15 ms·

ICANN has taken my site hostage

127 points by pieterhg 10y ago

fao_ 10y ago
"ICANN and IWILL"
hvidgaard 10y ago
So, not only did you let the subsciption lapse, you didn't keep the crucial and important contact information up to date? The information you're informed how crucial is for your continued ownership of the domain? Owning a domain is not a right, it's a business relation. Treat it as such and know the what and how of it. If I don't pay the yearly fee on my car, they'll take the plates - should I make an angry blog post about they should "ask me nicely"? And hey, you can preorder my book btw...
- pieterhg 10y ago
  > So, not only did you let the subsciption lapse No, where do you read this? I paid for my domain. NameCheap's WhoisGuard expired, contacts changed to old ones I didn't use from 3y ago. The domain was paid for. My "business relation" with ICANN was paid for. > If I don't pay the yearly fee on my car, they'll take the plates. No, I paid for the domain. They took it hostage because my 3-year old email wasn't confirmed. That's not about a business relation. That's bad "business" behavior.
  - hvidgaard 10y ago
    You let the WhoIsGuard lapse, you explicitely write so. It's your responsibility to ensure that your contact information stays updated in this case. I really don't see the problem. ICAAN does many things wrong, but this was not one of them.
- Luc 10y ago
  > If I don't pay the yearly fee on my car, they'll take the plates - should I make an angry blog post about they should "ask me nicely"? Renewing a passport at my city hall used to take several visits, often with a long wait, during business hours. After enough people complained the procedure was mostly moved online, with optional Fedex delivery of the passport. So, you see, these business relations are not set in stone, it's just that they were formulated for maximum convenience of ICANN, without consultation of domain owners...
  - hvidgaard 10y ago
    I compeletely agree, but in this case the OP did not stay on top of the contact information, and it cost him a lot of issues and lost work. ICAAN does many things wrong, but this was not one of them. Keep the contact information updated, it is not that hard.
abricot 10y ago
"I didn't update my contact information, so now I can't be contacted. How dare you"
- fnord123 10y ago
  "Why didn't any of ICANN's 340 employees who manage 6.5 million domains (~18571/person) call me personally to discuss how I would like to work through my fuck up? The monsters."
realusername 10y ago
I don't even get why would would need any contact info on a domain in the first place? It's just supposed to map ips to names, it should be registrable without anything but an email address to recover it if needed.
- nicolas_t 10y ago
  In practice the contact info is so that some companies can spam you with offers for SEO services and other stuff along with all the other typical spams you get.
  - Macha 10y ago
    The best one is I own a domain that is basically <my name>.Com A couple of times a year I'll get an email asking me if I'm interested in buying a domain like <mky name>.com for (the one that quoted a price) $1000. Usually just ignore them.
- nicolas_t 10y ago
  In practice the contact info is so that some companies can spam you with offers for SEO services and other stuff along with all the other typical spams you get.
owenwil 10y ago
Idk... it seems kinda fair of ICANN. Using something on top of your domain like WHOISGUARD rather than... just the one that's included at your registrar is odd, let alone not keeping email addresses alive. Annoying, yes, but this happens to everyone!
- Vendan 10y ago
  whoisguard is namecheap's whois anonymization service: https://www.namecheap.com/security/whoisguard.aspx https://www.namecheap.com/security/whoisguard.aspx
turbohedgehog 10y ago
Honestly I'd blame Namecheap, not ICANN. My registrar was much more relaxed - I did not need to take any action Please take a moment to view the WHOIS listing for each of the domain names you currently have registered through us. Please verify your mailing address, email address, and the administrative and technical contacts assigned to each domain name are correct. If your WHOIS information has changed or is inaccurate please log into your account manager and update accordingly. If your WHOIS information is correct, you do not need to take any action.
- aeden 10y ago
  This is a bit different, and it's possible your registrar is not yet using the latest RAA (Registrar Accreditation Agreement). Specifically, the email you're talking about is the once-a-year verification email that all compliant registrars must send. The OP was dealing with a new rule which is part of the RAA 2013, which adds the requirement for verifying emails within 15 days of any registrant change that impacts either the name or the email address of the registrant. (Edited to fix typo for RAA)
deleted 10y ago
[deleted]
ronalbarbaren 10y ago
That happening when someone or organization hold too much power. Not only ICANN, Verisign which manage .com and .net then price of .com .net .org.... increase per year. http://lmgtfy.com/?q=verisign+.com+.net+price+increase http://lmgtfy.com/?q=verisign+.com+.net+price+increase
woliveirajr 10y ago
If I understood correctly: - the user has made some mistake about some auto-renew feature, so that it didn't work smooth and has fallen to the previous known state (=using his real information) > For some reason, WhoisGuard wasn’t set to renew and it expired. - because of that, he didn't notice he was receiving e-mails, since it was an e-mail address he hasn't used for years. > Because I’ve been using WhoisGuard for years, I haven’t used the old email (...) that USED to be set as the contact BEFORE (...) This email wasn’t connected to this domain for 3 years. So when it switched back, I never got ANY of ICANN’s verification request emails. - Well, his old e-mail probably got the e-mails. He just didn't check it because he didn't access the old e-mail. ICANN now verifies every change in the whois information by sending an e-mail (something that I regard as a safety measure, because, well, when you register, you must inform a way to be reached, and e-mail is a reasonable way to do it): > The problem is (1) their emails look like SPAM and often end up in SPAM folders (2) who uses email these days anyway? (3) they often send them to old email addresses. Or, in other words, my e-mail provider filters e-mails automatically (samp rules), who should use e-mail when e-mail is the official way to be contacted about your site (huh?) and ICANN send e-mails to the old address (which is the one he informed when he registered his site). I'm not sure, perhaps I misunderstood something, but the problem seems to be caused: - by the user: now using auto-renew, not updating the whois information, not checkin the e-mail regularly (or having some forwarding rule to the e-mail he uses today) - by the WhoisGuard, if the auto-renew was disable by mistake of the site, not from the user - by Gmail (?), by having spam rules (?) And I don't know where it wa a ICANN error. Sorry, but I don't see a real problem here. The user lost his site for few days, ok, but due to some mistakes he made.
- Luc 10y ago
  > The user lost his site for few days, ok, but due to some mistakes he made. Only if you take ICANN's procedures as a given. They could have adapted one of dozens more customer friendly ways of dealing with this, but they don't have to because they're ICANN and they can do this with impunity.
  - pieterhg 10y ago
    Exactly. There's lots of ways to do this better. For example contacting the registrar (NameCheap) and finding another contact on the domain (or my NameCheap's official account's email) that does work. There's ways besides shutting down somebody's entire business. Which seems like a power move, if anything.
cdubzzz 10y ago
> I have about a hundred domain names. How can you expect me to check my inbox daily and click a link for all these domain names. It’s not 1995. This is not realistic. The consequence of shutting down someone’s business if they don’t confirm their email is way too crazy. I'm not a particularly big fan of ICANN's process here either, the same thing has happened to me before and it was very annoying. But "I have lots of domains" and "who uses email anyway" are extremely poor excuses. Having lots of domains seems like about the most logical reason one should be on top of this sort of thing.
- salesguy222 10y ago
  If the government required you to click a link every time you bought something online, and upon failure to click, they confiscated it, would you feel the same as you do now?
  - tankenmate 10y ago
    But here's the thing, you don't actually buy a domain name; in other words it's not property. Also, your registering a domain name is contingent on agreeing to the registrar's conditions, and some of those conditions are required to be there by the registrars agreement with ICANN. So you are entering into a contract. If you buy a car and park it directly in front of a fire hydrant and forget about it, then the government will seize your car until such time as you pay your fine, the towing fee and storage fee. If you register a domain in contravention to the agreed contract then ICANN will seize your domain until such time as you correct it (including the time it takes to confirm that you have complied). It really isn't that strange.
    - salesguy222 10y ago
      But what if the contract is unreasonable? Blocking a fire hydrant is an understandable problem and is handled in a decentralized manner (either a ticket you can plea to after the fact, or someone tells you to politely move your car) seizure and then negotiation is an unnecessary show of force in my opinion, unless the site was doing something criminal
Sir_Cmpwn 10y ago
Strange to see everyone sticking up for ICANN here. I'm of the opinion that their rules about WHOIS are harmful. Even if you think that the information should be kept accurate and up to date, is the appropriate recourse for ICANN to really have the site taken down until its resolved? Maybe as a measure of last resort. I would personally wait until they try to renew the domain and make them update the info then. Another problem is that since WHOIS data is public it's not effectively possible to run a website anonymously. I'd be okay with sharing contact info with limited parties (ICANN, registrar) but forcing people to share this info with the public is nuts. It makes running a website as an individual much more personally risky.
- woliveirajr 10y ago
  And you can think about the other way round: and if a site is doing something wrong, like distributing software, spreading a copy of your book, sharing unconsented nudity, and the list goes on... should you be able to hide behind anonymity?
  - Sir_Cmpwn 10y ago
    I would be consider allowing the records to be made available in court by judicial order (i.e. a subpoena). Still not public. Also, what the servers are doing isn't the domain's business. Traceroute the IP and bring it up with their ISP. Killing the domain isn't going to kill the availability of the content.
    - yosamino 10y ago
      ... Enter CloudFlare. You're now dealing with a scammer hiding behind Anon-DNS and a Server behind CloudFlare. The situation is now this: > what the servers are doing isn't the domain's business > what the servers are doing isn't CloudFlare's business The Anon-DNS provider doesn't feel responsible, CloudFlare doesn't feel responsible (while at the same time hosting the authoritative DNS). I can't even tell which jurisdiction these spammers operate from, so it's kind of impossible to do anything about it. God I hate receiving these stupid "We are just a reverse proxy, we are not responsible" emails from CloudFlare. They most these clowns will do is forward my contact info to the ISP running the criminals' backend servers, which might very well be these same criminals. Thanks for nothing CloudFlare.
blfr 10y ago
Is this particular implementation of the email verification mechanism really required by ICANN? My registrar (OVH) sends an email that requires no action if the contact information is correct.
jack_arleth 10y ago
As somebody who worked for a company selling domain-names and being responsible for the registration and renewal of domain names; this sadly enough is a very familiar situation. ICANN in my humble opinion has no blame in this, they are simply following the rules that they set out and OP agreed with when he registered the .com domain name. As stated in other comments keeping your WHOIS information is the sole responsibility you have when owning a domain name. That and timely renewing the domain of course. In my somewhat limited experience the WHOISGUARD system is something that only causes problems. It's a pain to work with when transferring or trading a domain name and upon expiration can result to the exact situation that OP currently in. To add, I'm somewhat weary of a site that hides it's owner. The whois data can create a certain form of trust and serve as a verification to ascertain the owner of the site is who he claims to be. I'm not sure why you would want to hide this data. A .com domain has the option to register the domain in the name of a corporation, thus removing the personal data of the owner (name and email) and only showing the name of the company, it's data and a administrative e-mail address in a minimal setup. As OP has; and I quote; "about a hundred domain names", I'm not sure why no company has been formed to solve this problem for all these domain-names. I personally think that the WHOIS system is one of the best ways to solve the problem that domain name registration poses. It's accessible for anyone, anywhere, in plaintext and without the need for special software. It's actually pretty great. Edit: typo's
- salesguy222 10y ago
  Thank you for your insight. I mean this comment seriously, because it is the only reason i don't run more websites: what happens when my site gets very popular and lucrative, and someone uses my whois info to rob me in my home?
  - aeden 10y ago
    Don't use your home address in whois, period. Use a business address. If you have a site that is lucrative then you have enough to pay for a PO box or an office space. There are plenty of companies that will provide on demand office space and take and forward mail for a couple hundred dollars per month or less.
meagher 10y ago
Good news is a bunch of people just checked their WHOIS email address. Other than the click-baity headline and book plug at the end, I think it's spot on.
return0 10y ago
It's easier to just put fake name and address in the required fields. Only the email is used for verification. This is a stupid requirement anyway. The fact that whoisguard exists is testament to it.
openplatypus 10y ago
I am disgusted by ICANNs approach here but not to spare NameCheap: If WhoisGuard expired, shouldn't they update the domain WHOIS data with his current contact details. I can't imagine levels not having up to date email address with his account. So if I am correct, WhoisGuard expired, record reverted to original one. But domain is still registered via NameCheap. NameCheap should use levels current details. Not the one from 5y ago.
micah94 10y ago
Simply put, you need a better registrar. Namecheap should step up and edit your contact info to whatever you want, push out that ICANN email again, and let you ack it. We've done this many times for customers. We also don't charge $5/yr for domains. But you get what you pay for. Sorry if this sounds harsh, but these things happen all the time with cheap i-services. If your business is a little more important, you need to pay a little more for exceptional cases like this.
- deleted 10y ago
  [deleted]
robalfonso 10y ago
I'm in the registrar space. A few observations. The process overall is not great, but ICANN's process didn't fail this customer. The customer needs to keep contact information up to date. If you own 100+ domains you should be very familiar and have your own process for managing this. Its been this way since 2013. The process to shut down a site is quite thorough in that many attempts at contact need to be made. I'm a little surprised a phone call wasn't generated. By the time we've emailed you 3 times - we are making a phone call - we don't want to shut down a site if its at all avoidable. This "24-48" hours stuff is nonsense - The suspension/un-suspension of a domain can be done almost immediately. It remains to be seen but NameCheaps only potential issue here is whether they failed to renew the WHOIS privacy service.
- k-mcgrady 10y ago
  >> "The customer needs to keep contact information up to date." I own a few domain names and they ask me to update this info one per year. I've never understood why they need it at all though. Why should they have my address/contact info and why should it be publicly available? I'm sure the answer is obvious but I can't figure it out.
  - robalfonso 10y ago
    First, thats the way it is - so knowing that you need to keep the information up to date. Regarding Why - ICANN runs on a multi stakeholder model, meaning governments and legal entities get a seat at the table too. They have an interest in knowing who is behind a domain - its that simple. Also whois privacy is not the protection everyone thinks it is. Its a lock on a door. It keeps casual looks out - spammers, scammers, etc. If a government or police organization wants that information and they have legitimate need to do so, they will get it.
laegoose1 10y ago
Aliyun asked me via email to send them ID copy, credit card copy, credit card statement for last 3 months in 24 hours otherwise my account would be shut down. I did so in 39 hours because I don't check that email account very often. All my running instances were shut down in 2 weeks without additional warnings. Only emails I got from them were about 20$ coupons for referral. As support later explained, I did not meet 24 hours deadline. (AWS haves me as customer last 4 years with 10's of thousands USD spent yearly and never asked for ID or credit card copies).
- Keverw 10y ago
  Wow. I wonder if that's a PCI violation to ask for a credit card copy via email... Doesn't sound very secure to me.
Nanite 10y ago
While I understand the sentiment, the author's analogy is bit off. ICANN is not the maffia, they are however in effect an institutional bureaucracy. Throwing a Medium hissy fit probably won't make them move any faster to resolve this.
drivingmenuts 10y ago
> No Pieter, you should read your email more carefully, this is a consequence of your messiness. Yep. End of story.
tzs 10y ago
> I have about a hundred domain names. How can you expect me to check my inbox daily and click a link for all these domain names. Why would you have those mails go to your inbox? Why not have something in your incoming mail filters that looks for them and moves them to a mailbox dedicated to domain admin mails? It's way easier to monitor that way, and harder to miss something in the noise.
dpedu 10y ago
You misconfigured your domain and as a result did not receive important communication sent to it. What's the controversy?
- Mattasher 10y ago
  I'm not sure if this is a genuine question, but if so, the controversy is this: Why should ICANN have the power to suspend your domain name in the first place? How does the Internet get better by having an organization that can terminate your key business (or personal) asset just because you missed (or misread, keeping in mind not everyone is fluent in English and everyone is wary of scams) an email they sent you?
deno 10y ago
NameCheap did the same thing to me, except it was even worse because it was on a domain name I purposefully let expire (I didn’t want it anymore). But instead of letting it expire with the Whois Guard data they changed it to my real data and essentially doxxed me right before it expired. Here is the email I got from the support: ---- Hello, Thank you for contacting Namecheap Support! Please accept our sincere apology for any frustration this issue may have caused you. Let us just clarify the issue: WhoisGuard protects domain contacts 7 days after expiration. After that WhoisGuard is disabled and depending on TLD contact details may or may not be displayed. Therefore these details are not mentioned in the quoted message. We would like to assure you that we have forwarded your feedback regarding the issue to the corresponding department and they will consider implementing it as soon as possible. The TLDs provided below usually have their contact details revealed in 7 days: .us.com ; .de.com ; .pw ; .website ; .press ; .host ; .online ; .space ; .io ; .co ; .me ; .info ; .biz ; .link ; .xyz ; .site ; .london ; .club ; .design ; .rent ; .college ; .tech ; .cn.com ; .eu.com ; .gb.com ; .gb.net ; .uk.com ; .uy.com ; .hu.com ; .no.com ; .qc.com ; .ru.com ; .sa.com ; .se.com ; .se.net ; .za.com ; .jpn.com ; .ae.org ; .kr.com ; .ar.com ; .us.org ; .com.de ; .wiki ; .fans ; .com.se ; .gr.com ; .jp.net ; .la ; .rest ; .bar ; .ink ; .co.com ; .love ; .br.com ; .uk.net ; .hu.net ; .in.net ; .mex.com ; .theatre ; .security ; .protection ; .cloud ; .top ; .us ; .bid ; .trade ; .webcam ; .men ; .black ; .pink ; .blue ; .red ; .kim ; .shiksha ; .lgbt ; .poker ; .pro ; .accountant ; .download ; .loan ; .racing ; .win ; .review ; .date ; .party ; .faith ; .cricket ; .science ; .mobi ; .voto ; .vote ; .green ; .mom ; .porn ; .adult ; .vegas ; .global ; .sex ; .irish ; .bz ; .vc ; .game ; .asia ; .stream ; .com.bz ; .net.bz ; .com.vc ; .net.vc ; .org.vc ; .krd ; .film ; .one ; .sydney ; .melbourne ; .study ; .audio ; .blackfriday ; .christmas ; .click ; .diet ; .flowers ; .gift ; .guitars ; .help ; .hiphop ; .hiv ; .hosting ; .juegos ; .lol ; .photo ; .pics ; .property ; .sexy ; .tattoo ; .xxx As a possible work-around it is possible to have an active domain removed from your Namecheap account. So if you have any non-expired domains in the account and you do not wish to renew them, you can just contact us and we will remove them. As a result, your contact details will be substituted with the ones of Namecheap and they will be shown in Whois. Should you have any questions please do not hesitate to contact us again. ---- Needless to say I won’t do business with any company that doesn’t take privacy of their customers seriously. They don’t even warn you Whois Guard is about to expire.
iProcrastinate 10y ago
Didn't Obama give complete control of ICANN to the United Nations recently? Was he just feeling super generous to other countries because I suse wasn't on board with that idea. :(
- caryhartline 10y ago
  This is not true: https://qz.com/761219/in-44-days-the-us-will-no-longer-oversee-the-internets-naming-system/ https://qz.com/761219/in-44-days-the-us-will-no-longer-overs... The entire overview of the decision is in the article. Essentially, one piece of how the Internet was managed was handed over from the U.S to ICANN. The reason is fairly straightforward; the federal gov did not feel the need to manage this thing for which there was no need for them to manage it.
db48x 10y ago
Given the realities, automation is the only real solution.
saaaaaam 10y ago
"I forgot to pay a bill basically because I forgot to check it was set on auto renew. It was for the landlord of my office space. She emailed me but I forgot to give her my up to date email address a while back - I never hear from her normally, and tbh communications about this sort of stuff are pretty low level so I shouldn't have to worry about it. Each week I need to do about two things to do with the admin of my tenancy here in the office building, the landlord emails me about trivial stuff - checking things, making sure that that new guy who said he worked for me didn't get a set of keys to my office space, updating things. TWO THINGS A WEEK! I don't have time for that. So now I'm super pissed off and people are starting to say I'm maybe not all that professional for letting stuff like this slide."
will_hughes 10y ago
ICANN as a whole is a pain in the ass to deal with. We had one of our domains taken hostage because the whois information pointed to our support@ address, and the support staff thought it was spam. What it's supposed to help, I don't know - because accurate registration information really doesn't seem to be a whole lot of help to anyone except perhaps ICANN themselves. Anonymising services or not, nothing on WHOIS needs to work except the email address, and that can be a random gmail address, the only thing you ever need respond to is ICANNs email. It certainly doesn't help in trying to identify or contact the real owner of domains. Another gripe with ICANN is that they're zero help when trying to take down scamming/spamming domains. Adding to that, many registrars simply don't give a shit about what their customers are doing with the domains they register. At work we own <ourcompanyname>.com and the local equivalents in pretty much every country. Some scammer purchased <ourcompanyname>.<new-generic-tld> and used that in fake job ads (the 'We need a support person in <country> to process payments' etc type). The ads get taken down pretty quick (job boards are familiar with this) but not before enough people are emailing jobs@ the scammer's domain. We only heard about this because a few people emailed us pissed about the scammy behaviour. We contacted the hosting company, domain registrar (both the reseller and the actual registrar), and Donuts, all of whom either completely ignored us, or said fuck off talk to ICANN. Even having our lawyers send a C&D letter to all the various parties got us nowhere. (Hosted in Russia, registered to a fake address in NYC, etc). ICANN won't touch it without us spending up to submit a dispute, which we did, but it takes them months to process and each domain costs something like USD$1500 to dispute. In the months while the scam was active, we got something like 100 people contacting us to report it, god knows how many actually fell for it. While we're in the process of disputing that, the smartass registers a couple of new generic-tld domains and starts using those.
codycraven 10y ago
I've encountered a similar situation where I never received an email or written letter (my contact information was correct in WHOIS). Suddenly I noticed I'm not receive emails for the affected domain, I check the site and is down. I reach out to my registrar who tells me it's a new ICANN policy and that I should have gotten an email...
herbst 10y ago
While this stucks ICANN clearly states that the email used here must be working. Even when privacy is enabled it just redirects to the set email. If that is not available i dont really see the issue when they shut it down.

127 points by pieterhg 10y ago

fao_ 10y ago

"ICANN and IWILL"

So, not only did you let the subsciption lapse, you didn't keep the crucial and important contact information up to date? The information you're informed how crucial is for your continued ownership of the domain? Owning a domain is not a right, it's a business relation. Treat it as such and know the what and how of it. If I don't pay the yearly fee on my car, they'll take the plates - should I make an angry blog post about they should "ask me nicely"? And hey, you can preorder my book btw...

pieterhg 10y ago
> So, not only did you let the subsciption lapse No, where do you read this? I paid for my domain. NameCheap's WhoisGuard expired, contacts changed to old ones I didn't use from 3y ago. The domain was paid for. My "business relation" with ICANN was paid for. > If I don't pay the yearly fee on my car, they'll take the plates. No, I paid for the domain. They took it hostage because my 3-year old email wasn't confirmed. That's not about a business relation. That's bad "business" behavior.
- hvidgaard 10y ago
  You let the WhoIsGuard lapse, you explicitely write so. It's your responsibility to ensure that your contact information stays updated in this case. I really don't see the problem. ICAAN does many things wrong, but this was not one of them.
Luc 10y ago
> If I don't pay the yearly fee on my car, they'll take the plates - should I make an angry blog post about they should "ask me nicely"? Renewing a passport at my city hall used to take several visits, often with a long wait, during business hours. After enough people complained the procedure was mostly moved online, with optional Fedex delivery of the passport. So, you see, these business relations are not set in stone, it's just that they were formulated for maximum convenience of ICANN, without consultation of domain owners...
- hvidgaard 10y ago
  I compeletely agree, but in this case the OP did not stay on top of the contact information, and it cost him a lot of issues and lost work. ICAAN does many things wrong, but this was not one of them. Keep the contact information updated, it is not that hard.

abricot 10y ago

"I didn't update my contact information, so now I can't be contacted. How dare you"

fnord123 10y ago
"Why didn't any of ICANN's 340 employees who manage 6.5 million domains (~18571/person) call me personally to discuss how I would like to work through my fuck up? The monsters."

realusername 10y ago

I don't even get why would would need any contact info on a domain in the first place? It's just supposed to map ips to names, it should be registrable without anything but an email address to recover it if needed.

nicolas_t 10y ago
In practice the contact info is so that some companies can spam you with offers for SEO services and other stuff along with all the other typical spams you get.
- Macha 10y ago
  The best one is I own a domain that is basically <my name>.Com A couple of times a year I'll get an email asking me if I'm interested in buying a domain like <mky name>.com for (the one that quoted a price) $1000. Usually just ignore them.
nicolas_t 10y ago
In practice the contact info is so that some companies can spam you with offers for SEO services and other stuff along with all the other typical spams you get.

owenwil 10y ago

Idk... it seems kinda fair of ICANN. Using something on top of your domain like WHOISGUARD rather than... just the one that's included at your registrar is odd, let alone not keeping email addresses alive. Annoying, yes, but this happens to everyone!

Vendan 10y ago
whoisguard is namecheap's whois anonymization service: https://www.namecheap.com/security/whoisguard.aspx https://www.namecheap.com/security/whoisguard.aspx

turbohedgehog 10y ago

Honestly I'd blame Namecheap, not ICANN. My registrar was much more relaxed - I did not need to take any action Please take a moment to view the WHOIS listing for each of the domain names you currently have registered through us. Please verify your mailing address, email address, and the administrative and technical contacts assigned to each domain name are correct. If your WHOIS information has changed or is inaccurate please log into your account manager and update accordingly. If your WHOIS information is correct, you do not need to take any action.

aeden 10y ago
This is a bit different, and it's possible your registrar is not yet using the latest RAA (Registrar Accreditation Agreement). Specifically, the email you're talking about is the once-a-year verification email that all compliant registrars must send. The OP was dealing with a new rule which is part of the RAA 2013, which adds the requirement for verifying emails within 15 days of any registrant change that impacts either the name or the email address of the registrant. (Edited to fix typo for RAA)

deleted 10y ago

[deleted]

ronalbarbaren 10y ago

That happening when someone or organization hold too much power. Not only ICANN, Verisign which manage .com and .net then price of .com .net .org.... increase per year. http://lmgtfy.com/?q=verisign+.com+.net+price+increase http://lmgtfy.com/?q=verisign+.com+.net+price+increase

woliveirajr 10y ago

If I understood correctly: - the user has made some mistake about some auto-renew feature, so that it didn't work smooth and has fallen to the previous known state (=using his real information) > For some reason, WhoisGuard wasn’t set to renew and it expired. - because of that, he didn't notice he was receiving e-mails, since it was an e-mail address he hasn't used for years. > Because I’ve been using WhoisGuard for years, I haven’t used the old email (...) that USED to be set as the contact BEFORE (...) This email wasn’t connected to this domain for 3 years. So when it switched back, I never got ANY of ICANN’s verification request emails. - Well, his old e-mail probably got the e-mails. He just didn't check it because he didn't access the old e-mail. ICANN now verifies every change in the whois information by sending an e-mail (something that I regard as a safety measure, because, well, when you register, you must inform a way to be reached, and e-mail is a reasonable way to do it): > The problem is (1) their emails look like SPAM and often end up in SPAM folders (2) who uses email these days anyway? (3) they often send them to old email addresses. Or, in other words, my e-mail provider filters e-mails automatically (samp rules), who should use e-mail when e-mail is the official way to be contacted about your site (huh?) and ICANN send e-mails to the old address (which is the one he informed when he registered his site). I'm not sure, perhaps I misunderstood something, but the problem seems to be caused: - by the user: now using auto-renew, not updating the whois information, not checkin the e-mail regularly (or having some forwarding rule to the e-mail he uses today) - by the WhoisGuard, if the auto-renew was disable by mistake of the site, not from the user - by Gmail (?), by having spam rules (?) And I don't know where it wa a ICANN error. Sorry, but I don't see a real problem here. The user lost his site for few days, ok, but due to some mistakes he made.

Luc 10y ago
> The user lost his site for few days, ok, but due to some mistakes he made. Only if you take ICANN's procedures as a given. They could have adapted one of dozens more customer friendly ways of dealing with this, but they don't have to because they're ICANN and they can do this with impunity.
- pieterhg 10y ago
  Exactly. There's lots of ways to do this better. For example contacting the registrar (NameCheap) and finding another contact on the domain (or my NameCheap's official account's email) that does work. There's ways besides shutting down somebody's entire business. Which seems like a power move, if anything.

cdubzzz 10y ago

> I have about a hundred domain names. How can you expect me to check my inbox daily and click a link for all these domain names. It’s not 1995. This is not realistic. The consequence of shutting down someone’s business if they don’t confirm their email is way too crazy. I'm not a particularly big fan of ICANN's process here either, the same thing has happened to me before and it was very annoying. But "I have lots of domains" and "who uses email anyway" are extremely poor excuses. Having lots of domains seems like about the most logical reason one should be on top of this sort of thing.

salesguy222 10y ago
If the government required you to click a link every time you bought something online, and upon failure to click, they confiscated it, would you feel the same as you do now?
- tankenmate 10y ago
  But here's the thing, you don't actually buy a domain name; in other words it's not property. Also, your registering a domain name is contingent on agreeing to the registrar's conditions, and some of those conditions are required to be there by the registrars agreement with ICANN. So you are entering into a contract. If you buy a car and park it directly in front of a fire hydrant and forget about it, then the government will seize your car until such time as you pay your fine, the towing fee and storage fee. If you register a domain in contravention to the agreed contract then ICANN will seize your domain until such time as you correct it (including the time it takes to confirm that you have complied). It really isn't that strange.
  - salesguy222 10y ago
    But what if the contract is unreasonable? Blocking a fire hydrant is an understandable problem and is handled in a decentralized manner (either a ticket you can plea to after the fact, or someone tells you to politely move your car) seizure and then negotiation is an unnecessary show of force in my opinion, unless the site was doing something criminal

Sir_Cmpwn 10y ago

Strange to see everyone sticking up for ICANN here. I'm of the opinion that their rules about WHOIS are harmful. Even if you think that the information should be kept accurate and up to date, is the appropriate recourse for ICANN to really have the site taken down until its resolved? Maybe as a measure of last resort. I would personally wait until they try to renew the domain and make them update the info then. Another problem is that since WHOIS data is public it's not effectively possible to run a website anonymously. I'd be okay with sharing contact info with limited parties (ICANN, registrar) but forcing people to share this info with the public is nuts. It makes running a website as an individual much more personally risky.

woliveirajr 10y ago
And you can think about the other way round: and if a site is doing something wrong, like distributing software, spreading a copy of your book, sharing unconsented nudity, and the list goes on... should you be able to hide behind anonymity?
- Sir_Cmpwn 10y ago
  I would be consider allowing the records to be made available in court by judicial order (i.e. a subpoena). Still not public. Also, what the servers are doing isn't the domain's business. Traceroute the IP and bring it up with their ISP. Killing the domain isn't going to kill the availability of the content.
  - yosamino 10y ago
    ... Enter CloudFlare. You're now dealing with a scammer hiding behind Anon-DNS and a Server behind CloudFlare. The situation is now this: > what the servers are doing isn't the domain's business > what the servers are doing isn't CloudFlare's business The Anon-DNS provider doesn't feel responsible, CloudFlare doesn't feel responsible (while at the same time hosting the authoritative DNS). I can't even tell which jurisdiction these spammers operate from, so it's kind of impossible to do anything about it. God I hate receiving these stupid "We are just a reverse proxy, we are not responsible" emails from CloudFlare. They most these clowns will do is forward my contact info to the ISP running the criminals' backend servers, which might very well be these same criminals. Thanks for nothing CloudFlare.

blfr 10y ago

Is this particular implementation of the email verification mechanism really required by ICANN? My registrar (OVH) sends an email that requires no action if the contact information is correct.

jack_arleth 10y ago

As somebody who worked for a company selling domain-names and being responsible for the registration and renewal of domain names; this sadly enough is a very familiar situation. ICANN in my humble opinion has no blame in this, they are simply following the rules that they set out and OP agreed with when he registered the .com domain name. As stated in other comments keeping your WHOIS information is the sole responsibility you have when owning a domain name. That and timely renewing the domain of course. In my somewhat limited experience the WHOISGUARD system is something that only causes problems. It's a pain to work with when transferring or trading a domain name and upon expiration can result to the exact situation that OP currently in. To add, I'm somewhat weary of a site that hides it's owner. The whois data can create a certain form of trust and serve as a verification to ascertain the owner of the site is who he claims to be. I'm not sure why you would want to hide this data. A .com domain has the option to register the domain in the name of a corporation, thus removing the personal data of the owner (name and email) and only showing the name of the company, it's data and a administrative e-mail address in a minimal setup. As OP has; and I quote; "about a hundred domain names", I'm not sure why no company has been formed to solve this problem for all these domain-names. I personally think that the WHOIS system is one of the best ways to solve the problem that domain name registration poses. It's accessible for anyone, anywhere, in plaintext and without the need for special software. It's actually pretty great. Edit: typo's

salesguy222 10y ago
Thank you for your insight. I mean this comment seriously, because it is the only reason i don't run more websites: what happens when my site gets very popular and lucrative, and someone uses my whois info to rob me in my home?
- aeden 10y ago
  Don't use your home address in whois, period. Use a business address. If you have a site that is lucrative then you have enough to pay for a PO box or an office space. There are plenty of companies that will provide on demand office space and take and forward mail for a couple hundred dollars per month or less.

meagher 10y ago

Good news is a bunch of people just checked their WHOIS email address. Other than the click-baity headline and book plug at the end, I think it's spot on.

return0 10y ago

It's easier to just put fake name and address in the required fields. Only the email is used for verification. This is a stupid requirement anyway. The fact that whoisguard exists is testament to it.

openplatypus 10y ago

I am disgusted by ICANNs approach here but not to spare NameCheap: If WhoisGuard expired, shouldn't they update the domain WHOIS data with his current contact details. I can't imagine levels not having up to date email address with his account. So if I am correct, WhoisGuard expired, record reverted to original one. But domain is still registered via NameCheap. NameCheap should use levels current details. Not the one from 5y ago.

micah94 10y ago

Simply put, you need a better registrar. Namecheap should step up and edit your contact info to whatever you want, push out that ICANN email again, and let you ack it. We've done this many times for customers. We also don't charge $5/yr for domains. But you get what you pay for. Sorry if this sounds harsh, but these things happen all the time with cheap i-services. If your business is a little more important, you need to pay a little more for exceptional cases like this.

deleted 10y ago
[deleted]

robalfonso 10y ago

I'm in the registrar space. A few observations. The process overall is not great, but ICANN's process didn't fail this customer. The customer needs to keep contact information up to date. If you own 100+ domains you should be very familiar and have your own process for managing this. Its been this way since 2013. The process to shut down a site is quite thorough in that many attempts at contact need to be made. I'm a little surprised a phone call wasn't generated. By the time we've emailed you 3 times - we are making a phone call - we don't want to shut down a site if its at all avoidable. This "24-48" hours stuff is nonsense - The suspension/un-suspension of a domain can be done almost immediately. It remains to be seen but NameCheaps only potential issue here is whether they failed to renew the WHOIS privacy service.

k-mcgrady 10y ago
>> "The customer needs to keep contact information up to date." I own a few domain names and they ask me to update this info one per year. I've never understood why they need it at all though. Why should they have my address/contact info and why should it be publicly available? I'm sure the answer is obvious but I can't figure it out.
- robalfonso 10y ago
  First, thats the way it is - so knowing that you need to keep the information up to date. Regarding Why - ICANN runs on a multi stakeholder model, meaning governments and legal entities get a seat at the table too. They have an interest in knowing who is behind a domain - its that simple. Also whois privacy is not the protection everyone thinks it is. Its a lock on a door. It keeps casual looks out - spammers, scammers, etc. If a government or police organization wants that information and they have legitimate need to do so, they will get it.

laegoose1 10y ago

Aliyun asked me via email to send them ID copy, credit card copy, credit card statement for last 3 months in 24 hours otherwise my account would be shut down. I did so in 39 hours because I don't check that email account very often. All my running instances were shut down in 2 weeks without additional warnings. Only emails I got from them were about 20$ coupons for referral. As support later explained, I did not meet 24 hours deadline. (AWS haves me as customer last 4 years with 10's of thousands USD spent yearly and never asked for ID or credit card copies).

Keverw 10y ago
Wow. I wonder if that's a PCI violation to ask for a credit card copy via email... Doesn't sound very secure to me.

Nanite 10y ago

While I understand the sentiment, the author's analogy is bit off. ICANN is not the maffia, they are however in effect an institutional bureaucracy. Throwing a Medium hissy fit probably won't make them move any faster to resolve this.

drivingmenuts 10y ago

> No Pieter, you should read your email more carefully, this is a consequence of your messiness. Yep. End of story.

tzs 10y ago

> I have about a hundred domain names. How can you expect me to check my inbox daily and click a link for all these domain names. Why would you have those mails go to your inbox? Why not have something in your incoming mail filters that looks for them and moves them to a mailbox dedicated to domain admin mails? It's way easier to monitor that way, and harder to miss something in the noise.

dpedu 10y ago

You misconfigured your domain and as a result did not receive important communication sent to it. What's the controversy?

Mattasher 10y ago
I'm not sure if this is a genuine question, but if so, the controversy is this: Why should ICANN have the power to suspend your domain name in the first place? How does the Internet get better by having an organization that can terminate your key business (or personal) asset just because you missed (or misread, keeping in mind not everyone is fluent in English and everyone is wary of scams) an email they sent you?

deno 10y ago

NameCheap did the same thing to me, except it was even worse because it was on a domain name I purposefully let expire (I didn’t want it anymore). But instead of letting it expire with the Whois Guard data they changed it to my real data and essentially doxxed me right before it expired. Here is the email I got from the support: ---- Hello, Thank you for contacting Namecheap Support! Please accept our sincere apology for any frustration this issue may have caused you. Let us just clarify the issue: WhoisGuard protects domain contacts 7 days after expiration. After that WhoisGuard is disabled and depending on TLD contact details may or may not be displayed. Therefore these details are not mentioned in the quoted message. We would like to assure you that we have forwarded your feedback regarding the issue to the corresponding department and they will consider implementing it as soon as possible. The TLDs provided below usually have their contact details revealed in 7 days: .us.com ; .de.com ; .pw ; .website ; .press ; .host ; .online ; .space ; .io ; .co ; .me ; .info ; .biz ; .link ; .xyz ; .site ; .london ; .club ; .design ; .rent ; .college ; .tech ; .cn.com ; .eu.com ; .gb.com ; .gb.net ; .uk.com ; .uy.com ; .hu.com ; .no.com ; .qc.com ; .ru.com ; .sa.com ; .se.com ; .se.net ; .za.com ; .jpn.com ; .ae.org ; .kr.com ; .ar.com ; .us.org ; .com.de ; .wiki ; .fans ; .com.se ; .gr.com ; .jp.net ; .la ; .rest ; .bar ; .ink ; .co.com ; .love ; .br.com ; .uk.net ; .hu.net ; .in.net ; .mex.com ; .theatre ; .security ; .protection ; .cloud ; .top ; .us ; .bid ; .trade ; .webcam ; .men ; .black ; .pink ; .blue ; .red ; .kim ; .shiksha ; .lgbt ; .poker ; .pro ; .accountant ; .download ; .loan ; .racing ; .win ; .review ; .date ; .party ; .faith ; .cricket ; .science ; .mobi ; .voto ; .vote ; .green ; .mom ; .porn ; .adult ; .vegas ; .global ; .sex ; .irish ; .bz ; .vc ; .game ; .asia ; .stream ; .com.bz ; .net.bz ; .com.vc ; .net.vc ; .org.vc ; .krd ; .film ; .one ; .sydney ; .melbourne ; .study ; .audio ; .blackfriday ; .christmas ; .click ; .diet ; .flowers ; .gift ; .guitars ; .help ; .hiphop ; .hiv ; .hosting ; .juegos ; .lol ; .photo ; .pics ; .property ; .sexy ; .tattoo ; .xxx As a possible work-around it is possible to have an active domain removed from your Namecheap account. So if you have any non-expired domains in the account and you do not wish to renew them, you can just contact us and we will remove them. As a result, your contact details will be substituted with the ones of Namecheap and they will be shown in Whois. Should you have any questions please do not hesitate to contact us again. ---- Needless to say I won’t do business with any company that doesn’t take privacy of their customers seriously. They don’t even warn you Whois Guard is about to expire.

iProcrastinate 10y ago

Didn't Obama give complete control of ICANN to the United Nations recently? Was he just feeling super generous to other countries because I suse wasn't on board with that idea. :(

caryhartline 10y ago
This is not true: https://qz.com/761219/in-44-days-the-us-will-no-longer-oversee-the-internets-naming-system/ https://qz.com/761219/in-44-days-the-us-will-no-longer-overs... The entire overview of the decision is in the article. Essentially, one piece of how the Internet was managed was handed over from the U.S to ICANN. The reason is fairly straightforward; the federal gov did not feel the need to manage this thing for which there was no need for them to manage it.

db48x 10y ago

Given the realities, automation is the only real solution.

saaaaaam 10y ago

"I forgot to pay a bill basically because I forgot to check it was set on auto renew. It was for the landlord of my office space. She emailed me but I forgot to give her my up to date email address a while back - I never hear from her normally, and tbh communications about this sort of stuff are pretty low level so I shouldn't have to worry about it. Each week I need to do about two things to do with the admin of my tenancy here in the office building, the landlord emails me about trivial stuff - checking things, making sure that that new guy who said he worked for me didn't get a set of keys to my office space, updating things. TWO THINGS A WEEK! I don't have time for that. So now I'm super pissed off and people are starting to say I'm maybe not all that professional for letting stuff like this slide."

will_hughes 10y ago

ICANN as a whole is a pain in the ass to deal with. We had one of our domains taken hostage because the whois information pointed to our support@ address, and the support staff thought it was spam. What it's supposed to help, I don't know - because accurate registration information really doesn't seem to be a whole lot of help to anyone except perhaps ICANN themselves. Anonymising services or not, nothing on WHOIS needs to work except the email address, and that can be a random gmail address, the only thing you ever need respond to is ICANNs email. It certainly doesn't help in trying to identify or contact the real owner of domains. Another gripe with ICANN is that they're zero help when trying to take down scamming/spamming domains. Adding to that, many registrars simply don't give a shit about what their customers are doing with the domains they register. At work we own <ourcompanyname>.com and the local equivalents in pretty much every country. Some scammer purchased <ourcompanyname>.<new-generic-tld> and used that in fake job ads (the 'We need a support person in <country> to process payments' etc type). The ads get taken down pretty quick (job boards are familiar with this) but not before enough people are emailing jobs@ the scammer's domain. We only heard about this because a few people emailed us pissed about the scammy behaviour. We contacted the hosting company, domain registrar (both the reseller and the actual registrar), and Donuts, all of whom either completely ignored us, or said fuck off talk to ICANN. Even having our lawyers send a C&D letter to all the various parties got us nowhere. (Hosted in Russia, registered to a fake address in NYC, etc). ICANN won't touch it without us spending up to submit a dispute, which we did, but it takes them months to process and each domain costs something like USD$1500 to dispute. In the months while the scam was active, we got something like 100 people contacting us to report it, god knows how many actually fell for it. While we're in the process of disputing that, the smartass registers a couple of new generic-tld domains and starts using those.

codycraven 10y ago

I've encountered a similar situation where I never received an email or written letter (my contact information was correct in WHOIS). Suddenly I noticed I'm not receive emails for the affected domain, I check the site and is down. I reach out to my registrar who tells me it's a new ICANN policy and that I should have gotten an email...

herbst 10y ago

While this stucks ICANN clearly states that the email used here must be working. Even when privacy is enabled it just redirects to the set email. If that is not available i dont really see the issue when they shut it down.