ICANN meeting venue “insensitive and hurtful”

ICANN has taken some criticism over the decision to host its flagship Universal Acceptance 2024 meeting in Serbia.

An individual named Dmitry Noskov has written to ICANN to complain that the Universal Acceptance Steering Group will hold its “Keystone” meeting — the main event of the UA Day series of meetings around the world — later this month in Belgrade. He wrote (pdf):

Given the current global tension in the region due to ongoing conflict and the close cultural and historical ties between Serbia and Russia, which have led to diplomatic and trade actions by several countries against Russia, I am concerned about the implications of holding the event in Belgrade. It is crucial to consider the potential perception of insensitivity or hurtfulness to global sentiments, especially to those affected by the conflict.

Unlike most of Europe, Serbia has maintained a somewhat neutral stance on Russia’s invasion of Ukraine and there is reportedly large popular support for Russia, and a large Russian population, in the country. Russia and Serbia are old allies.

ICANN has taken a generally pro-Ukraine stance. It donated $1 million to relief efforts in 2022 after the war started. It also lobbied against the Russian nomination for ITU secretary-general. Russia’s ccTLD registry cut off its ICANN funding last year.

CEO Sally Costerton replied (pdf) to Noskov to say that the choice of Belgrade as the keystone UA Day event for 2024 was made by the UASG.

The UA Day event in Belgrade is being hosted by local ccTLD registry RNIDS, which runs .rs and the Cyrillic equivalent .срб.

.ru domains fly off the shelf as Western sanctions bite

Russia’s ccTLD has posted very impressive growth in registrations for 2023, attributable largely to sanctions related to the country’s invasion of Ukraine.

ccTLD.ru, the registry for .ru and .рф, reported that it ended 2023 with 5,439,137 .ru domains, an increase of 506,024 or 10.3% over the year. It said 85% of the names were registered by Russians.

It said 1,709,718 new domains were registered in .ru, with over 200,000 being registered per month by December.

For comparison with fellow top-10 ccTLDs, Germany’s .de grew by 201,000 names last year, and Brazil’s .br grew by 220,000. The UK’s .uk shrank and the Netherlands’ .nl was basically flat.

In the smaller Cyrllic .рф, the growth rate was even greater — 13.7%, with 768,883 domains in total at the end of the year, up 92,769 names, the registry said.

Despite the rapid growth, .ru is still a bit off its 2017 peak of around 5.53 million domains, according to my database.

In a press release, ccTLD.ru director Andrey Vorobyev admitted that one of the “main drivers” of the growth were Russians transferring their sites to Russia “under the pressure of sanctions”.

After Russia launched its full-scale invasion of Ukraine in 2022, many domain registries and registrars in the West unilaterally decided to stop doing business with Russian citizens and organizations, despite US government sanctions specifically not applying to domains.

GoDaddy cut off Russians and .ru while Namecheap, which has many support staff in Ukraine, cut off Russian customers and continues to prominently fund-raise for Ukraine on its storefront. Other companies announcing boycotts included 101domain, IONOS and Nominet.

Ukraine’s ccTLD, .ua, has fared less well during the crisis. Its total domain count shrank by about 77,000 to 514,000 in 2023, according to my database. The local registry, Hostmaster, had frozen deletions for a period to give people who had been displaced or mobilized more time to renew, but started releasing those domains last year.

Hostmaster has reported adoption of certain third-level geographic .ua domains that use Latin transliterations of Ukrainian place names, rather than Russian — .kyiv.ua versus .kiev.ua for example — as citizens seek to “de-Russify” their holdings.

Ukrainian domains slide as war becomes the new normal

Ukraine’s ccTLD is starting to see a decline in its total domains under management as emergency policies related to Russia’s full-scale invasion in February 2022 are relaxed.

According to local registry Hostmaster, .ua’s total was down 1.5% at the end of the first quarter at 612,778 domains, due to the fact that expiring domains that were frozen in 2022 have now started to drop.

Hostmaster said the effect will become more noticeable in coming quarters. Stats show a decline of about a thousand domains since the end of June.

When the war started, .ua had about 558,000 domains. It peaked at around 614,000 in early June.

Early in the conflict, Hostmaster had said that expired domains would be held in a redemption period status. Many registrants were assumed to have been drafted into the military or refugees.

Since then, the registry says a “significant number” of expired domains have been restored.

However, the policy was rolled back this June; expired domains now have the antebellum standard 30 days to be restored. Domains that were not renewed in 2022 still have a November deletion date, Hostmaster said.

Meanwhile, WIPO has recently restarted its UDRP services for Ukraine, having paused them in May 2022 in response to the war. Decisions that were paused in early 2022 have now been executed and published.

Registry launches Ukrainian domains for Russian-occupied region

A Ukrainian registry has started offering domains in a second-level Ukrainian transliteration of a Russia-occupied region.

Southern Ukrainian Network Information Center started offering residents of the Mykolaiv oblast domains at the third-level under mykolaiv.ua at the start of October, according to the registry’s web site.

Mykolaiv is the Ukrainian version of the original Cyrillic name. Previously, domains were only available under the Russian transliteration, .nikolaev.ua. SUNIC also offers the shorter .mk.ua domain.

Mykolaiv, in the battle-scarred south of the country, is also the name of the region’s capital city. While the city has resisted Russian capture, much of the region has been under the invading force’s control since early in the war.

SUNIC, which also offers odessa.ua (Russian) and odesa.ua (Ukrainian) names for the Odesa region and city, is encouraging .nikolaev.ua registrants to acquire their matching mykolaiv.ua names.

Adopting Ukrainian transliterations of Cyrillic place names has been seen as a symbolic act of defiance against Russian ambitions.

ICANN reports shocking increase in pandemic scams

The number of gTLD domains being used for malware and phishing related to the Covid-19 pandemic has increased markedly in the last eight months, according to data released by ICANN this week.

The Org revealed that since it started tracking this kind of thing in May 2020 it has flagged 23,452 domains as “potentially active and malicious”.

The data is collected by checking zone files against a list of 579 keywords and running the results through third-party abuse blocklists. Blocked domains are referred to the corresponding registrars for action.

I’m not sure you could technically call these “takedown requests”, but there’s a pretty strong implication that registrars should do the right thing when they receive such a report.

The 23,452 notices is a sharp rise from both the 12,860 potentially abusive flagged names and 3,791 “high confidence” reports ICANN has previously said it found from the start of the project until August 2021.

It’s not clear whether the rise is primarily due to an increase in abusive practices or ICANN’s improved ability to detect scams as it adds additional keywords to its watch-list.

ICANN said in March that it is now also tracking keywords related to the Russian invasion of Ukraine.

It’s also asking organizations in frequently targeted sectors to supply keyword suggestions for languages or scripts that might be under-represented.

The data was processed by ICANN’s Domain Name Security Threat Information Collection and Reporting (DNSTICR or “DNS Ticker”), which Org management previously discussed at ICANN 73.

Ukraine won’t delete domains until war is over

Hostmaster, the Ukrainian ccTLD registry, has indefinitely paused domain deletions due to the ongoing war with Russian.

The company said its domain redemption period, which usually lasts 30 days after a registration expires, will now run until the end of martial law, which was brought in by the government shortly after the invasion.

The registry had previously, and perhaps optimistically, extended the window to 60 days. But the war continues, and many registrants are still unable to renew their names.

Since the first extension, registrars have already recovered over 300 names that were not renewed in time, Hostmaster said.

The price to restore an expired .ua name is the same as a renewal, the registry said.

ICANN picks recipient of $1 million Ukraine aid

ICANN has decided to donate $1 million to the Emergency Telecommunications Cluster, an international organization that helps people stay connected during times of crisis.

The donation was announced at ICANN 73 in early March, not long after Russia’s invasion of Ukraine, and ICANN has spent the last six weeks picking a recipient and doing its due diligence. For ICANN, that’s basically warp speed.

The ETC is one of 11 “clusters”, overseen by the UN’s Inter-Agency Standing Committee, which provide relief during humanitarian crises. Other clusters help with food, medicine, and so on.

Its partners include UN agencies, other governmental bodies, charities, and private companies such as Cisco and Iridium.

The ETC has been on the ground in Ukraine since March 3, preparing to provide emergency communications and strengthen infrastructure against cyber-attacks, though its latest report notes that Ukraine’s infrastructure is holding up pretty well so far.

ICANN CEO Göran Marby said in a statement:

This is an initiative for which we have no precedent; it is a first for ICANN. I am proud of the org for the drive and commitment to quickly identify the best path and organization to efficiently deliver meaningful support. The ETC’s vision of “a world where safe and local access to reliable communications is always available” is well aligned with our mission to ensure the stable and secure operation of the Internet’s unique identifier systems.

ICANN’s board has approved an ongoing program of similar donations, not just for Ukraine.

Domain sales exempt from US sanctions on Russia

A variety of internet technologies, including domain name registration services, have been declared exempt from US sanctions on Russia.

The Department of the Treasury’s Office of Foreign Assets Control has issued a notice (pdf) specifically authorizing the export to Russia for the following:

services, software, hardware, or technology incident to the exchange of communications over the internet, such as instant messaging, videoconferencing, chat and email, social networking, sharing of photos, movies, and documents, web browsing, blogging, web hosting, and domain name registration services

The move is reportedly meant to support independent media’s and activists’ fight against Russian government propaganda during the Ukrainian invasion.

Some US registrars, including Namecheap and GoDaddy, have chosen to restrict their Russian customer base on ethical grounds since the first week of the war in Ukraine.

Namecheap, which has many staff in Ukraine, has banned all Russian custom other than those actively opposing the Putin government.

Microsoft seizes domains Russia was using to attack Ukraine

Microsoft says it has taken control of some domain names that we being using by hackers connected to the Russian security services to launch cyber attacks against Ukrainian, US and EU targets.

Company VP Tom Burt wrote that seven domains used by a group called Strontium were seized via a US court order and redirected to a Microsoft sinkhole, disrupting these attacks.

Burt wrote that the targets were Ukrainian media organizations and US and EU foreign policy think tanks, adding:

We believe Strontium was attempting to establish long-term access to the systems of its targets, provide tactical support for the physical invasion and exfiltrate sensitive information.

One wonders why Russia would use domains under US jurisdiction to conduct such attacks.

War fails to stop .ua domains selling

Ukraine’s ccTLD has maintained what appears to be a healthy level of new registrations, despite the Russian invasion.

The company today reported that between February 24 and March 25, it saw over 3,000 new .ua domain regs, over 2,000 of which were in .com.ua. The ccTLD offers names in a few dozen third-level spaces.

February 24 was the day Russia invaded, and the day Ukraine went into martial law.

“The com.ua domain is mostly used by commercial organizations. Therefore, the presence of registrations shows that Ukrainian business continues to operate under martial law,” Hostmaster wrote (via Google Translate).

.ua had a total of 534,162 domains under all 2LDs today, according to the registry’s web site.

While Hostmaster has not yet published its end-of-month stats for March, it appears that the new adds suggest an improvement on typical monthly performance, or at least business as usual.

The registry has come under denial-of-service attack dozens of times since the war started, but says it has so far continued to operate without interruption.