.home gets half a billion hits a day. Could this put new gTLDs at risk?

New gTLDs could be in jeopardy following the results of a study into the security risks they may pose.
ICANN is likely to be told to put in place measures to mitigate the risk of new gTLDs causing problems, and chief security officer Jeff Moss said “deadlines will have to move” if global DNS resolution is put at risk.
His comments referred to the potential for clashes between applied-for new gTLD strings and non-existent TLDs that are nevertheless already widely used on internal networks.
That’s a problem that has been increasingly highlighted by Verisign in recent months. The difference here is that the study’s author does not have a .com monopoly to protect.
Interisle Consulting, which has been hired by ICANN to look into the problem, today released some of its preliminary findings during a session at the ICANN 47 meeting in Durban, South Africa.
The company looked at domain name look-up data collected from one of the DNS root servers over a 48-hour period, in an attempt to measure the potential scope of the clash problem.
Some of its findings are surprising:

• Of the 1,408 strings originally applied for in the current new gTLD round, only 14 do not currently have any root traffic.
• Three percent of all requests were for strings that have been applied for in the current round.
• A further 19% of requests were for strings that could potentially be applied for in future rounds (that is, the TLD was syntactically well-formed and not a banned string such as .local).
• .home, the most frequently requested invalid TLD, received over a billion queries over the 48-hour period. That’s compared to 8.5 billion for .com

Here’s a list of the top 17 invalid TLDs by traffic, taken from Interisle’s presentation (pdf) today.

If the list had been of the top 100 requested TLDs, 13 of them would have been strings that have been applied for in the current round, Interisle CEO Lyman Chapin said in the session.
Here’s the most-queried applied-for strings:

Chapin was quick to point out that big numbers do not necessarily equate to big security problems.
“Just occurrence doesn’t tell you a lot about whether that’s a good thing, a bad thing, a neutral thing, it just tells you how often the string appears,” he said.
“An event that occurs very frequently but has no negative side effects is one thing, an event that occurs very infrequently but has a really serious side effect, like a meteor strike — it’s always a product of those two factors that leads you to an assessment of risk,” he said.
For example, the reason .ice appears prominently on the list appears to be solely due to an electricity producer in Costa Rica, which “for some reason is blasting .ice requests out to the root”, Chapin said.
If the bad requests are only coming from a small number of sources, that’s a relatively simple problem to sort out — you just call up the guy responsible and tell him to sort out his network.
In cases like .home, where much of the traffic is believed to be coming from millions of residential DSL routers, that’s a much trickier problem.
The reverse is also true, however: a small number of requests doesn’t necessarily mean a low-impact risk.
There may be a relatively small number of requests for .hospital, for example, but if the impact is even a single life support machine blinking off… probably best not delegate that gTLD.
Chapin said that the full report, which ICANN said could be published in about two weeks, does contain data on the number of sources of requests for each invalid TLD. Today’s presentation did not, however.
As well as the source of the request, the second-level domains being requested is also an important factor, but it does not seem to have been addressed by this study.
For example, .home may be getting half a billion requests a day, but if all of those requests are for bthomehub.home — used today by the British ISP BT in its residential routers — the .home registry might be able to eliminate the risk of data leakage by simply giving BT that domain.
Likewise, while .hsbc appears on the list it’s actually been applied for by HSBC as a single-registrant gTLD, so the risk of delegating it to the DNS root may be minimal.
There was no data on second-level domains in today’s presentation and it does not appear that the full Interisle report contains it either. More study may be needed.
Donuts CEO Paul Stahura also took to the mic to asked Chapin whether he’d compared the invalid TLD requests to requests for invalid second-level domains in, say, .com. He had not.
One of Stahura’s arguments, which were expounded at length in the comment thread on this DI blog post, is that delegating TLDs with existing traffic is little different to allowing people to register .com domains with existing traffic.
So what are Interisle’s recommendations likely to be?
Judging by today’s presentation, the company is going to present a list of risk-mitigation options that are pretty similar to what Verisign has previously recommended.
For example, some strings could be permanently banned, or there could be a “trial run” — what Verisign called an “ephemeral delegation” — for each new gTLD to test for impact before full delegation.
It seems to me that if the second-level request data was available, more mitigation options would be opened up.
ICANN chief security officer Jeff Moss, who was on today’s panel, was asked what he would recommend to ICANN CEO Fadi Chehade today in light of the report’s conclusions.
“I am not going to recommend we do anything that has any substantial SSR impact,” said Moss. “If we find any show-stoppers, if we find anything that suggests impact for global DNS, we won’t do it. It’s not worth the risk.”
Without prompting, he addressed the risk of delay to the new gTLD program.
“People sometimes get hung up on the deadline, ‘How will you know before the deadline?’,” he said. “Well, deadlines can move. If there’s something we find that is a show-stopper, deadlines will have to move.”
The full report, expected to be published in two weeks, will be opened for public comment, ICANN confirmed.
Assuming the report is published on time and has a 30-day comment period, that brings us up to the beginning of September, coincidentally the same time ICANN expects the first new gTLD to be delegated.
ICANN certainly likes to play things close to the whistle.

Donuts chalks up another LRO win

Donuts has successfully fought off another Legal Rights Objection against one of its new gTLD applications.
This time the objector was The Limited, apparently the operator of a large chain of clothing stores in the US, and the applied-for gTLD was .limited, which is uncontested.
Key to the World Intellectual Property Organization panelist’s decision appears to be the fact that the brand and the trademark in question is “The Limited” rather than “Limited”.
The retailer failed to show that it was commonly known by the word “Limited” alone, whereas Donuts made the case that “limited” is a common generic word with multiple uses.
The panelist wrote:

The definite article “the” makes a difference in this case. If the string were <.thelimited>, Applicant’s professed plans for the String would be highly suspect. This is because limited liability businesses do not use the term “the limited” (or an abbreviation or derivation thereof) in their company name.
…
In the absence of the definite article “the” in the String, however, Applicant’s proposed use of the String is plausible and legitimate, and the likelihood of confusion between Objector’s mark and the String is greatly reduced. There is simply no viable evidence in the record to suggest that significant source confusion – among consumers or non-consumers who use the Internet – will ensue if Applicant carries out its plans.

It’s the sixth LRO to be decided and the sixth finding in favor of the new gTLD applicant.
Donuts also fought off an objection from another clothing retailer, Express, which it is fighting for the .express gTLD.

Trademark Clearinghouse cutting it fine for new gTLD launches

The Trademark+50 rights protection mechanism for new gTLDs is late, potentially complicating the lives of trademark professionals.
During a session with registries and registrars at ICANN 47 in Durban today, executives from IBM and Deloitte, which are managing the Trademark Clearinghouse, laid out their go-live expectations.
The TMCH is the central repository of trademark records that will support the mandatory Sunrise periods and Trademark Claims services during new gTLD launches.
Trademark+50 is the system approved by ICANN earlier this year that will also trigger Claims notices for up to 50 strings trademark owners have won at UDRP or in court.
IBM and Deloitte said that they hope to have a Sunrise sandbox ready for registry testing by the end of July, with a production environment live by August 9 and Claims following a month later.
These were hopes, not commitments, they stressed.
When asked about Trademark+50, an IBM representative acknowledged that it had to be ready before any new gTLD started its Claims period but said it is going to take “months” to implement.
“It’ll be in time, it’ll be before Claims start,” he said.
“It’s probably going to be difficult to reach before the middle of September,” another TMCH exec said. “We know it cannot be the week before Claims starts, it cannot be two weeks or three weeks before Claims starts.”
ICANN still hasn’t finalized its set of requirements for Trademark+50, but the TMCH executives said they hope to get that settled in Durban this week, possibly this evening.
So what’s going to be impact of the expected TMCH go-live schedule? It doesn’t seem likely to delay the launch of the first new gTLDs.
ICANN doesn’t expect the first Trademark Claims period to begin until November, which gives the first registries two months to test their systems against Trademark+50. Tight, but doable.
The real impact might be on trademark owners.
ICANN’s current earliest projection for a new gTLD being delegated is September 5. On that date, the first registry could choose to give trademark owners the 30-day mandatory Sunrise warning.
So the first Sunrise period would start October 5 or thereabouts.
That’s where it starts getting tricky.
See, the TMCH’s early bird pricing ends the day the first Sunrise period begins, so there’s certain to be a mad rush by trademark owners to get their trademarks registered in the first week of October.
Even if many brands aren’t too worried about being protected in the IDN gTLDs that will launch first, they’ll want to secure the discount if they have a large portfolio of trademarks.
And history has shown most trademark owners leave Sunrise registrations to the last minute. That’s why pretty much every Sunrise period to date has been extended — the registry can’t cope with the influx.
In the case of the TMCH, however, they’re also going to be battering a Trademark+50 system that’s been in production for no more than a couple of weeks and will, software being software, likely be full of bugs.
It could get messy.
“When IP owners find out that this is not going to be in production a week or two or a few weeks before the first [new gTLD] goes into Claims, they’re going to go ballistic,” Neustar VP Jeff Neuman said at the session today.
At the very least, it looks like trademark owners will have only a brief window to add their extra strings — which could amount to hundreds in many cases — to their TMCH records before the first Sunrise.
That scenario is mostly speculation, of course, based on a first delegation date that ICANN admits is “hypothetical” and the TMCH’s tentative schedule outlined today.
IBM and Deloitte execs are expected to provided a fuller explanation of the current state of play during a dedicated session in Durban on Wednesday at 11am local time.

100th new gTLD application withdrawn

Former London mayor Ken Livingstone, rejoice!
L’Oreal has withdrawn its gTLD application for .redken, a dot-brand for one of its hair care products that I am reliably informed is not named after the balding socialist politician.
It’s the seventh of the company’s 14 new gTLD bids to be withdrawn.
Also today, it emerged that portfolio applicant Famous Four Media has withdrawn its application for .health, the only one of the four bids for that string yet to pass Initial Evaluation.
The string is one of the most controversial, being the subject of multiple very expensive to defend objections as well as strong Governmental Advisory Committee advice.
As of today, 100 new gTLD applications have been withdrawn, 53 of which were for uncontested strings.

First new gTLD contracts signed

Donuts, an ARI Registry Services subsdiary and CORE this morning became the first new gTLD applicants to sign registry contracts with ICANN.
The ceremonial signing took place live on stage at the opening ceremony of ICANN 47, the week-long public meeting in Durban, South Africa.
ARI CEO Adrian Kinderis signed on behalf of شبكة. applicant International Domain Registry. The string is Arabic for “.web” and transliterates as “.shabaka”. It is 3 in the program’s evaluation queue.
In an ARI press release, Go Daddy CEO Blake Irving confirmed that Go Daddy will carry .shabaka.
Donuts CEO Paul Stahura signed for .游戏, the Chinese-language “.games”, which had prioritization number 40.
It was not immediately clear which contracts Iliya Bazlyankov, chair of CORE’s executive committee, signed. CORE has applied for three internationalized domain name gTLDs with high priority numbers.
(UPDATE: Bazlyankov has been in touch to say: “We signed the .сайт (site) and .онлайн (online) contracts which had numbers 6 and 9 in the priority”.)
Representatives of Go Daddy, MarkMonitor, Momentous, Mailclub and African registrar Kheweul.com also joined ICANN CEO Fadi Chehade on stage to sign the 2013 Registrar Accreditation Agreement.
The event marks the beginning of the contract signing phase of the new gTLD program, an important milestone.
For applicants without outstanding objections, contention or Governmental Advisory Committee advice, signing a contract means only pre-delegation testing and the final transition to delegation remains.

86 passes and two failures in this week’s new gTLDs

ICANN has just published this week’s batch of new gTLD Initial Evaluation results, revealing 86 passing scores and two applications that must go to Extended Evaluation.
The two failures are .ged and .bcg.
The .ged bid, which is intended to represent General Educational Development, was filed by a joint venture of the American Council on Education and the big publisher Pearson.
It’s the first example of an application to receive passing scores on both its financial and technical questions but to still require Extended Evaluation anyway.
The applicant had proposed a registry service related to internationalized domain names that gave the evaluation panels reason to believe a deeper evaluation was needed.
Uniquely so far, Extended Evaluation is likely to cost this applicant more money, due to the cost of a Registry Services Evaluation Panel.
Boston Consulting Group applied for .bcg as a dot-brand and failed because it scored a zero on its “Financial Statements” question, as most other IE failures have to date.
This weeks passing scores belong to these applications:

.redstone .institute .website .airtel .bestbuy .education .charity .shouji .alstom .multichoice .reit .bible .holiday .deutschepost .chrysler .terra .cam .inc .farm .cars .florist .financial .bet .design .cafe .sale .lundbeck .latino .iveco .inc .dodge .security .global .food .tradershotels .design .bond .zappos .rwe .commbank .landrover .house .cars .blog .fish .amazon .adult .wine .group .property .free .living .maserati .beauty .amsterdam .foodnetwork .broker .design .sucks .fans .tushu .discount .glass .fashion .search .school .linde .off .office .miami .trust .red .boats .immo .repair .dstv .claims .iinet .soccer .inc .mail .toshiba .law .love .suzuki .africa

There are now 730 applications still in Initial Evaluation. So far 1,092 have passed and 13 have failed.

Afilias opens pre-regs on 30 new gTLDs

Afilias has started accepting expressions of interest on the 30 new gTLDs it has applied for.
A basic site launched today invites potential registrants to indicate which names they’d like to register in future and submit their email address for updates.
As usual, it’s free, no obligation, and provides more value to the registry than the registrant.
The strings covered are:

.移动 (info), .信息 (mobi), .DESI, .APP, .HEALTH, .LTD, .KIM, .BLUE, .PINK, .LOTTO, .MLS, .LGBT, .BLOG, .GREEN, .INC, .TEAM, .SHIKSHA, .MEMORIAL, .RADIO, .BET, .RED, .WINE, .LLC, .WEB, .ORGANIC, .MEET, .PET, .BLACK, .CASINO, .POKER, .VOTE, .VOTO

Many of these gTLDs are still contested and some haven’t yet passed Initial Evaluation, so the list may dwindle as time goes by.

Donuts beats dot-brand in fight over .express gTLD

Donuts has prevailed in the first big dust-up between a portfolio gTLD applicant and a dot-brand hopeful.
The World Intellectual Property Organization today published its decision (pdf) in the Legal Rights Objection filed by a clothing retailer called Express over the .express gTLD.
The ruling could have a big impact on future rounds of the new gTLD program, possibly giving rise to an influx of defensive, generic-word dot-brand applications.
Both Express and Donuts have applied for .express. They’re the only two applicants for the string.
Express runs about 600 stores in the US and elsewhere and has had a trademark on its name since 1979. Donuts, as with all of its 307 original applications, wants to run .express as an open gTLD.
Express argued in its LRO that a Donuts-run .express would severely damage its brand, saying:

Should applicants for new TLDs be able to operate unrestricted TLDs represented by generic words which are also extremely well known brands, billions of dollars of goodwill will be wiped out in a TLD heartbeat.

Donuts, in its response, pointed out that there are thousands of uses of the word “express” in trademarks and other contexts, and even produced a survey that it said showed only 8% of fashionistas even associate the word with the brand.
The WIPO panelist, after what appears to have been something of a crisis moment of wondering what the hell ICANN was thinking when it designed the LRO, sided with Donuts. He said:

The Panel ultimately decides that the trademark owner (Complainant) should not be able to prevent adoption by the applicant (Respondent) of the applied-for gTLD <.express> in the particular context presented here. While Complainant certainly owns rights in the EXPRESS trademark for use in connection with apparel and fashion accessories, and while that trademark is reasonably well known among a relevant segment of consumers in the United States, there are so many common usages of the term “express” that it is not reasonable to foreclose its use by Respondent as a gTLD.

He follows up with a few sentences that should give owners of dictionary-word trademarks reason to be worried.

The Panel recognizes that, should Respondent successfully secure the gTLD, Complainant may be required to address potential Internet user confusion in the commercial marketplace for its products based on the registration (or attempted registration) of certain second level domains. However, Complainant faces this risk because it adopted a common word in the English language for its trademark. Moreover, Complainant has applied for the identical <.express> string as a gTLD in competition with Respondent. Ultimately, the parties may well end up in an auction contest for the gTLD. This is not Complainant’s last chance to secure its trademark as a gTLD.

In other words, Express can either pay ICANN or Donuts a bunch of cash at auction to get its dot-brand, or it can let Donuts win and spend a bunch of cash on defensive registrations and UDRP/URS complaints. Not a great result for Express either way.
The panelist takes 10 pages of his 26-page decision to explain his deliberations, but it basically boils down to this: Express’ trademark is too generic to give the company exclusivity over the word.
It’s hard to disagree with his reasoning.
If subsequent LROs go the same way, and I suspect they will, then it will quickly become clear that the only way to guarantee nobody else gets your dictionary-word brand as a gTLD will be to apply for it yourself and fight it all the way to auction.

IAB gives dotless domains the thumbs down

The Internet Architecture Board believes dotless domain names would be “inherently harmful to Internet security.”
The IAB, the oversight committee which is to internet technical standards what ICANN is to domain names, weighed into the debate with an article apparently published yesterday.
In it, the committee states that over time dotless domains have evolved to be used only on local networks, rather than the internet, and that to start delegating them at the top level of the DNS would be dangerous:

most users entering single-label names want them to be resolved in a local context, and they do not expect a single name to refer to a TLD. The behavior is specified within a succession of standards track documents developed over several decades, and is now implemented by hundreds of millions of Internet hosts.
…
By attempting to change expected behavior, dotless domains introduce potential security vulnerabilities. These include causing traffic intended for local services to be directed onto the global Internet (and vice-versa), which can enable a number of attacks, including theft of credentials and cookies, cross-site scripting attacks, etc. As a result, the deployment of dotless domains has the potential to cause significant harm to the security of the Internet

The article also says (if I understand correctly) that it’s okay for browsers to interpret words entered into address bars without dots as local resources and/or search terms rather than domain names.
It’s pretty unequivocal that dotless domains would be Bad.
The article was written because there’s currently a lot of talk about new gTLD applicants — such as Google, Donuts and Uniregistry — asking ICANN to allow them to run their TLDs without dots.
There’s a ban in the Applicant Guidebook on the “apex A records” that would be required to make dotless TLDs work, but it’s been suggested that applicants could apply to have the ban lifted on a case by case basis.
More recently, ICANN’s Security and Stability Advisory Committee has stated almost as unequivocally as the IAB that dotless domains should not be allowed.
But for some reason ICANN recently commissioned a security company to look into the issue.
This seems to have made some people, such as the At Large Advisory Committee, worried that ICANN is looking for some wiggle room to give its new gTLD paymasters what they want.
Alternatively, ICANN may just be looking for a second opinion to wave in the faces of new gTLD registries when it tells them to take a hike. It was quite vague about its motives.
It’s not just a technical issue, of course. Dotless TLDs would shake up the web search market in a big way, and not necessarily for the better.
Donuts CEO Paul Stahura today published an article on CircleID that makes the case that it is the browser makers, specifically Microsoft, that are implementing DNS all wrong, and that they’re objecting to dotless domains for competitive reasons. The IAB apparently disagrees, but it’s an interesting counterpoint nevertheless.

DomainsBot takes its new gTLD spinner to registries

DomainsBot has started promoting its domain name suggestion services to new gTLD registries.
Announced today, its new TLD Recommendation Engine for Registries is designed to make TLD suggestions more relevant when people are hunting for a new domain name.
It’s a sister service to the TLD Recommendation Engine for Registrars that, as we reported last week, DomainsBot hopes to have in place on many of the major registrars’ storefronts when new gTLDs launch.
After last week’s news, Domain Name Wire did a test of its demo and found it lacking in certain areas, such as failing to offer a .accountant domain to a query containing “CPA”.
DomainsBot CEO Emiliano Pasqualetti told DI that the service being announced today will help TLD registries avoid this kind of problem.
In consultation with DomainsBot, they’ll be able to more accurately define the meaning of their TLD string, improving the relevancy of DomainsBot’s results and potentially not missing out on sales.
Under the hood, it’s based on a database of all the existing second-level domains in existence today. DomainsBot wants to connect each second-level string to relevant results in new gTLDs.
“My goal is to pre-classify every existing second-level domain before new gTLDs go live,” Pasqualetti said.
The service is not free, of course. The cheapest tier has an introductory price of $1,000 per month, which Pasqualetti said will go up in future.
It’s “pay for relevancy” rather than “pay for display”, he said. “I’m not saying if you pay me I will display .cpa every time.”
MinardosGroup, which has applied for .build, .construction and .expert, has already signed on to use the service, according to a DomainsBot press release.