info prices every year, from $10.84 in 2019 to $19 today.

Registrar shamed for alleged crypto abuse neglect

ICANN has given a warning to Malaysian registrar WebNic, claiming that it has turned a blind eye to abuse reports in breach of new Registrar Accreditation Agreement rules.

ICANN Compliance says the company, a subsidiary of Kuala Lumpur-based Qinetics, failed to take action to resolve abuse reports made against several domains it manages.

Online reports and databases suggest the names in question were used in phishing attacks attempting to steal cryptocurrency wallet credentials.

Compliance said it “has observed a concerning pattern regarding DNS Abuse mitigation”, saying WebNic continually drags its feet on responding to abuse reports, often only taking action after ICANN gets involved.

The breach notice adds:

The Registrar frequently issued repeated requests for evidence to abuse reporters – even when the original reports appeared actionable – and failed to fully consider information or clarifications provided by the abuse reporter, ICANN or otherwise reasonably accessible to the Registrar. In other cases, the Registrar requested evidence from the abuse reporters that did not appear to be relevant to the reported activity, causing additional delays.

WebNic is not a young, fly-by-night registrar. It’s been around a quarter century and has over 800,000 domains under management just in the gTLDs. Its parent also offers registry back-end services.

The company has until August 19 to make Compliance happy or risk termination proceedings.