This company had every reason to want a dot-brand, but just killed it off

The latest dot-brand to terminate its new gTLD registry contract with ICANN could have been a case study in why dot-brands are a good idea.

Dabur India is 137 years old and makes over a billion dollars a year selling consumer goods — mainly cosmetics and personal care products, but also shady-looking Ayurvedic alternative medicines and supplements — in its home country and beyond, and it had experimented with using its .dabur gTLD over the last six years.

But it’s no longer interested, telling ICANN recently that it wants its Registry Agreement torn up, which ICANN has agreed to.

That’s despite the fact that Dabur appears to be suffering from exactly the kind of problem that dot-brands were supposed to help mitigate.

If you visit its web site at dabur.com today, you’ll be immediately presented with a very prominent pop-up warning you about scammers exploiting the Dabur trademark to grift money out of people who think they’re signing up to be official distributors.

The notice is lengthy but in part reads:

DABUR is only dealing with trade through www.dabur.com and any person claiming themselves to be taking order for the supply of DABUR products via phone/online may be cheating with you. DABUR shall not be responsible for any order placed other than on our official website www.dabur.com

One of the biggest selling points for the dot-brand concept is that customers can be taught to distrust any solicitation purporting to be legit if it does not originate from a domain in the relevant dot-brand.

If the notice on dabur.com is any guide, turns out you can do the same thing with a .com domain.

Dabur had briefly experimented with its gTLD not long after it was delegated. Current zone files show half a dozen .dabur names, but only two seem to resolve or show up in search engines. One redirects to the .com site.

Ironically, the other is doctor.dabur, in which Dabur solicits doctors to sign up to push its Ayurvedic products. Ayurveda is a form of medical quackery popular in South Asia.

Added to the recent self-termination of QVC’s .qvc, the total number of dot-brands to lose their registry contracts is now 91.

Olympics: Australia preemptively blocking Brisbane 2032 regs

With the venue for the 2032 Olympic Games revealed as Brisbane, Australia last week, the .au registry this week asked people to stop trying to register Olympics-related domains, because they won’t work.

Local ccTLD registry overseer auDA said in a blog post that it’s seen a spike in attempts to register domains containing the string “olympics” and variants since the announcement was made a week ago.

But these strings are on auDA’s reserved list, which cannot be registered even as substrings without government permission. Only the Australian Olympic Committee is allowed to register such domains.

According to auDA, the protected strings are: olympic, olympics, olympicgames, olympiad and olympiads.

It’s a more comprehensive approach to protecting Olympic “trademarks” (for want of a better word) than that employed by ICANN in its gTLD registry contracts, where the various Olympic and Red Cross/Crescent organizations are among a privileged few to enjoy unique protections.

ICANN only requires registries to block the exact-match string from registration, while auDA will block substrings also.

auDA says the domain “BrissiOlympics.com.au” would be blocked. It would not in any ICANN gTLD.

Domainers at risk as EnCirca takes over deadbeat registrar’s customer base

Customers of defunct registrar Pheenix risk losing their domains because the company was not properly escrowing its registrant data, according to the registrar taking over their domains.

EnCirca, which is taking over up to 6,000 domains previously registered with Pheenix, says the registrar’s shoddy escrow practices mean some of these domains may not be reunited with their rightful owners.

Pheenix “failed to properly escrow domain ownership information for many of the domains utilizing WHOIS proxy services”, EnCirca recently wrote, adding:

We anticipate that many domains will remain unclaimed due to bounced emails or inoperable proxy services. Locating rightful owners will be problematic since the data escrow is often devoid of any identifying ownership information.

To try to mitigate the problem, EnCirca is offering affected registrants the chance to prove ownership by filling out a form and uploading other evidence, such as Pheenix receipts or bank statements.

EnCirca added that because Pheenix disappeared still owing money to registries, the registries may be forcing renewal or restore fees that will then be passed on registrants.

If your domains were at or near expiration, restoring them could be complex and pricey or impossible.

If you’re affected, you can find information here.

Most or all Pheenix customers are likely to be domain investors. It was a drop-catcher, which once had over 500 dummy registrars in its expansive dropnet, most of which it subsequently de-accredited.

But it went AWOL last May, not responding to ICANN or paying its dues, apparently disappearing from the face of the Earth.

ICANN terminated its accreditation in May this year, and initiated a bulk transfer to EnCirca a couple weeks ago (which it only disclosed this week).

EnCirca has experience handling this kind of problem, which is presumably why ICANN gifted it the bulk transfer. In 2018 it took on the domains 49 of Pheenix’s shell registrars, which it says were suffering from the same escrow problems.

Another new gTLD applicant lawyers up on ICANN

Another rejected new gTLD applicant has filed an Independent Review Process complaint against ICANN, claiming the org failed to follow proper procedures on fairness and transparency.

And I think it’s got a pretty good chance of winning.

A Bahrain company called GCCXI has filed the IRP, eight years after its application for .gcc was thrown out by ICANN on the vague advice of its Governmental Advisory Community.

.gcc is for Gulf Cooperation Council, the short-hand English name for the Cooperation Council for the Arab States of the Persian Gulf, a proto-union of six states on the east coast of the Arabian peninsula.

The applicant’s problem is that it’s not affiliated with, nor supported by, the GCC or its member states.

The GAC, in its controversial Beijing communique of April 2013 objected to GCCXI’s application in the same breath and under the same power as it objected to DotConnectAfrica’s .africa bid.

Back then, the GAC was much more secretive than it is today, and did not have to provide a rationale for its advice. Its powers to object to gTLD applications pretty much amounted to a veto.

ICANN dutifully followed the GAC’s advice, throwing out the .gcc application later that year.

The applicant has evidently been trying to get ICANN to change its mind, using the Request for Reconsideration and then Cooperative Engagement Processes, since early 2014. That CEP concluded in May, and GCCXI filed for IRP in June.

Why did the CEP — a form of arbitration designed to avoid expensive IRP complaints and lawsuits — take so long and ultimately fail?

Don’t look to the IRP complaint published by ICANN (pdf) for answers — it’s redacted the whole ruddy lot, a few pages of text, without explanation.

That’s ironic given that a lack of transparency is one of GCCXI’s beefs against the org, along with an alleged failure to follow its bylaws on neutrality and fairness.

ICANN has ignored all of its carefully developed and documented policies, and instead has kowtowed to unspecified government concerns — devising a secret process to kill Claimant’s investment and opportunity, and completely disregarding the public interest in delegating the TLD for use.

The continued fight for a gTLD it surely has no hope of ever operating is a ballsy move by the applicant.

It’s roughly equivalent to some random European company applying to run .eu to represent the geographic region of EU member states without the consent of the EU institutions themselves and then complaining when it’s told to take a walk.

But that doesn’t necessarily mean it will lose the IRP. In fact, I think it has a pretty good chance of winning.

GCCXI does not deserve to prove it should be given .gcc, it only needs to show that ICANN broke its own bylaws.

DotConnectAfrica, which was rejected by the GAC and then ICANN for pretty much the same unsubstantiated reasons — the GAC “veto” — won its IRP in 2015, with the panel finding that ICANN accepted the GAC’s unexplained advice without even rudimentary due diligence, violating its commitment to fairness.

It was particularly embarrassing for the GAC, whose then-chair admitted that the committee deliberately kept its advice vague and open to interpretation

While .africa is not exactly the same as .gcc (the former is officially a geographic string, the latter is not), GCCXI had DCA had their applications rejected based on the exact same piece of GAC advice.

It’s also similar to Amazon’s IRP fight for .amazon, which it won. That bid was also kicked out as a result of ICANN’s adoption of opaque GAC advice from the Beijing communique.

You’ve got to think GCCXI has a decent shot at a victory here, though if recent IRPs and general ICANN foot-dragging on accountability are any guide we won’t know for a couple years.

Facebook’s war on privacy claims first registrar scalp

China’s oldest accredited registrar says it will shut up shop permanently next week after being sued into the ground by Facebook, apparently the first victim of the social media giant’s war against Whois privacy.

Facebook sued OnlineNIC in 2019 alleging widespread cybersquatting of its brands. The complaint cited 20 domains containing the Facebook or Instagram trademarks and asserted that the registrar, and not a customer, was the true registrant.

The complaint named ID Shield, apparently OnlineNIC’s Hong Kong-based Whois privacy service, as a defendant and was amended in March this year to add as a defendant 35.cn, another registrar that Facebook says is an alter ego of OnlineNic.

The amended complaint listed an addition 15 squatted domains, for 35 in total.

This week, OnlineNIC director Carrie Yu (aka Carrie Arden aka Yu Hongxia), told the court:

Defendants do not have the financial resources to continue to defend the instant litigation, and accordingly no longer intend to mount a defense. Defendants do not intend to file any oppositions to any pending filing… Subject to any requirements of ICANN, Defendants intend to cease business operations on July 26, 2021.

But Facebook reckons the registrar is about to do a runner to avoid paying almost $75,000 in court fees already incurred and avoid the jurisdiction of the California court where the case is being heard.

Facebook had asked for $3.5 million in penalties in a proposed judgment and OnlineNIC had not opposed.

While it presents itself as American, it appears that OnlineNIC is little more than a shell in the US.

Its official headquarters are little more than a lock-up garage surrounded by builders’ merchants in a grim, windowless facility just off the interstate near Oakland, California.

Its true base appears to be a business park in Xiamen, China, where 35.cn/35.com operates. The company has boasted in the past of being China’s first and oldest ICANN-accredited registrar, getting its foot in the door when the floodgates opened in 1999.

Facebook is now asking the court for a temporary restraining order freezing the defendants’ financial and domain assets, and for a domain broker to be appointed to liquidate its domain portfolio.

If you’re a legit OnlineNIC customer, you might be about to find yourself in a world of hurt.

OnlineNIC had just over 624,000 gTLD domains under management at the last count. 35.cn had another 200,000.

The lawsuit is one of three Facebook is currently fighting against registrars, one prong of its strategy to pressure the ICANN community to open up Whois records rendered private by EU law and consequent ICANN policy.

OnlineNIC is the low-hanging fruit of the trio and the first to be sued. It already faced cybersquatting cases filed by Verizon, Yahoo and Microsoft in 2009. The Verizon case came with a $33 million judgment.

Facebook has also sued the rather less shady registrars Namecheap and Web.com (now Newfold Digital) on similar grounds.

Nope, no Seattle meeting for ICANN

ICANN’s planned public meeting in Seattle will have no face-to-face component, the board of directors decided yesterday.

In a resolution published last night, the board cited the global vaccine inequity and the ongoing difficulties with international travel and visas during the coronavirus pandemic.

But it added that it plans to go ahead with a hybrid online/in-person meeting for ICANN 73 in San Juan, Puerto Rico next March “if it is feasible to do so”.

The board noted that its last in-person AGM, held in late 2019, saw 68% of its participants come from outside the US, suggesting Seattle would go ahead with a majority of its community members absent.

It added that “it is likely that ICANN72 could be a meeting of in-person attendees from just a couple of regions, which does not serve global participants in ICANN’s multistakeholder model”

While some of the pandemic-related issues may be resolved by October, ICANN had to make the call now to avoid wasting money on a physical meeting it may have had to later cancel.

The results of the board vote have not yet been published. A similar resolution last year saw some directors vote in favor of a return to face-to-face meetings by October 2020.

The resolution states that ICANN org should use the next eight months to ensure the hybrid model planned for San Juan is as effective as possible for those who will still be unable or unwilling to attend in person due to the pandemic.

It adds that smaller regional meetings, where travel restrictions are less irrelevant, could still go ahead this year.

A recent poll showed a majority of community members from all regions were keen to return to in-person meetings for Seattle, but the majority was greater in North America than elsewhere.

A group of participants from the Asia-Pacific region recently wrote to ICANN to state that it was likely that nobody from that region would be able to show up in Seattle.

ICANN 72 will be the sixth consecutive public meeting to be held virtually.

.org domains could come in seven new languages

Public Interest Registry is planning support for seven more languages in the .org gTLD.

The company has asked ICANN for permission to support seven additional internationalized domain name scripts: Croatian, Finnish, Hindi, Italian, Montenegrin, Portuguese, and Japanese.

Five of these languages use the Latin script also used in English, but have special accents or diacritics that require IDN tables to support in the DNS.

PIR submitted the request via the Registry Services Evaluation Process, where it is currently being reviewed by ICANN. Such RSEPs are usually approved without controversy.

MMX gets nod to sell 22 gTLDs to GoDaddy

New gTLD registry MMX expects to shortly offload most of its portfolio of strings to GoDaddy Registry after receiving ICANN approvals.

The company said today that its transfer requests for four of its gTLD contracts have received full ICANN approval.

Another 18 have received conditional ICANN approval, and MMX believes it has met these unspecified conditions.

Another five of its stable that are not fully owned and operated still require the nod from its partners.

MMX said in April that it planned to sell its entire portfolio to GoDaddy, after which it is expected the company will be wound down.

The company did not break down which transfer have received full approval, conditional approval, or are still waiting for approval.

It gTLDs are: .cooking, .fishing, .horse, .miami, .rodeo, .vodka, .beer, .luxe, .surf, .nrw, .work, .budapest, .casa, .abogado, .wedding, .yoga, .fashion, .garden, .fit, .vip, .dds, .xxx, .porn, .adult, .sex, .boston, .london and .bayern.

Panel hands .sucks squatter a WIN, but encourages action against the registry

A UDRP panel has denied a complaint against .sucks cybersquatter Honey Salt on a technicality, but suggested that aggrieved trademark holders instead sic their lawyers at the .sucks registry itself.

The three-person World Intellectual Property Organization panel threw out a complaint about six domains — covestro.sucks, lundbeck.sucks, rockwool.sucks, rockfon.sucks, grodan.sucks, tedbaker.sucks, tedbaker-london.sucks, and tedbakerlondon.sucks — filed jointly by four separate and unrelated companies.

The domains were part of the same operation, in which Turks & Caicos-based Honey Salt registers trademarks as .sucks domains and points them at Everything.sucks, a wiki-style site filled with content scraped from third-party sites.

Honey Salt has lost over a dozen UDRP cases since Everything.sucks emerged last year.

But the WIPO panel dismissed the latest case without even considering the merits, due to the fact that the four complainants had consolidated their grievances into a single complaint in an apparent attempt at a “class action”.

The decision reads:

although the Complainants may have established that the Respondent has engaged in similar conduct as to the individual Complainants, which has broadly-speaking affected their legal rights in a similar fashion, the Complainants do not appear to have any apparent connection between the Complainants. Rather it appears that a number of what can only realistically be described as separate parties have filed a single claim (in the nature of a purported class-action) against the Respondent, arising from similar conduct. As the Panel sees it, the Policy does not support such class actions

The panel decided that to force the respondent to file a common response to these complaints would be unfair, even if it is on the face of it up to no good.

Making a slippery-slope argument, the panel suggested that to allow class actions might open up the possibility of mass UDRP complaints against, for example, domain parking companies.

So the case was tossed without the merits being formally considered (though the panel certainly seemed sympathetic to the complainants).

But the sting in the tale comes at the end: the panel allowed that the complainants may re-file separate complaints, but also suggested they invoke the Trademark Post Delegation Dispute Resolution Procedure.

That’s interesting because the Trademark PDDRP, an ICANN policy administered by WIPO and others, is a way to complain about the behavior of the registry, not the registrant.

It’s basically UDRP for registries.

The registry for .sucks domains is Vox Populi, part of the Momentous group of companies. It’s denied a connection to Honey Salt, which uses Vox sister company Rebel for its registrations.

According to ICANN: “The Trademark PDDRP generally addresses a Registry Operator’s complicity in trademark infringement on the first or second level of a New gTLD.”

Complainants under the policy much show by “clear and convincing evidence” that the registry operator or its affiliates are either doing the cybersquatting themselves or encouraging others to do so.

There’s no hiding behind shell companies in tax havens — the policy accounts for that.

The trick here would be to prove that Honey Salt is connected to Vox Pop or the Momentous group.

Nothing is known about the ownership of Honey Salt, though Whois records and UDRP decisions identify a person, quite possibly a bogus name, as one “Pat Honeysalt”, who has no digital fingerprint to speak of.

The most compelling piece of evidence linking Honey Salt to Vox is gleaned by following the money.

The current business model is for Everything.sucks to offer Honey Salt’s domains for “free” by publishing transfer authorization codes right there on the squatted domain.

But anyone attempting to claim these names will still have to pay a registrar — such as Rebel — a transfer/registration fee that could be in excess of $2,000, most or all of which flows through to Vox Pop.

If we ignore the mark-up charged by non-Rebel registrars, the only party that appears to be profiting from Honey Salt’s activities appears to be the .sucks registry itself, in other words.

On its web site, Everything.sucks says it’s a non-profit and makes the implausible claim that it’s just a big fan of .sucks domains. Apparently it’s a fan to the extent that it’s prepared to spend millions registering the names and giving them away for free.

An earlier Everything.sucks model saw the domains listed at cost price on secondary market web sites.

The Trademark PDDRP, which appears to be tailor-made for this kind of scenario, has not to my knowledge been used to date. Neither WIPO nor ICANN have ever published any decisions delivered under it.

It costs complainants as much as $30,500 for a three-person panel with WIPO and has a mandatory 30-day period during which the would-be complainant has to attempt to resolve the issue privately with the registry.

The six domains in the UDRP case appear to have all gone into early “pending delete” status since the decision was delivered and do not resolve.

Will you use SSAD for Whois queries?

ICANN is pinging the community for feedback on proposed Whois reforms that would change how people request access to private registrant data.

The fundamental question is: given everything you know about the proposed System for Standardized Access and Disclosure (SSAD), how likely are you to actually use it?

The SSAD idea was dreamed up by a community working group as the key component of ICANN’s response to privacy laws such as GDPR, and was then approved by the Generic Names Supporting Organization.

But it’s been criticized for not going far enough to grant Whois access to the likes of trademark lawyers, law enforcement and security researchers. Some have called it a glorified ticketing system that will cost far more than the value it provides.

Before the policy is approved by ICANN’s board, it’s going through a new procedure called the ODP, for Operational Design Phase, in which ICANN staff, in coordination with the community, attempt to figure out whether SSAD would be cost-effective, or even implementable.

The questionnaire released today will be an input to the ODP. ICANN says it “will play a critical role in assessing the feasibility and associated risks, costs, and resources required in the potential deployment of SSAD.”

There’s only eight questions, and they mostly relate to the volume of private data requests submitted currently, how often SSAD is expected to be used, and what the barriers to use would be.

ICANN said it’s asking similar questions of registries and registrars directly.

There’s a clear incentive here for the IP and security factions within ICANN to low-ball the amount of usage they reckon SSAD will get, whether that’s their true belief or not, if they want ICANN to strangle the system in its crib.

It’s perhaps noteworthy that the potential user groups the questionnaire identifies do not include domain investors nor the media, both of which have perfectly non-nefarious reasons for wanting greater access to Whois data. This is likely because these communities were not represented on the SSAD working group.

You can find the questionnaire over here. You have until July 22.