Dropping domains might get more expensive at Donuts

Donuts is planning to change the way its registry handles dropping domains and may charge additional fees for access.

According to a service request filed with ICANN, Donuts wants to migrate its hundreds of gTLDs to the “Dropzone” system originally deployed by Afilias, which the company acquired at the end of 2020.

Instead of domains separately dropping according to their expiry time, Dropzone sees them pooled together into daily batches for a more orderly release.

Registrars are still awarded dropping domains on a first-come, first-served basis, according to when they submit their EPP create requests to the Dropzone environment, according to Donuts.

Donuts reckons this system will allow it to better manage traffic load on its registry. Presumably, registrars won’t need to send so many creates, as the drop time is synchronized for all deleting domains.

It also thinks the process will help level the playing field for registrars trying to register expired domains.

But the ICANN request (pdf) also suggests that, unlike Afilias, it might add additional fees for registrars to access Dropzone:

In addition to the standard or premium registration prices of a given domain name, The Dropzone service can support additional application fees to be configured on a per TLD basis. Applications fees where applicable will be charged in addition to the standard registration price of a domain name.

Such charges would presumably be passed on to registrants.

Afilias’ original request for Dropzone approval stated that the fee to catch a drop would be the same as a standard registration fee.

Registrars will have to reconfigure their systems to use Dropzone, which exists on a separate host.

Afilias’ 21 gTLDs have been using Dropzone since ICANN approved the service last year.

.sucks registry probably “connected” to mass cybersquatter, panel rules

Vox Populi, the .sucks registry, is probably affiliated with and financially benefiting from a mass cybersquatter, a panel of domain experts has said.

In the UDRP case of Euromaster v Honey Salt, a three-person panel handed the complainant the domain euromaster.sucks, ruling that it was a case of cybersquatting.

It’s one of 21 .sucks UDRP complaints filed against Honey Salt, a Turks & Caicos company operating under unknown ownership believed to own hundreds or thousands of brand-match .sucks domains.

It’s lost 17 of the 19 so-far decided cases. It also won one case on a technicality and another early case on the merits after mounting a free-speech defense that subsequent panels have not bought.

What’s new about this one is that the WIPO panel — Lawrence Nodine, Douglas Isenberg and Stephanie Hartung — is the first to follow the money and openly infer a connection between Honey Salt and Vox Pop.

The panel said that it “infer[s] that the Respondent [Honey Salt] and Registry [Vox Pop] are connected”, and that Vox is probably trying to make money by charging trademark owners premium fees for their own brands.

Vox Pop has previously denied such a connection, when I first made the same inference last October.

Regular readers will recall that Honey Salt has registered hundreds of .sucks domains and pointed them to a wiki-style web site called Everything.sucks, ostensibly run by a third-party, US-based non-profit.

Rather than containing original “gripe” content, which could easily enable it to win a free-speech UDRP defense, Everything.sucks simply populates its site with poor-quality, context-free content scraped by bots from social media and third-party web sites such as TrustPilot and GlassDoor.

Originally, each page carried a banner linking to a secondary market page at Uniregistry or Sedo where the domains could be purchased, often at cost price.

That quickly disappeared when the first UDRP cases started rolling in, and earlier this year Everything.sucks said on each page that it refused to sell its domains to anyone, instead offering a free transfer.

It even published the pre-authorized transfer codes on each page, meaning literally anyone could seize control of the domain in question without asking permission from or negotiating with Honey Salt in advance.

The problem with that is that transfers are not free. Some domains are flagged as premium — including lots of brand-matches — and have transfer fees in the thousands of dollars. Even the cheapest still carry the base registry fee.

Many registrars steer well clear of this model, disallowing any .sucks transfers.

One registrar that reliably does allow .sucks transfers is Rebel, which is sister company to Vox Pop under the Momentous group of companies. It offers .sucks domains at the registry wholesale fee, which is $200 for an non-premium.

It’s been painfully obvious since the outset that the only parties that stand to make a profit on the Everything.sucks business model are the registry and its affiliated companies — it simply doesn’t make sense that Honey Salt would invest hundreds of thousands of dollars in trademark-infringing domains, simply to hand them over at cost.

But the Euromaster panel is the first to infer the connection, or at least the first to publicly infer the connection.

Euromaster had filed a supplemental document in its complaint pointing out that the “free” transfer of euromaster.sucks would in fact cost a “premium” fee of $2418.79. The registrar quoting that fee is not revealed.

The WIPO panel asked Honey Salt for an explanation and it sounds like it got a bunch of procedural waffle in response.

This led to the following discussion, to which I’ve added some emphasis:

The Panel also finds that Respondent [Honey Salt] has failed to show that it has no financial interest in the Disputed Domain Name. Complainant’s Supplemental submissions demonstrate that Complainant’s chosen registrar quoted a fee of USD 2418.79 to transfer the Disputed Domain Name. Complainant’s report is consistent with M and M Direct Limited v. Pat Honey Salt, Honey Salt Limited, WIPO Case No. D2020-2545, where a different panel conducted an independent investigation and reported that the domain name at issue in that case was not offered “free” as promised, but instead that registrars classified the domain names at issue as “premium” and quoted transfer fees of USD 3,198 and USD 4,270 respectively.

This directly contradicts any claim to be offering a free and noncommercial service, and given that any registration would result in a fee being paid to the Registry by a registrar, leads the Panel to infer that the Respondent [Honey Salt] and Registry [Vox Pop] are connected.

Given the prior decision in M and M Direct, and the evidence that Complainant’s Supplemental submissions, the Panel afforded Respondent an opportunity to submit additional argument and evidence to explain the inconsistency. Respondent made no effort to do so, but instead only opposed consideration of Complainant’s supplemental evidence and repeated its previous contentions. The Panel rejects the objections to Complainant’s Supplemental submission, and emphasizes that Respondent was given an opportunity fully to respond.

The Panel finds that Complainant’s evidence raises substantial questions about the credibility of Respondent’s assertion that it has no financial interest in the Disputed Domain Name and whether Respondent’s offer to transfer the Disputed Domain might, directly or indirectly, financially benefit Respondent. Accordingly, the Panel finds that Respondent has not carried its burden to show that its use is noncommercial

In other words, the panel suspects that Vox Pop is in on Honey Salt’s bulk-cybersquatting game.

The closest any other UDRP panel has come to making this link was in a recent case filed by multiple, unrelated trademark owners, where the panel, while denying the complaint on procedural grounds, suggested that aggrieved trademark owners instead invoke ICANN’s Trademark Post Delegation Dispute Resolution Procedure.

The Trademark PDDRP is a mechanism — so far unused and untested — that allows trademark owners to allege registry complicity in cybersquatting schemes. Think of it like UDRP for cybersquatting registries.

Frankly, I’m amazed it hasn’t been used yet.

As Kabul falls, Whois could present a danger to ordinary Afghans

With Afghanistan falling to the Taliban this week, there’s potential danger to .af registrants — both in terms of losing domain services and of Whois being used for possibly deadly reprisals.

At time of writing, it’s been four days since the fall of Kabul. The uneasy truce between NATO and Taliban forces has failed to prevent scenes of chaos at the city’s main airport and the PR machine of so-called “Taliban 2.0” is in full bluster.

The new Taliban is, its spokespeople suggest, more tolerant of western liberal values and more supportive of human rights than its brutal, pre-9/11 incarnation.

Few believe this spin, and there have been multiple reports of 1990s-style oppression, including revenge killings and the suppression of women’s rights, across the country.

With all that in mind, a blog post about .af domain names may seem trivial, but it’s not my intention to trivialize.

I’m as appalled as any right-minded observer by the situation on the ground in Afghanistan and the neglect that led to it. But I believe .af could prove a learning moment in the ongoing conversation about Whois privacy.

The .af ccTLD has been managed since not long after the US-led invasion by the country’s Ministry of Communications and IT as the Afghanistan Network Information Center.

The registry had previously been managed for free from London by NetNames, with an admin contact in Kabul, according to the report of the 2003 IANA redelegation, which happened at a time when Afghanistan was still under a transitional government heavily overseen by the foreign governments behind the invasion.

Domain policy for .af was created in 2002, and it includes provisions for an open, freely available Whois database that is still in effect today.

Domains registered via overseas registrars appear to be benefiting from the impact of the EU’s General Data Protection Regulation, which redacts personal information, but this obviously does not apply in Afghanistan.

This means the names, addresses, phone numbers and email addresses of .af registrants are available for querying via various Whois interfaces, including the registry’s own, which is managed by New Zealand-based back-end CoCCA.

Using a combination of web searches and Whois queries, it is possible to find personally identifiable information of registrants, including names and addresses, at local human rights groups, as well as local news media and technology providers supportive of human rights causes.

If the reports of Taliban fighters conducting house-to-house searches for enemies of the new state are accurate, the easy availability of this personal data could be a serious problem.

To a great extent, this could be a case study in what privacy advocates within the ICANN community are always warning about — public access to Whois data gives oppressive regimes a tool to target their oppression.

And as we have seen this week, oppressive regimes can appear almost literally overnight.

While it seems unlikely there’s anyone from the old Afghan ministry still in control of the registry, I think .af back-end provider CoCCA, as well as Whois aggregators such as DomainTools, should have a long think about whether it’s a good idea to continue to provide open access to .af Whois records at this time.

Fortunately, there doesn’t appear to be a great many .af domains under management. DomainTools reckons it’s under 7,000.

At the other end of the scale of seriousness, overseas .af registrants may also see issues with their names due to the Taliban takeover.

It seems incredible today, but in 2001 a Taliban decree restricted internet access to a single computer at a government ministry. Others in government could apply to use this computer by sending a fax to the relevant minister.

While it seems impossible that such a Draconian restriction could be reintroduced today, it still seems likely that the Taliban will crack down on internet usage to an extent, including introducing morality or residency restrictions to .af regs.

.af is currently open to registrants from anywhere in the world, with no complex restrictions and .com-competitive prices.

Many multinational corporations have registered .af names for their local presence.

The string “af” has in recent years become social media shorthand for “as fuck”, and a small number overseas registrants appear to be using it as a domain hack in that context — type “corrupt.af” into your browser and see what happens.

Others seem to be using .af, where short domains are still available, as shortcuts to their social media profiles.

I don’t believe ICANN will need to get directly involved in this situation. Its Whois query tool does not support .af, and IANA presumably won’t need to get involved in terms of redelegation any more than it would following a general election or a coup d’état.

ICANN director picks for 2021 revealed

ICANN’s Nominating Committee has revealed its three picks for the organization’s board of directors, with one member been swapped out for a newcomer.

Lito Ibarra will be replaced by Edmon Chung, while Danko Jevtović and Tripti Sinha see their seats kept safe for their respective second three-year terms.

Ibarra works for El Salvador’s .sv top-level domain registry and represented the Latin America region on the board. By the time the handover occurs in October, he will have served two of his possible three-year terms.

He’s being replaced by Chung, a long-time industry and ICANN participant perhaps best known as the CEO of DotAsia, which runs .asia. As you might expect, he represents the Asia-Pacific region.

While the appointments clearly alter the regional mix somewhat, they equally clearly do nothing to tilt the gender balance on the male-heavy board, which ICANN has stated is a desirable goal for NomCom.

NomCom also revealed its picks for two members of the GNSO Council, one member of the ccNSO Council and three members of the At-Large Advisory Committee, which include some familiar names.

NomCom said it had 116 applications in total, over half of which came from Africa and Asia-Pac.

For the first time since 2006, ICANN did not disclose the gender mix of the applicants. It’s not clear why.

The full list of successful applicants can be found here.

Over 2,000 attendees for ICANN 73?

Puerto Rico is expecting as many as 2,100 people to show up to ICANN’s public meeting there next year, according to a local report.

A local business publication, NimB, cites Pablo Rodríguez of NIC.pr as saying ICANN 73 could have about 2,100 attendees, bringing as much as $8 million to $10 million to the San Juan economy.

My first thought was that the dollar figure seemed high — it works out to about $5,000 per head — until I realized that most attendees are funded by either ICANN or their company credit cards, and not everyone is as frugal as yours truly.

But then I realized that 2,100 is by far the more surprising number.

Consider that it’s by no means assured that there will be an in-person component to the meeting at all. ICANN is certainly planning for one, but like everyone else the Org is subject to the whims of a microscopic glob of goo.

The plan is for a “hybrid”, a mix of face-to-face and Zoom, with some recognition that there are some parts of the world that will show up with extremely light delegations.

Consider also that the last time ICANN met in San Juan in March, just a couple years ago, the grand total was 1,564 people, 37% of whom hailed from outside the Americas.

With that in mind, 2,100 seems like an incredibly ambitious prediction.

ICANN spills beans on Marby’s million-dollar payday

ICANN appears to have increased its transparency when it comes to executive pay, at least when it comes to the CEO.

Göran Marby was revealed earlier this year to have banked more than $1 million in ICANN’s fiscal 2020, and he received another 5% boost at a board meeting this February.

Six months later, the board of directors has finally approved the minutes of that meeting, and for the first time it actually minutes the meeting, revealing the contents of the discussion and the names of the three dissenting directors.

In the past, minutes of decisions involving pay typically just restate the resolution and rationale with no additional context. They don’t usually even reveal the vote tally.

According to the minutes, there was some debate about the method used to determine how much Marby should be paid.

ICANN’s longstanding policy has to offer executive pay within the “50% and 75% percentile of comparable position salaries” in the general for-profit industries, high-tech industry, and non-profits.

What often bothers ICANN watchers, and bothered some directors in February, is how these three comparable industries are mixed and weighted when figuring out how much an ICANN employee is worth.

If high-tech is given more weight, that would pull in the direction of a higher salary. If non-profits were weighted more, that would pull in the opposite direction.

According to the minutes, Avri Doria raised this issue in February, suggesting that non-profit salaries should be more influential in the mix, when future CEOs are selected.

Chair Maarten Botterman said in the minutes that the blend of comparisons doesn’t really matter all that much because Marby’s compensation is “well below” the percentile threshold ICANN has set itself, regardless of the mix.

The discussion continued:

Nigel Roberts noted that looking at sectors other than non-profit is important because while ICANN might not be a big commercial company, it is certainly in competition with those companies for executive leadership candidates and that he believes ICANN needs to compensate well because of that. Becky Burr similarly noted that it is important to understand from where ICANN is drawing its leadership so that the compensation can be competitive, while also acknowledging that the compensation level under discussion is below the target range.

The problem with these arguments is that Marby was not hired from any of the three sectors ICANN uses for comparison.

While he has a background in tech, he was a telecoms regulator on a government salary in Sweden when he applied for the ICANN gig. He’s being paid more than his predecessors who did come directly from high-tech.

The minutes go on to note that director Ihab Osman pointed out that Marby gets paid more than the secretary-general of the United Nations and the CEO of the American Red Cross.

He wondered aloud whether the skill set of an ICANN CEO is the same as a high-tech CEO, while director Mandla Msimang questioned whether ICANN’s revenue should play a factor in setting compensation.

Osman also noted the potentially poor optics of giving Marby a big pay rise in the midst of a pandemic.

When it came to a vote, Doria, Osman and Msimang all voted against the 5% pay increase, but the remaining 11 directors voted in favor. Marby and Ron Da Silva were not present for the discussion.

ICANN 73 will be “virtual first”

ICANN’s public meeting next March will prioritize online participation, according to chair Maarten Botterman.

Botterman told members of the APAC Space community group this week that ICANN 73 will have “a meaningful ‘virtual first’ hybrid format to support the community’s ongoing priorities, policy advice, and development work”.

APAC Space, you will recall, had written to ICANN to protest the possibility of this October’s ICANN 72 meeting moving to a hybrid model with an in-person component that most Asia-Pacific community members would not be able to take advantage of due to ongoing pandemic-related travel restrictions.

But the ICANN board, in part due to these concerns, decided to keep 72 online-only rather than showing up in Seattle in person, while stating an intention to go hybrid for 73 if “feasible”.

ICANN 73 is due to take place in Puerto Rico, part of the North America region, next March. As a US territory, the venue will be easier to attend for Americans.

Indeed, APAC Space is skeptical about its members ability to attend 73 in person also.

Botterman addressed this, saying:

We appreciate you have similar concerns about holding a hybrid meeting for ICANN73. At this time, relevant experts have a higher level of confidence that the global pandemic situation, in particular vaccination and infection rates, will be much improved by early 2022. While we will continue to closely monitor the situation, our intentions are to hold ICANN73 as a hybrid meeting with an in-person component if it is feasible to do so.

The five online-only meetings ICANN has held since the pandemic hit are generally regarded as being pretty good as far as Zoom meetings go, but there can be no replacement for the corridor conversations, cocktail events and private dinners that face-to-face meetings permit.

Even the ICANN board of directors is affected — due to the annual turnover, some members haven’t even met each other face-to-face in a board context.

Registrars to get more domain takedown powers

ICANN will soon grant its accredited registrars the ability to unilaterally take down domains involved in ongoing security incidents, according to chair Maarten Botterman.

Responding to the news that registries have come up with a voluntary framework for tackling botnets that auto-generate domain registrations for use in command and control activities, Botterman said ICANN will extend a process currently restricted to registries into the registrar community.

That policy is the Expedited Registry Security Request Process, which allows registries to quickly obtain a retroactive waiver of its contractual obligations — such as the obligation to pay ICANN fees — if it has to urgently respond to a major incident.

The process was invoked four times last year, covering six gTLDs and roughly 1,600 domains. ICANN granted all four requests, though it seems to have on average missed its target of responding within three business days.

“As part of ICANN’s efforts to support the mitigation of DNS security threats, ICANN org will soon enable registrars to also request such waivers,” Botterman recently told the Registries Stakeholder Group.

He was responding to the news that several registries have signed up to a voluntary “Framework on Domain Generating Algorithms (DGAs) Associated with Malware and Botnets”.

That framework would allow registries to preemptively register or block domains likely to be auto-generated by botnet code, thereby cutting the head off the snake before it can wreak more havoc.

MMX drops two registrars

MMX has dumped two registrar contracts with ICANN, as the company’s asset-sale to GoDaddy nears completion.

ICANN records show that Minds and Machines LLC and Minds and Machines Registrar UK Limited both entered “terminated” status over the last few days, meaning they’re no longer accredited to sell gTLD domains.

But they weren’t doing any selling of domains anyway. The UK company had 108 domains under management and the US on had none at the last count.

The US accreditation was the one used primarily by the company under its original business model of a “triple-play” registry/registrar/back-end, when it was still going by Minds + Machines, which was abandoned five years ago.

The registrar peaked at about 50,000 names, which were then transferred over to Uniregistry. The back-end business was also abandoned, with Nominet taking over technical management of most of its gTLDs.

MMX is currently in the process of getting out of its sole remaining third business, that of gTLD registry.

GoDaddy has already taken over most of its 27 gTLDs under a $120 million deal announced earlier this year. Four TLDs remain, and will be transferred subject to approval from government partners.

Dead dot-brands #92 and #93

Two more companies have withdrawn from the new gTLD space, asking ICANN to rip up their dot-brand contracts.

The Royal Melbourne Institute of Technology, an Australian university, has terminated its contract for .rmit, and SwiftCover, an American insurance company, has withdrawn .swiftcover.

SwiftCover next used its gTLD, according to zone file records. Not once.

RMIT had registered a small handful of domains under .rmit, and had been using at least one of them — which wasn’t even a redirect to the uni’s main .au site — as recently as February this year.

But by May the experiment was over, with RMIT filing its ICANN papers.

These are the 92nd and 93rd dot-brand termination notices to be published by ICANN.