Verisign confirms it did fund $135 million .web bid

Verisign has just confirmed that it was behind the winning bid in last week’s .web gTLD auction.
Nu Dot Co won the auction after 23 rounds over two days of bidding, but Verisign was thought to be the real beneficiary.
The company has now released the following statement confirming the relationship:

The Company entered into an agreement with Nu Dot Co LLC wherein the Company provided funds for Nu Dot Co’s bid for the .web TLD. We are pleased that the Nu Dot Co bid was successful.
We anticipate that Nu Dot Co will execute the .web Registry Agreement with the Internet Corporation for Assigned Names and Numbers (ICANN) and will then seek to assign the Registry Agreement to Verisign upon consent from ICANN.
As the most experienced and reliable registry operator, Verisign is well-positioned to widely distribute .web. Our expertise, infrastructure, and partner relationships will enable us to quickly grow .web and establish it as an additional option for registrants worldwide in the growing TLD marketplace. Our track record of over 19 years of uninterrupted availability means that businesses and individuals using .web as their online identity can be confident of being reliably found online. And these users, along with our global distribution partners, will benefit from the many new domain name choices that .web will offer.

No big surprises there. Verisign had already told investors it had a $130 million payment coming up soon.
See DI’s analysis on the auction results here.

Verisign likely $135 million winner of .web gTLD

Verisign has emerged as the likely winner of the .web gTLD auction, which closed on Thursday with a staggering $135 million winning bid.
The shell company Nu Dot Co LLC was the prevailing applicant in the auction, which ran for 23 rounds over two days.
Just hours after the auction closed, Domain Name Wire scooped that Verisign had quietly informed investors that it has committed to pay $130 million for undisclosed “contractual rights”.
In its Securities and Exchange Commission quarterly report, filed after the markets closed on Thursday, Verisign said:

Subsequent to June 30, 2016, the Company incurred a commitment to pay approximately $130.0 million for the future assignment of contractual rights, which are subject to third-party consent. The payment is expected to occur during the third quarter of 2016.

There seems to be little doubt that the payment is to be made to NDC (or one of its shell company parents) in exchange for control of the .web Registry Agreement.
The “third-party consent” is likely a reference to ICANN, which must approve RA reassignments.
We speculated on July 14 that Verisign would turn out to be NDC’s secret sugar daddy, which seems to have been correct.
Rival .web applicant Donuts had sued ICANN for an emergency temporary restraining order, claiming it had not done enough to uncover the identity of NDC’s true backers, but was rebuffed on multiple grounds by a California judge.
Donuts, and other applicants, had wanted the contention set settled privately, but NDC was the only hold-out.
Had it been settled with a private auction, and the $135 million price tag had been reached, each of the seven losing applicants would have walked away with somewhere in the region of $18.5 million in their pockets.
This draws the battle lines for some potentially interesting legal fallout.
It remains to be seen if Donuts will drop its suit against ICANN or instead add Verisign in as a defendant with new allegations.
There’s also the possibility of action from Neustar, which is currently NDC’s named back-end provider.
Assuming Verisign plans to switch .web to its own back-end, Neustar may be able to make similar claims to those leveled by Verisign against XYZ.com.
Overall, Verisign controlling .web is sad news for the new gTLD industry, in my view.
.web has been seen, over the years, as the string that is both most sufficiently generic, sufficiently catchy, sufficiently short and of sufficient semantic value to provide a real challenge to .com.
I’ve cooled on .web since I launched DI six years ago. Knowing what we now know about how many new gTLD domains actually sell, and how they have to be priced to achieve volume, I was unable to see how even a valuation of $50 million was anything other than a long-term (five years or more) ROI play.
Evidently, most of the applicants agreed. According to ICANN’s log of the auction (pdf) only two applicants — NDC and another (Google?) — submitted bids in excess of $57.5 million.
But for Verisign, .web would have been a risk in somebody else’s hands.
I don’t think the company cares about making .web a profitable TLD, it instead is chiefly concerned with being able to control the impact it has on .com’s mind-share monopoly.
Verisign makes about a billion dollars a year in revenue, with analyst-baffling operating margins around 60%, and that’s largely because it runs .com.
In 2015, its cash flow was $651 million.
So Verisign has dropped a couple of months’ cash to secure .web — chickenfeed if the real goal is .com’s continued hegemony.
In the hands of a rival new gTLD company’s marketing machine, in six months we might have been seeing (naive) headlines along the lines of “Forget .com, .web is here!”.
That won’t happen now.
I’m not privy to Verisign’s plans for .web, but its track record supporting the other TLDs it owns is not fantastic.
Did you know, or do you remember, that Verisign runs .name? I sometimes forget that too. It bought it from Global Name Registry in late 2008, at the high point of its domains under management in this chart.

I don’t think I expect Verisign to completely bury .web, but I don’t think we’re going to see it aggressively promoted either.
It will never be positioned as a competitor to .com.
If .web never makes $135 million, that would be fine. Just as long as it doesn’t challenge the perception that you need a .com to be successful, Verisign’s purchase was worth the money.

Verisign announces .net price increase

Verisign has just announced that prices for .net domains are going up again this coming February.
Announcing its second-quarter earnings, the company revealed plans to raise its registry fee from $7.46 to $8.20, effective February 1, 2017.
That’s the maximum 10% price hike it’s allowed to claim under its .net Registry Agreement with ICANN.
Raising .net prices has become a bit of an annual tradition with Verisign, one of the few gTLD registries to still have its prices regulated by ICANN.
The company had about 16.2 million .net domains under management at the last formal, published count in March. Its daily “domain base” has .net at 15.7 million names today.

.web auction to go ahead after ICANN denies Donuts/Radix appeal

The new gTLD .web seems set to go to auction next week after ICANN rejected an 11th-hour delay attempt by two applicants.
ICANN’s Board Governance Committee said yesterday that there is no evidence that applicant Nu Dot Co has been taken over by a deep-pocketed third party.
The BGC therefore rejected Donuts’ and Radix’s joint attempt to have the July 27 “last resort” auction delayed.
Donuts and Radix had argued in a Request for Reconsideration earlier this week that Nu Dot Co has changed its board of directors since first applying for .web, which would oblige it to change the application.
Its failure to do so meant they auction should be delayed, they said.
They based their beliefs on an email from NDC director Jose Ignacio Rasco, in which he said one originally listed director was no longer involved with the application but that “several others” were.
There’s speculation in the contention set that a legacy gTLD operator such as Verisign or Neustar might now be in control of NDC.
But the BGC said ICANN had already “diligently” investigated these claims:

in response to the Requesters’ allegations, ICANN did diligently investigate the claims regarding potential changes to Nu Dot’s leadership and/or ownership. Indeed, on several occasions, ICANN staff communicated with the primary contact for Nu Dot both through emails and a phone conversation to determine whether there had been any changes to the Nu Dot organization that would require an application change request. On each occasion, Nu Dot confirmed that no such changes had occurred, and ICANN is entitled to rely upon those representations.

ICANN staff had asked Rasco via email and then telephone whether there had been any changes to NDC’s leadership or control, and he said there had not.
He is quoted by he BGC as saying:

[n]either the ownership nor the control of Nu Dotco, LLC has changed since we filed our application. The Managers designated pursuant to the company’s LLC operating agreement (the LLC equivalent of a corporate Board) have not changed. And there have been no changes to the membership of the LLC either.

The RfR has therefore been thrown out.
Unless further legal action is taken, the auction is still scheduled for July 27. The deadline for all eight applicants (seven for .web and one for .webs) to post deposits with ICANN passed on Wednesday.
As it’s a last resort auction, all funds raised will go into an ICANN pot, the purpose of which has yet to be determined. The winning bid will also be publicly disclosed.
Had the contention set been settled privately, all losing applicants would have made millions of dollars of profit from their applications and the price would have remained a secret.
NDC is the only applicant refusing to go to private auction.
The applicants for .web are NDC, Radix, Donuts, Schlund, Afilias, Google and Web.com. Vistaprint’s bid for .webs is also in the auction.
The RfR decision can he read here (pdf).

Is Verisign .web applicant’s secret sugar daddy?

The fiercely contested .web gTLD is being forced into a last-resort auction and some people seem to think a major registry player is behind it.
Two .web applicants — Radix (pdf) and Schlund (pdf) — this week wrote to ICANN to demand that the .web auction, currently planned for July 27, be postponed.
They said the sale should be delayed to give applicants time “to investigate whether there has been a change of leadership and/or control” at rival applicant Nu Dot Co LLC.
Nu Dot Co is a new gTLD investment vehicle headed up by Juan Diego Calle, who launched and ran .CO Internet until it was sold to Neustar a couple of years ago.
I gather that some applicants believe that Nu Dot Co’s .web application is now being bankrolled by a larger company with deeper pockets.
The two names I’ve heard bandied around, talking to industry sources this week, are Verisign and Neustar.
Nobody I’ve talked to has a shred of direct evidence either company is involved and Calle declined to comment.
So is this paranoia or not?
There are a few reasons these suspicions may have come about.
First, the recent revelation that successful .blog applicant Primer Nivel, a no-name Panama entity with a Colombian connection, was actually secretly being bankrolled by WordPress, has opened eyes to the possibility of proxy bidders.
It was only after the .blog contention set was irreversibly settled that the .blog contract changed hands and the truth become known.
Some applicants may have pushed the price up beyond the $19 million winning bid — making the rewards of losing the private auction that much higher — had they known they were bidding against a richer, more motivated opponent.
Second, sources say the .web contention set had been heading to a private auction — in which all losing applicants get a share of the winning bid — but Nu Dot Co decided to back out at the last minute.
Under ICANN rules, if competing applicants are not able to privately resolve their contention set, an ICANN last-resort auction must ensue.
Third, this effective vetoing of the private auction does not appear to fit in with Nu Dot Co’s strategy to date.
It applied for 13 gTLDs in total. Nine of those have already gone to auctions that Nu Dot Co ultimately lost (usually reaping the rewards of losing).
The other four are either still awaiting auction or, in the case of .corp, have been essentially rejected for technical reasons.
It usually only makes sense to go to an ICANN last-resort auction — where the proceeds all go to ICANN — if you plan on winning or if you want to make sure your competitors do not get a financial windfall from a private auction.
Nu Dot Co isn’t actually an operational registry, so it doesn’t strictly have competitors.
That suggests to some that its backer is an operational registry with a disdain for new gTLD rivals. Verisign, in other words.
Others think Neustar, given the fact that its non-domains business is on the verge of imploding and its previous acquisition of .CO Internet from Calle.
I have no evidence either company is involved. I’m just explaining the thought process here.
According to its application, two entities own more than 15% of Nu Dot Co. Both — Domain Marketing Holdings, LLC and NUCO LP, LLC — are Delaware shell corporations set up via an agent in March 2012, shortly before the new gTLD application filing deadline.
Many in the industry are expecting .web to go for more than the $41.5 million GMO paid for .shop. Others talk down the price, saying “web” lacks the cultural impact it once had.
But it seems we will all find out later this month.
Responding to the letters from Schlund and Radix, ICANN yesterday said that it had no plans to postpone the July 27 last-resort auction.
All seven applicants had to submit a postponement form by June 12 if they wanted a delay, ICANN informed them in a letter (pdf), and they missed that deadline.
They now have until July 20 to either resolve the contention privately or put down their deposits, ICANN said.
The applicants for .web, aside from Nu Dot Co, are Google, Donuts, Radix, Schlund, Web.com and Afilias.
Due to a string confusion ruling, .webs applicant Vistaprint will also be in the auction.

Verisign to get .com for six more years, but prices to stay frozen

ICANN and Verisign have agreed to extend their .com registry contract for another six years, but there are no big changes in store for .com owners.
Verisign will now get to run the gTLD until November 30, 2024.
The contract was not due to expire until 2018, but the two parties have agreed to renew it now in order to synchronize it with Verisign’s new contract to run the root zone.
Separately, ICANN and Verisign have signed a Root Zone Maintainer Agreement, which gives Verisign the responsibility to make updates to the DNS root zone when told to do so by ICANN’s IANA department.
That’s part of the IANA transition process, which will (assuming it isn’t scuppered by US Republicans) see the US government’s role in root zone maintenance disappear later this year.
Cunningly, Verisign’s operation of the root zone is technically intermingled with its .com infrastructure, using many of the same security and redundancy features, which makes the two difficult to untangle.
There are no other substantial changes to the .com agreement.
Verisign has not agreed to take on any of the rules that applies to new gTLDs, for example.
It also means wholesale .com prices will be frozen at $7.85 for the foreseeable future.
The deal only gives Verisign the right to raise prices if it can come up with a plausible security/stability reason, which for one of the most profitable tech companies in the world seems highly unlikely.
Pricing is also regulated by Verisign’s side deal (pdf) with the US Department of Commerce, which requires government approval for any price increases until such time as .com no longer has dominant “market power”.
The .com extension is now open for public comment.
Predictably, it’s already attracted a couple of comments saying that the contract should instead be put out to tender, so a rival registry can run the show for cheaper.
That’s never, ever, ever, ever going to happen.

Verisign loses .art contract to CentralNic

CentralNic has been awarded the back-end contract for the forthcoming .art gTLD, usurping Verisign from the role.
UK Creative Ideas, which bought .art at a private auction for an undisclosed sum a year ago, appointed the company its “exclusive registry service provider”, CentralNic said.
UKCI’s original .art application named Verisign as its back-end, and this is not the first time CentralNic has sneaked away a Verisign client.
When XYZ.com acquired .theatre, and .security and .protection from Symantec, it moved them from Verisign to its .xyz provider CentralNic.
That earned XYZ and CentralNic a contract interference lawsuit, which XYZ settled in May.
Clearly litigation has not managed to chill competition in this instance.
.art is set to launch in stages over the next 12 months, CentralNic said.
UKCI estimated in its ICANN application that it would get between 25,000 and 80,000 registrations in its first year.
That may prove to be optimistic, at least at the high end.
UKCI’s vision for .art is for a restricted gTLD, which don’t tend to do huge volumes. I believe the largest restricted new gTLD is .nyc, with about 75,000 names in its zone.
All .art registrants will have to show some kind of connection to the art world, according to UKCI’s application.

This includes artists, owners and keepers of works of art, commercial art organisations (such as galleries and auction and trading houses), not-for-profit organisations (such as museums, foundations, and professional associations), supporting businesses (such as insurance, appraisal, transport) and customers and members of the general public interested in art.

Goodness knows how this will be implemented in practice, given that basically everyone is an artist to some extent.
UKCI is based in the Isle of Man, the UK dependency presumably selected for tax reasons rather than any connection to the art world, and is backed by Russian venture capitalists.

Verisign says new gTLDs put millions at risk

Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.
It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.
According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.
But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.
You can read the paper here (pdf), but I’ll attempt to summarize.
The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.
It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.
Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.
So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.
The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.
When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.
A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.
That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.
Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.
The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.
The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.
It’s potentially quite scary, but there are some mitigating factors.
First, the problem is not limited to new gTLDs.
Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).
He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.
“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.
“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.
According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.
With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.
I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.
Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.
Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.
The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.
Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.
All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).
Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.
There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.
A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.
ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.

XYZ settles Verisign’s back-end switcheroo lawsuit

XYZ.com has settled a lawsuit filed against it against Verisign stemming from XYZ’s acquisition of .theatre, .security and .protection.
Verisign sued the new gTLD registry operator for “interfering” with its back-end contracts with the previous owners last August, as part of its campaign to compete against new gTLDs in the courtroom.
XYZ had acquired the .security and .protection ICANN contracts from security Symantec, and .theatre from a company called KBE Holdings.
As part of the transitions, all three applications were modified with ICANN to name CentralNic as the back-end registry services provider, replacing Verisign.
Verisign sued on the basis of tortious interference and business conspiracy. It was thrown out of court in November then amended and re-filed.
But the case appears to have now been settled.
Negari issued a grovelling not-quite-apology statement on his blog:

I am pleased to report that the recent case filed by Verisign against CentralNic, Ltd., XYZ and myself has been settled. After looking at the claims in dispute, we regret that as a result of our acquisition of the .theatre, .security and .protection extensions and our arrangement for CentralNic to serve as the backend service provider for these extensions, that Verisign was prevented from the opportunity to pursue monetization of those relationships. As ICANN’s new gTLD program continues to evolve, we would caution others who find themselves in similar situations to be mindful of the existing contracts extension owners may have with third parties.

Registries changing their minds about their back-end provider is not unheard of.
In this case, large portions of Verisign’s final amended complaint were redacted, suggesting some peculiarities to this particular switch.
If there was a monetary component to the settlement, it was not disclosed. The original Verisign complaint had demanded damages of over $2 million.

Verisign facing its own activist investor

While new gTLD registries Rightside and Minds + Machines have faced board-room challenges by activist investors in recent months, it seems industry heavyweight Verisign is contended with a similar problem.
John Chevedden, once described as an “economy class” activist due to his relatively small stakes, is attempting to give smaller Verisign shareholders the ability to propose directors for the company’s board.
Rather than attempting to gut the companies he invests in, he tries to make the odd incision into their corporate governance in order to give smaller investors a greater voice in their companies.
He’s filed a proposal, which will be voted on at Verisign’s June 9 annual general meeting, for a new “proxy access” bylaw.
Essentially, the proposal would allow an unlimited number of shareholders who collectively own over 3% of the company’s stock to propose two people for director elections (or 25% of the board, whichever is greater).
But Verisign’s current board is recommending that shareholders vote against the proposal, saying it’s “unnecessary”.
The company says that it plans to introduce its own proxy access bylaw that would be slightly different.
The Verisign alternative would limit the size of the nominating gang to 20 shareholders. That would mean that each individual investor would have to own much larger stakes, in order to pass the 3% threshold and nominate director candidates.
Verisign says Chevedden’s proposal, which does not limit the number of small shareholders involved, would be expensive and unwieldy to manage.
Chevedden reportedly has quite a decent success rate with these kinds of proposals.