China conference leads to 49% .vip spike

The Global Domain Industry Conference, held in China over the weekend, has led to a huge boost in .vip domain sales.
Registry Minds + Machines told the markets this morning that the recently launched gTLD hit 404,892 as of 1600 UTC yesterday, up 49% from Friday.
CEO Toby Hall confirmed to DI that China is very much behind the spike, and that the conference helped raise the profile of .vip.
Billings and orders have now hit $5.5 million, up from $3.2 million on May 22, M+M said. That number includes sunrise and premium sales.
At GDS, M+M sold eight .vip domains auction for a total of $232,000 before auction commissions, which very likely inspired the spike in base-fee registrations.
Photos of GDS published on social media yesterday show a packed auditorium, with hundreds of attendees.

what did they say on 2016 Global Domain Industry Summit? what did you care? find it : https://t.co/wTRKX1Fbxq pic.twitter.com/xQNMZNGUxl

— 西部数码 (@westdotcn) June 6, 2016

While M+M makes much of the fact that it has not used a “freenium” strategy for .vip — which it says may lead to better renewal rates than competitors — retail prices are still pretty damn cheap.
At West.cn, its leading Chinese registrar, a .vip can be had today for about $3. It’s closer to $10 at GoDaddy.
Today’s batch of zone files have not yet been published by ICANN for verification, but yesterday there were 245,872 names in .vip.

.xyz tops 5 million domains as penny deals continue

XYZ.com became the first new gTLD operator to top five million domains in a single TLD last night, when .xyz added almost 1.5 million names.
According to our parse of today’s zone file, .xyz has 5,096,589 names, up 1,451,763 on yesterday’s 3,644,826.
On Monday, the number was just under 2.8 million.
The massive spike came after what was supposed to be the final day of a three-day discounting blitz, as registrars sold the names for $0.02, $0.01 or even nothing.
Uniregistry, which sold for a penny, seems to have claimed the lion’s share of the regs.
The company supplied DI with data showing it had processed over 1.16 million registrations on June 2, about 90% of which CEO Frank Schilling said were .xyz sales.
At its peak, Uniregistry created 95,793 new domains in an hour, this data shows.
Judging by the numbers published on its home page, the registrar has pretty much doubled its domains under management overnight.
The rapid growth of .xyz is very probably not over.
Some registrars said they will carry on with the penny giveaways for an extra day.
At least one popular registrar, NameCheap, told irritated customers that the popularity of its $0.02 offer meant it had a backlog of registration requests that would take 12 to 24 hours to process. Those may not have showed up in the zone file yet.
In addition, .xyz prices are expected to be dirt cheap — just $0.18 at Uniregistry, for example — for the rest of the month, at least at the 50-odd registrars XYZ says are participating in its promotion.

Amazingly, .blockbuster will soon be a gTLD

Video rental chain Blockbuster may have gone the way of the the 8-track, the VCR, and the Nokia cell phone, but it will soon have a gTLD of its own.
The .blockbuster gTLD application completed its pre-delegation testing with ICANN this week and is now with IANA/Verisign, ready to go live on the internet in the coming week or so.
It’s a fairly straightforward dot-brand application, even though the brand itself is pretty much dead.
Blockbuster, which at its peak in 2004 had 9,000 rental stores in its chain, was rescued from its Netflix-induced bankruptcy by TV company Dish Network back in 2011.
Dish applied for .blockbuster in 2012 when the brand was still, if only barely, a going concern.
However, since that time all of its remaining Blockbuster stores have been closed down and the Blockbuster-branded streaming service has been renamed Sling.
The web site at blockbuster.com is a husk that hasn’t been updated since 2014.
And yet the brand will shortly be at the cutting edge of online branding by having its own new gTLD.
A dot-brand without a brand? Surely this will be among the most useless new gTLDs to hit the ‘net.

Donuts’ new 50% price hike explained

Donuts’ new pricing model for 10 of its new gTLDs, announced yesterday, has caused some confusion for registrants and will make life more complex for registrars.
The company said yesterday that from October it plans to raise its wholesale fee by 50% for new registrations in .camera, .camp, .cleaning, .dog, .glass, .kitchen, .plumbing, .shoes, .solar and .toys.
It’s a substantial increase for domains that typically retail for between $25 and $40, and Donuts has clearly got an eye on profitability rather than volume.
But, crucially, the increased fees will not apply to renewals of existing registrations.
This introduces an unfamiliar pricing paradigm to the domain name industry — the notion of variable renewal pricing for non-premium domains.
Let’s do an example, assuming the wholesale fee is currently $10 (it isn’t, but Donuts does not disclose its wholesale fees).
If you were to register example.dog today or before October 1, the wholesale renewal fee for that domain would be $10 for as long as you held that domain. In 20 years, you’d still be paying Donuts $10 a year in renewal fees.
But if you were to register the same domain name after October 1, you’d be paying Donuts $15 a year in renewal fees.
Donuts told DI last night that the only way an already-registered domain in one of the affected gTLDs would see an increased fee is if it deletes and is re-registered.
The current, lower, wholesale fee will continue to apply if you transfer your domain to a new registrar. It will even apply if you sell your domain to a new registrant, according to Donuts.
In practice, how much you actually pay depends on your registrar, of course.
Registrars may decide to have variable renewal fees at the retail level too or, probably more likely, they may apply a uniform renewal price. In the latter case, current .dog domains would be 50% more profitable than domains registered from October 1.
Under the hood, the new model introduces complexities for registrars, described to DI by one registrar as a “pain”.
They’ll need to update their systems to account for the varying rates and will need to pass data about renewal tiers between each other when domains are transferred.
If Donuts were to raise prices every two years, and applied the hike to more gTLDs, pretty soon there’ll be a lot of tiers to track.
But variable pricing is not completely unheard of, and is regulated to an extent by ICANN.
The standard Registry Agreement, which applies to all Donuts’ gTLDs, forbids registries from charging some registrants higher renewal fees than others.
But there are exceptions. If the registrant explicitly agrees to the renewal fee at the point of registration, it’s legit. Donuts and others already use this exception in order to charge higher prices for premium name renewals.
The purpose of that part of the contract “is to prohibit abusive and/or discriminatory Renewal Pricing practices”, preventing registries imposing higher fees on customers that are using domains very profitability, for example.

Donuts to hike prices 50% on some TLDs

While some new gTLD registries are all about the giveaways and deep discounting, Donuts has taken the unprecedented decision to actually increase its prices.
The company announced today that it will add a whopping 50% to its wholesale fee for 10 of its TLDs.
The TLDs are: .camera, .camp, .cleaning, .dog, .glass, .kitchen, .plumbing, .shoes, .solar and .toys.
While Donuts does not disclose its wholesale fees, these domains typically retail for $25 to $40 for non-premiums.
We could be looking at a .dog at GoDaddy, for example, going up from $40 a year to $60 a year, if the increases are passed on proportionately.
None of the 10 TLDs in question have set the market alight, volume-wise. They’re all struggling around the 3,000 to 6,000 domains mark, according to zone file data.
Seven of the 10 zones have actually been shrinking in recent months.
All but one of them went to general availability in the first half of 2014, so have been on the market about two years.
The new prices will kick in October 1, Donuts said.
Renewal prices for domains registered before that date will renew at their original wholesale fee, the company added.

.xyz adds 788,000 domains in a day

Blimey.
XYZ.com managed to “sell” at least 788,167 .xyz domain names yesterday, as registrars gave them away for peanuts.
According to this morning’s zone file count, the gTLD has 3,644,826 domains, compared to 2,856,659 yesterday.
And its sale is not even over until midnight tonight.
The company has pumped millions into marketing .xyz for the second anniversary of its general availability launch, and many registrars dropped their prices accordingly.
Registrars are currently selling the names for $0.02, $0.01 or, apparently in the case of at least one Chinese registrar, nothing.
It goes without saying that this is the biggest one-day spike for a 2012 new gTLD, blowing the previous record of 238,616 out of the water.
While XYZ.com no doubt gets bragging rights, one has to wonder how much value has actually been created here.
The vast majority of these names will have been acquired by investors and will sit idle before eventually dropping. It’s possible that some have also been registered for nefarious purposes.
Some number will no doubt renew, otherwise the promotion will have been a wasted enterprise.
If you look at XYZ’s first big giveaway — the controversial free push into Network Solutions customer accounts — you’ll see very low retention.
NetSol had 360,683 .xyz names under management after the promotion finished in July 2014, but that was down to 18,919 by October 2015, when most had deleted.
That’s a drop of 95%.
The difference here is of course that registrants this week have had to pick their domains and hand over nominal payment.
Investors have been known to form emotional attachments to their portfolios, which could increase renewals this time around.
XYZ.com will have to pay around $200,000 in ICANN fees for yesterday’s added domains.

These might be the top 10 biggest new gTLD daily growth spikes

With news seeping out this evening that XYZ.com’s latest marketing blitz has very possibly added half a million domains to its .xyz gTLD today, I thought I’d knock out some data on the previous largest one-day growth spikes in new gTLDs.
With some caveats, which I’ll get to, I think these might be the top 10 growth days for new gTLDs.
[table id=41 /]
They’re the only 10 spikes of over 100,000 domains I could confirm in the DI PRO database, at least in 2012-round gTLDs.
With .xyz reportedly adding at least 400,000 domains today, due to several registrars basically giving them away, it’s certainly going to be at the top of this table tomorrow.
XYZ is celebrating its second anniversary of general availability tomorrow, and has invested several million bucks in promotions on registrars which are in turn selling .xyz names for as little as a penny apiece.
As mentioned, there are some caveats to the data in the table above.
It’s based on the zone files published daily by ICANN’s Centralized Zone Data Service, which can be patchy.
CZDS is set up in such a way that each user has missing days here and there, and it has in the not too distant past had a tendency to balk when it receives an unexpectedly large zone file.
In other words, there’s a pretty good chance I’ve missed some spikes, but I’m confident there’s nothing else approaching 400,000 in a day.
UPDATE: .vip should be on the table, with a one-day spike of 115,245 on May 18 2016.

West.cn to prop up .xyz renewals with $1.5 million subsidy

Leading Chinese registrar West.cn has said it will subsidize .xyz renewals to the tune of $1.5 million.
According to a West.cn press release, CEO He Xiaojiang made the announcement alongside XYZ.com counterpart Daniel Negari at meeting in Beijing on Friday.
The registrar’s .xyz customers “are going to get high rebate back from West.cn so that they can get very low renewal fees”, according to a translation of the original Chinese.
The subsidized renewal price, which starts in June, will be RMB 18 ($2.73), according to the company.
That’s about a $7 discount on West.cn’s usual renewal price of RMB 64.
First-year .xyz prices at the registrar are currently RMB 8 ($1.22).
West.cn is believed to have well over a million .xyz domains on its books. With over a third market share, it’s XYZ.com’s biggest registrar.
The press release points out that West.cn is not getting a special rate from XYZ (which would be against ICANN rules).
Negari declined to elaborate on the specifics of the subsidy.
But in what is no doubt a related move, he told DomainInvesting.com yesterday that XYZ has “reserved several million dollars to be spent with registrars and on advertising platforms for our 2 year anniversary”.
This ad spend will be made over the month of June, he said, to coincide with the June 2, 2014 general availability launch of .xyz.
Fifty registrars are participating, he said, calling it the “biggest sale” the industry has seen.
Whether through heavily discounted renewals or bargain first-year regs, it seems the company is set on making sure its DUM volume does not dip as its anniversary approaches.
It’s not unusual for registries to do special offers to coincide with launch birthdays.
.xyz currently has about 2.8 million registered domains, but about 1.8 million of those were registered after June 2015 and are not in need of renewal before the promotion period expires (though registrants can of course renew whenever they like).

Verisign says new gTLDs put millions at risk

Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.
It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.
According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.
But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.
You can read the paper here (pdf), but I’ll attempt to summarize.
The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.
It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.
Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.
So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.
The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.
When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.
A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.
That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.
Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.
The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.
The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.
It’s potentially quite scary, but there are some mitigating factors.
First, the problem is not limited to new gTLDs.
Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).
He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.
“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.
“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.
According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.
With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.
I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.
Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.
Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.
The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.
Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.
All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).
Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.
There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.
A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.
ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.

1,000th new gTLD goes live

The 1,000th new gTLD from the 2012 application round was delegated yesterday.
It was either .shop or .realestate, appropriately enough, which both appear to have been added to the DNS root zone at about the same time.
Right now, there are actually only 999 new gTLDs live in the DNS. That’s because the unwanted .doosan was retired in February.
During its pre-launch planning for the new gTLD program, ICANN based its root zone stability planning on the assumption that fewer than 1,000 TLDs would be added to the root per year.
In reality, it’s taken much longer to reach that threshold. The first few new gTLDs were added in late October 2013, 945 days ago.
On average, in other words, a new gTLD has been added to the root slightly more than once per day.
Over that same period, nine ccTLDs — internationalized domain names applied for via a separate ICANN program — have also gone live.
The 1,000th new gTLD to be added to the IANA database was .blog.
There are 1,314 TLDs in the root all told.