February, 2009 Registrar Report

 In May of 2008 KnujOn released a controversial report highlighting Registrars that have a concentration spam, abuse and illicit activity. The report, and follow activity, had a profound and lasting effect on the Registrar world and Internet abuse. We are refreshing this report with data collected after June, 2008 to examine changes. One thing that has not changed is the fact that most abuse is concentrated at a minority of providers.


83% of the Illicit Sites Tracked by KnujOn Clustered at 10 Registrars.


Who are these 10 Registrars?
  1. XIN NET (Second Time at #1) Detailed Report
  2. eNom Detailed Report (part 1), (part 2)
  3. Network Solutions Detailed Report
  4. Register.com Detailed Report
  5. PLANETONLINE
  6. RegTime
  7. OnlineNIC
  8. SpotDomains (domainsite)
  9. Wild West
  10. HICHINA Web Solutions
However, there has been a marked change in the specific list. Who is not on the list is just as interesting as who is on the list. compare the current list with the first one:
  1. Xin Net Bei Gong Da Software
  2. Beijing Innovative Networks
  3. Todaynic
  4. Joker
  5. eNom, Inc.
  6. MONIKER
  7. Dynamic Dolphin
  8. The Nameit Co/AITDOMAINS.COM
  9. PDR/Directi
  10. Intercosmos/DIRECTNIC
So what happened to the Registrars not on the new list? For starters, Beijing Innovative Networks and Joker were issued Breach Notices by ICANN. They were basically told to clean up their operation or risk loosing accreditation which would effectively take them out of the domain industry. From what we've been told by ICANN they took the notices very seriously and made changes to their operation. TodayNIC contacted us directly and assured us that they were aware of some issues and were working aggressively to fix them. After various revelations about Dynamic Dolphin surfaced and successful lawsuits against Scott Richter concluded, their name came up less and less. Directi furiously defended themselves in light of this report and others, but their presence in these statistics was likely driven by two factors: a contract with the failed EstDomains and certain resellers who were abusing Directi's service. Since then Directi has terminated thousands of illicit domains. Moniker was highly critical of KnujOn's report but apparently was influenced by it one way or another because their counts dropped as well. Intercosmos/DIRECTNIC has been suspending every domain found with a policy violation. The change at The Nameit Co. is the only unknown factor at this time.[Update: 04.10.09] A careful read of ICANN's Contractual Compliance Semi-Annual Report shows Nameit/AIT is under investigation by ICANN. The following paragraph is from that Report.

Since July 2008, ICANN continued to follow-up with seven registrars to elicit responses to the audit. Four additional registrars responded to ICANN’s request to provide a reasonable level of assurance that they had taken steps to correct Whois data inaccuracies. (refer to Figure 4-1). Three registrars - Beijing Innovative Linkage Technology Ltd., dba dns.com.cn (Beijing Innovative Linkage Technology), Advanced Internet Technologies, Inc. (AIT) and Parava Networks, Inc, dba 10-domains.com (Parava) - were not in compliance. ICANN sent breach letters to Beijing Innovative Linkage Technology and Parava. Staff is continuing to investigate AIT and considering issuing a breach letter. Beijing Innovative Technologies recognized that by failing to take reasonable steps to correct Whois inaccuracies they breached the RAA. Subsequently, they agreed to participate in a compliance remediation plan. (icann.org)



This leaves us with the two holdovers: Xin Net and eNom, Inc.. Neither company responded to this report nor did they take verifiable steps to curb the cited abuses. In the case of Xin Net, their numbers were much worse than Beijing Innovative Networks, but for reasons unknown to us they were not issued a breach notice by ICANN even though we recommended it.

On to the new list, but before we go into specifics a few things need to be stated. First, to us these numbers indicate a problem at the cited Registrar, it does not mean a Registrar is criminal or evil. Far from it, we believe this is a question of effective controls and good policy. Registrars may lack adequate abuse staff or awareness of the problem. Some simply do not know who their bad customers are. It is important to understand that these problems can be fixed! To this end, each Registrar in the report has been contact by us with a list recommendations fixing problems, including specific abusive customers and illicit domains they need to dump to make things better. We realize that this is no small order and are prepared to offer assistance to any Registrar wanting to clean out the bad elements.

Let’s start by looking at the entire spam picture and its relationship to the Registrar world. We find that the spam traffic appears clustered at a small number of Registrars, ten to be exact, have 82.90% of all the spammed domains.

In trying to understand why this might be the case, the ten in question must be examined more closely and ranked.

We use four indicators to rank Registrars in relation to spam traffic:
  1. The raw number of domains held by the Registrar advertised in spam
  2. The number of spam messages used to advertise those domains
  3. The percentage of the whole Registrar portfolio that the spammed domains represents
  4. The rate of spam messages per spammed domain
Each count tells us something different and important, but no single number tells us the whole story. We are attempting to give each Registrar the benefit of the doubt and to take into consideration their individual effect and total market effect.



eNom, far and away has the most number of spammed domains with Xin Net a little behind. However, eNom has a very large portfolio and this must be taken into consideration.



By counting the number of recorded spam messages for each Registrar we see that Xin Net dwarfs the other Registrars in this score.



If we consider the total number of domains held by a Registrar in comparison to their spam rates we see that Planet OnLine has nearly 40% of its portfolio advertised with spam. eNom, which has the highest total spammed domains, only has 0.36% of its portfolio being spammed. RegTime has only 0.32% of the number of Domains as eNom but has 5% of its holdings advertised with spam. This is a concentration in traffic.



The number of spams per spammed domain changes the story once again with Xin Net domains being advertised with an average of 345 spam messages each. Register.com has 59 messages per each spammed domain. Network Solutions and RegTime also hover in the 50 messages per domain area.

To get the final overall rating we added their scores in each of the four areas and averaged them. There were ties in some cases and the ties were broken by examining how many rogue pharmacies a particular Registrar had.

Over the next 10 days we will be featuring one Registrar in this list and highlighting their specific problems, starting with Xin Net tomorrow. The specific numbers are below. Dispute or comment at contact@knujon.com

Registrar Total Portfolio Spam Instances Abused Domains Percent of
Portfolio		 Average spam
per domain
XINNET 1,030,000 -  3,228,041 9,346 0.9 345.4
ENOM 8,840,000 1,294,595 32,610 0.4 39.7
NETSOL 6,630,000 582,583 11,105 0.2 52.5
REGISTERCOM 2,750,000 308,738 5,228 0.2 59
PLANETONLINE 53,202 89,638 20,604 38.7 4.4
REGTIME 29,141 84,123 1,552 5.3 54
ONLINENICINC 1,170,000 61,076 9,624 0.8 6.34
SPOTDOM 363,756 50,244 3,752 1 13.4
WILDWESTDOM 3,240,000 54,203 3,106 0.1 17.5
HICHINAWEBSOLUTIONS 665,170 44,811 999 0.2 44.9