Will ICANN take action against "worst" Chinese registrar?

Last month, the Internet Corporation for Assigned Names and Numbers (ICANN) was the target of a public complaint that it wasn't doing enough to fight spam and bogus websites. The complaint was made by anti-spam service Knujon (see disclosure at the bottom of this post), which suggested that most spam-related websites were funneled through 20 ICANN-approved registrars based in the United States and overseas. The company said that ICANN, despite being repeatedly notified that the registrars' WHOIS records were filled with false address and contact information for millions of spam sites, did not follow its own mandate to force WHOIS compliance among the worst offenders.

Now, Knujon founder Garth Bruen has formally requested ICANN to shut down the Beijing-based registrar at the top of the list, Xinnet Bei Gong Da Software. According to a new document that Bruen sent to ICANN this week, none of the WHOIS records in a sample of 11,000 alleged spam sites registered through Xinnet and reported by Knujon to ICANN's Whois Data Problem Report System were corrected in a six-month period ending in May 2008. In many cases, says the document, Xinnet does not have "any Whois record data for review while the sites are still active."

I verified that the samples in the new document that Bruen used to make his point -- fallspot.com, finest-favorite.com, kheenerso.com, mountainfavor.com, rsavefu.com, tioakjiopa.com, exellentquality.com, polaebrue.com, orderheres.com (see inset), keesnerrt.com, killsioe.com, hiaoteyy.com, vijeast.com, and tinescoz.com -- were indeed spam storefronts for replica watches and online pill merchants. Two other sites, sugarfrom.com and blackcame.com, were down when I tried to access them on Friday. All were registered through Xinnet, although in more than half the cases, there was no WHOIS contact information listed. A few others had obvious fake names and contact information, such as Fallspot's "David Fox," whose listed Chinese phone number ended in seven zeroes and had an email address of "test@test.com."

Among the handful of sites that did include real-looking contact information, most email addresses and phone numbers turned out to be bogus. The exception was the identical hotmail email address for tinescoz.com and hiaoteyy.com -- a Chinese-language email sent to the address has yet to generate a bounce-back or response. For the working phone numbers at polaebrue.com (shared with orderheres.com) and tinescoz.com, there was a dial tone but no answer. However, the calls went through on Friday evening in China, and it's conceivable no one was available to answer. I was unable to verify any of the legitimate-looking physical Chinese street addresses listed in the WHOIS records for kheenerso.com, mountainfavor.com, polaebrue.com, orderheres.com, hiaoteyy.com, or tinescoz.com.

Bruen claims that Xinnet is still allowing spam sites to be registered -- "typically about 100 per day," says the Knujon document. His recommendation to ICANN is severe:

"Given the listed issues we are recommending that Xin Net be issued a breach notice and that until these issues are resolved they be prevented from registering new domains. The failure to comply with requirements to have accurate records, the blatant and continued posting of illicit traffic sites, and possible blocking of access to Whois records point to a complete failure at Xin Net to accept its responsibility as a registrar.

We believe that this situation poses an immediate health risk to Internet consumers and since Xin Net will not take proactive steps to prevent repeat offenders from registering fake pharmacy sites, stopping all new registrations is the only way to break this cycle of illicit site registration and faux compliance."

When asked for comment, the ICANN spokesperson issued the following statement: