Extortion or Expansion? An Investigation into the Costs and Consequences of ICANN’s gTLD Experiments

Abstract

Since October 2013, the Internet Corporation of Assigned Names and Numbers (ICANN) has introduced over 1K new generic top-level domains (gTLDs) with the intention of enhancing innovation, competition, and consumer choice. While there have been several positive outcomes from this expansion, there have also been many unintended consequences. In this paper we focus on one such consequence: the gTLD expansion has provided new opportunities for malicious actors to leverage the trust placed by consumers in trusted brands by way of typosquatting. We describe gTLDtm (The gTLD typosquatting monitor) – an open source framework which conducts longitudinal Internet-scale measurements to identify when popular domains are victims of typosquatting, which parties are responsible for facilitating typosquatting, and the costs associated with preventing typosquatting. Our analysis of the generated data shows that ICANN’s expansion introduces several causes for concern. First, the sheer number of typosquatted domains has increased by several orders of magnitude since the introduction of the new gTLDs. Second, these domains are currently being incentivized and monetarily supported by the online advertiser and tracker ecosystem whose policies they clearly violate. Third, mass registrars are currently seeking to profit from the inability of brands to protect themselves from typosquatting (due to the prohibitively high cost of doing so). Taken as a whole, our work presents tools and analysis to help protect the public and brands from typosquatters.

Appendix

1.1 A.1 ICANN and gTLD Expansions

In this section, we provide a high-level overview of how gTLDs have been expanded over the years and the role that ICANN plays in regulating these expansions. Since 1998, the Internet Corporation for Assigned Names and Numbers (ICANN), has been responsible for administering the Internet Domain Name System (DNS). This role has included the authority for establishing new top-level domains (TLDs). TLDs have historically been classified into: (1) TLDs reserved for countries and territories (country-code TLDs or ccTLDs), (2) a TLD reserved for Internet infrastructure (infrastructure TLD: .arpa), and (3) TLDs that may be used for other purposes (generic TLDs or gTLDs).

gTLD Expansion Between 1984 and 2012. Between 1984 and 2000, the number of gTLDs increased from five to seven with .net and .int added to the “core” set (.com, .edu, .gov, .mil, and .org). Of these seven, three TLDs – .com, .net, and .org – have always been open to public registration with the other TLDs being reserved for use by specific organizations such as universities (.edu) and government entities (.gov). Starting in 1998, ICANN began considering a more “open” gTLD program which would allow private entities to act as registries and manage new gTLDs. Following a public call for proposals in August 2000 and a two-month period for public comment, ICANN announced seven new gTLDs in November 2000 (.aero, .biz, .coop, .info, .museum, .name, and .pro). The process was repeated again in 2004, resulting in the introduction of six new gTLDs (.asia, .cat, .jobs, .mobi, .tel, and .travel). Between 2004 and 2012, only two other gTLDs – .xxx and .post – were added. By the end of 2012, the Internet had 22 gTLDs – of which 15 were open to public registration. As of August 2013, the 15 additions to the 7 core gTLDs accounted for 3% of all domain registrations while the 7 core gTLDs accounted for 51% of all domain registrations on the Internet (ccTLD domain registrations accounted for 35%) [31].

The 2012–2013 gTLD Expansion. In 2008, citing the success of the previous gTLD expansions in 2000 and 2004, ICANN approved new policies to facilitate the large-scale creation of new gTLDs with the stated goal of “enhancing innovation, competition, and consumer choice” [32]. Following the creation and multiple revisions of a guide for the application process of new gTLDs, in 2011 steps were taken to enable the registration of new gTLDs. These guidelines are still applicable today. In order to register a new gTLD, a registry needs to demonstrate capabilities to handle technical, operational, and business operations related to the handling of registrar relationships and submit a $185K application and evaluation fee [33]. Applications for new gTLDs were opened in 2012 following criticism and protest from Internet societies, including Harvard’s Berkman Center for Internet & Society [34], the Association of National Advertisers [35], and the United States Federal Trade Commission [36] which primarily cited the lack of transparency in the evaluation process, potential for trademark infringement and other generally malicious conduct. By 2013, over 1,900 applications were received of which 1,543 were granted and 1,208 are still active today. Contested gTLD registration applications were resolved by a bidding process. As of July 2016, the ICANN netted a profit of $233M from the bidding process alone [37]. As of August 2018, the 1,208 active new gTLDs accounted for 9% of all domain registrations on the Internet [31]. We note that statistics regarding the registration of new gTLD domains have not been updated on the ICANN website since 2015 and are only available through other third-party services.

Registry Responsibilities and Guidelines. Following the delegation of a gTLD, a registry is required to perform certain responsibilities related to maintenance of the gTLD. A full specification of these requirements is available online [38]. We summarize the requirements that are relevant to our study below.

• WHOIS services. Registries are required to maintain a fully responsive and searchable WHOIS service available via port 43 and through a web-based interface.

• Zone files. Registries are required to provide public access to their current zone files via the Centralized Zone Data Access (CZDA) provider [14]. In order for a member of the public to gain access to the zone file, they need to provide “information sufficient to correctly identify and locate” themselves. These may include an organization name and address, IP address, etc. There is no specified time within which a registry is required to provide a response.

• Protected domains. All registries owning and operating an open gTLD are subject to a sunrise period of 30 days. During this period, domains may only be registered by organizations registered with ICANNs Trade Mark Clearing House (TMCH). Following this period, all domains are open for public registration – regardless of their trademark status and any trademark disputes are to be resolved using ICANN services. All costs associated with disputes, trademark verification, and TMCH registration are to be paid by the trade mark holder. Further, the TMCH will only accept domains as trademarked if the following criteria are met (examples are demonstrated with the organization “ICANN Example”): (1) exact match rule—icannexample.org is a valid trademark domain, (2) hyphen for spaces/special characters rule—icann-example.org is a valid trademark domain. All other domain variations, including plurals are considered invalid (e.g., icann-examples.org).

We note that we were unable to find documents relating to how compliance with these responsibilities were to be monitored or enforced.