The Tax Man to get domain takedown powers

The Tax Man is going to get powers to ask for domains to be taken down in the UK, according to local registry Nominet.

His Majesty’s Revenue and Customs is set to be added to Nominet’s list of approved law enforcement agencies under its Criminal Practices Policy, enabling it to ask for domains to be suspended if it suspects criminal behavior.

The policy is essentially a trusted notifier program where LEAs are given the benefit of the doubt when it comes to takedown requests. Nominet conducts some sanity checks and will give the registrant 48 hours notice before it suspends their name unless it thinks the name poses and imminent risk.

Nominet said that HMRC was being onboarded because it’s already getting similar legal powers under the recent UK Crime and Policing Act, which became law in April.

The law gives statutory takedown powers to a number of LEAs that were already entrusted by the Nominet self-regulatory policy, such as the Financial Conduct Authority and the Gambling Commission.

A Nominet spokesperson said the HMRC was being added to the list to advise on issues where “domains are being used for HMRC impersonation, phishing or other tax-related scams to the public”.

Cybercrime link as t.me gets taken down

Speculation is rampant online right now after t.me, the domain used for short links by the messaging service Telegram, was apparently taken down by the .me registry, affecting as many as a billion users.

t.me seems to have gone dark shortly before 2000 UTC on Monday evening, with Whois/RDAP records showing it is now placed on serverHold status, which usually indicates a registry-level suspension and removal from the .me zone.

The suspension means that millions of short links using t.me are no longer functioning when clicked, leading instead to NXDOMAIN errors. Substituting t.me for telegram.me can be used as a workaround; the longer domain remains unsuspended.

.me is the ccTLD for Montenegro and is managed by local firm doMEn, which is mostly a partnership between US-based domain giants GoDaddy and Identity Digital.

Telegram and doMEn’s partners have yet to publicly address the outage, leading to a great deal of speculation online.

The most plausible explanation put forward so far but not yet confirmed is that the takedown relates to an order issued Monday by the US government’s Office of Foreign Assets Control, which has broad powers to sanction organizations and individuals it believes are linked to crime and terrorism.

OFAC, in an advisory that otherwise largely targets Cuban-linked entities, sanctioned domains and cryptocurrency wallets linked to First VPN Service (1VPNS), which it said was a Ukraine-based cybercrime group selling anonymity services to ransomware attackers and others.

OFAC said: “Numerous ransomware groups have purchased infrastructure from 1VPNS, which they have leveraged in attacks on U.S. companies and institutions—including to hide the origins of their attacks, deploy malware, and manage exfiltrated data.”

The July 13 order sanctioned three 1VPNS domain names — 1vpns.com, 1vpns.net, and 1vpns.org — that had in fact already been taken down by a Europol-led law enforcement operation in May.

But also on the list is the URL t.me/FirstVPNService. The equivalent telegram.me URL was not listed.

This has led to the suspicion that the t.me suspension is a classic case of government using a jurisdictional sledgehammer to crack an overseas nut — ordering doMEn’s US-based registry partners to take down the whole of t.me rather than asking Dubai-based Telegram to take down the specific offending URL or group.

Identity Digital, which holds the pen on .me domain edits, would have been powerless to resist an order from its own government.

While the takedown will doubtless be raised in ongoing policy discussions about when it is appropriate for a registry or registrar to suspend a domain over DNS abuse concerns, it’s less clear whether it will play into the Montenegro government’s nascent efforts to exert more local control over .me.

Have your say on police domain takedown powers

The UK Parliament wants your input on a new proposed law that would give the police powers to take down domain names and IP addresses.

The broad-ranging Criminal Justice Bill 2023 (pdf) would give police the ability to obtain court orders requiring registries and registrars to suspend domains believed to be used in criminal activity.

Accompanying explanatory notes say that these court orders could be applied internationally against domain companies in other countries via various means.

The clock is ticking for submissions — the Public Bill Committee of Parliament is due to sit to consider evidence from December 12 and issue its report with suggested amendments by January 30.

The committee advises submitting evidence as soon as possible to maximize the time spent considering it.

BMW porn site leads to registrar getting suspended

A Hong Kong registrar has had its ICANN contract suspended after failing to transfer a cybersquatted domain to car maker BMW.

ThreadAgent.com, which has about 32,000 .com and .net domains under management, attracted the attention of ICANN compliance after a customer lost a UDRP case concerning the domain bmwgroup-identity.net.

The domain led to a site filled with porn and gambling content, and the UDRP was a slam-dunk win for BMW.

But ThreadAgent failed to transfer the domain to BMW within the 10 days required by ICANN policy, leading to Compliance reviewing the registrar for other areas of non-compliance.

A December 22 breach notice led to the registrar transferring the domain to BMW last week, but it had failed to resolve the other issues ICANN had identified, leading to a suspension notice the very next day.

ICANN wants ThreadAgent to explain why the UDRP was not processed according to the policy, and how it will be compliant in futre. It also says the company is not operating a web Whois service as required.

ICANN has told the company it will not be able to sell gTLD domains or accept inbound transfers between January 28 and April 28, and must display a notice to that effect prominently on its web site.

That second requirement may prove complicated, as ThreadAgent appears to be one of about 20 registrar accreditations belonging to XZ.com, a Chinese group based in Xiamen. It has not used the domain threadagent.com in several years, and its other accreditations, which use the same storefront, are all still unsuspended.

GoDaddy, PorkBun and Endurance win domain “blocking” court fight

Three large registrar groups last week emerged mostly victorious from a court battle in which a $5.4 billion-a-year consumer goods giant sought to get domains being used in huge scam operations permanently blocked.

Hindustan Unilever, known as HUL, named Endurance, GoDaddy and PorkBun in a lawsuit against unknown scammers who were using cybersquatted domains to rip off Indians who thought they were signing up to become official distributors.

The .in ccTLD registry, NIXI, was also named in the suit. All of the domains in question were .in names.

Among other things, HUL wanted the registrars to “suspend and ensure the continued suspension of and block access to” the fraudulent domains in question, but the judge had a problem with this.

He’d had the domain name lifecycle explained to him and he decided in a June 12 order (pdf) that it was not technically possible for a registrar to permanently suspend a domain, taking into account that the registration will one day expire.

He also defined “block access to” rather narrowly to mean the way ISPs block access to sites at the network level, once again letting the registrar off the hook.

Judge GS Patel of the Bombay High Court wrote:

Any domain name Registrar can always suspend a domain that is registered. But the entire process of registration itself is entirely automated and machine-driven. No domain name registrar can put any domain names on a black list or a block list.

Where he seems to have messed up is by ignoring the role of the registry, where it’s perfectly possible for a domain name to be permanently blocked.

NIXI may not have its hands directly on the technology, but .in’s EPP registry is run by back-end Neustar (now owned by GoDaddy but not directly named in the suit), which like all gTLD registries already has many thousands of names permanently reserved under ICANN’s direction.

Patel also seems to assume that NIXI doesn’t get paid for the domain names its registrar sells. He wrote:

The relief against Defendants Nos. 14 and 15, the dot-IN registry and NIEI [NIXI] at least to the extent of asking that they be ordered to de-register or block access is misdirected. Neither of these is a registrar. Neither of these receives registration consideration. Neither of these registers any domain name. The reliefs against them cannot therefore be granted.

NIXI actually charges INR 350 ($4.60) per second-level .in name per year, of which a reported $0.70 goes to Neustar.

The judge also ruled that the registrars have to hand over contact information for each of the cybersquatters.

He also ordered several banks, apparently used by the scammers, to hand over information in the hope of bringing the culprits to justice.

Registrar suspended over dodgy transfers

ICANN has suspended a Los Angeles-based registrar after failing to get answers to its questions about a bunch of domain transfer.
World Biz Domains won’t be able to sell any gTLD domains, or accept transfers, from October 16 until January 13 next year. It will also have to post ICANN’s suspension notice on its home page.
Its crime? Failing to provide ICANN with records proving that the change of registrant requests for 15 potentially valuable domain names were legitimate.
ICANN has been badgering World Biz for these records since April, but says it was given the runaround.
The domains in question — 28.net, 68.net, 88.org, changi.com, tay.net, goh.net, koh.net, kuantan.com, yeong.com, merlion.org, og.net, raffles.net, sentosa.org, sg.org and shenton.com — all appear to have been registered to a Singaporean investor using the registrar DomainDiscover until about a year ago.
The non-numeric names all have significance to Singapore or neighboring Malaysia one way or the other. Some of them are arguably UDPR fodder.
Shenton is a busy street and hotel in the city, Merlion is Singapore’s lion mascot, Sentosa is a Singaporean island, and Raffles is of course the name of the famous hotel. Other domains on the list are common Chinese surnames used by Singaporeans.
It appears that about a year ago, according to DomainTools’ historical Whois records, they were transferred to World Biz and put under privacy protection.
There’s no specific claim in ICANN’s notice that any domain hijacking has taken place, but it’s easy to infer that the original registrant was for some reason not happy that the domains changed hands and therefore complained to ICANN.
Some of the domains in question have since been transferred to other registrars and may have been returned to the original registrant.
If ICANN’s track record of demanding records is any guide, this will not help World Biz come into compliance.
Should it be terminated, it looks like very few registrants will be affected.
While World Biz at one point had over 5,000 gTLD domains under management, it’s been shrinking consistently for the best part of a decade and in May had just 74 DUM.
September last year, when the domains in question moved to World Biz, was the company’s most-successful month in terms of inbound transfers — 17 domains — since I started tracking this kind of data nine years ago.

Net 4 India gets brief reprieve from ICANN suspension

India registrar Net 4 India has been given a bit of breathing space by ICANN, following its suspension last month.
ICANN suspended the registrar’s accreditation a month ago, effective June 21, after discovering the company had been in insolvency proceedings for some time.
But on June 20 ICANN updated its suspension notice to give Net4 more time to comply. It now has until September 4, the same day its insolvency case is expected to end, to provide ICANN with documentation showing it is still a going concern.
The registrar was sued by a debt collector that had acquired some Rs 1.94 billion ($28 million) of unpaid debts from an Indian bank.
ICANN’s updated suspension notice adds that Net4 is to provide monthly status updates, starting July 18, if it wants to keep its accreditation.
The upshot of all this is that the registrar can carry on selling gTLD domains and accepting inbound transfers for at least another couple months.

India’s largest registrar goes insolvent, gets suspended

India’s largest independent registrar has been found insolvent by a local court, after failing to pay back $28 million in bank loans.
Net 4 India has now also had its right to sell gTLD domains suspended by ICANN as a result.
Judging by legal papers (pdf) buried on Net4’s web site, the insolvency relates to a series of loans the company took out with the State Bank of India between 2002 and 2012.
After the company failed to pay those loans back, in 2014 the debt was acquired from SBI by Edelweiss Asset Reconstruction, which specializes in buying debt cheap then recovering it through the courts.
Edelweiss sued Net4 to get its money back a couple of years ago and, in March this year after what appears to have been a slam-dunk, won its case.
The ruling states that the outstanding debt in 2017 was almost two billion rupees — Rs 1,940,860,284, which works out to just short of $28 million at today’s rates.
Having learned about the insolvency in April, ICANN set about trying to contact Net4’s management to see if the company was coming back into compliance.
ICANN’s Registrar Accreditation Agreement says ICANN can terminate registrars’ contracts if they are in insolvency proceedings for more than 30 days.
After the company failed to show it was compliant, this week its RAA was suspended from June 21 to September 19.
During that period, Net4 will not be able to sell new domain registrations or accept incoming transfers. It will also have to display a notice on its web site to that effect.
If it has not demonstrated compliance by August 28, ICANN may start its termination process.
Net4 is the largest ICANN-accredited registrar based in India, as measured by number of registered gTLD domains (excluding Public Domain Registry, LogicBoxes, and several affiliated dummy accreditations, which are all owned by US-based Endurance International).
It had over 100,000 gTLD domains under management at the end of February — almost all in .com and other legacy gTLDs — but its DUM had been shrinking hard for many months.
At some point, Net4 appears to have been listed on both India’s National Stock Exchange and the Bombay Stock Exchange, but was delisted about a year ago.

Belgium to crack down on fraud domains

DNS Belgium says it will shortly implement a new policy that will see it take down .be domains associated with fraud within 24 hours of discovering them.
The new scheme, which comes into effect December 1, essentially grants the Belgian government’s ministry of the economy — FPS Economy or Federal Public Service Economy in local parlance — a trusted notifier status when it comes to takedowns.
Previously, requests had to go through public prosecutors and took about two weeks, giving attackers a longer window to milk their victims.
Under the old regime, FPS Economy could only request a suspension in cases where the Whois data was inaccurate.
The registry said it will only suspend domains that are involved in “serious crimes”, including phishing and fraudulent web stores.
Registrants will have two weeks to appeal their suspensions. After six months, the domains will be deleted.
Several hundred .be domains per year are expected to be affected.

Rape ban results in just one .uk takedown, but piracy suspensions soar

Nominet’s controversial policy of suspending domain names that appear to condone rape resulted in one .uk domain being taken down last year.
That’s according to a summary of take-downs published by Nominet yesterday.
The report (pdf) reveals that 3,889 .uk names were taken down in the 12 months to October 31, 2015.
That’s up on the the 948 domains suspended in the six months to October 31, 2014.
The vast majority — 3,610 — were as a result of complaints from the Police Intellectual Property Crime Unit. In the October 2014 period, that unit was responsible for 839 suspensions.
Unlike these types of suspensions, which deal with the allegedly illegal content of web sites, the “offensive names” ban deals purely with the words in the domain names.
Nominet’s systems automatically flagged 2,407 names as potentially in breach of the policy — most likely because they contained the string “rape” or similar — in the 12 months.
But only one of those was judged, upon human perusal, in breach.
In the previous 12 months period, 11 domains were suspended based on this policy, but nine of those had been registered prior to the implementation of the policy early in 2014.
The policy, which bans domains that “promote or incite serious sexual violence”, was put in place following an independent review by Lord Macdonald.
He was recruited for advice due to government pressure following a couple of lazy anti-porn articles, both based on questionable research by a single anti-porn campaigner, in the right-wing press.
Assuming it takes a Nominet employee five minutes to manually review a .uk domain for breach, it seems the company is paying for 200 person-hours per year, or 25 working days, to take down one or two domain names that probably wouldn’t have caused any actual harm anyway.
Great policy.