Domain Name Registrar’s Bankruptcy Threatens 70,000 Domain Name Owners

A new threat explodes in the digital India scenario, and it is not information warfare, or election influencing or cyber attacks from our “friendly neighbors”, but a sort of nuclear fallout.

The liquidation of domain registrar Messrs net4 may result in the non availability of thousands of websites, emails of a number of large companies.

In a meeting early today morning, one large IT corporation and a couple of individuals expressed their pain and frustration at their inability to redress their situation – cannot transfer the domain, cannot renew etc.

At stake is the digital business and survival of about 70,000 (or more) organizations which may soon face outages as the company is being liquidated. Leading companies have registered their domains and may not be aware of the situation.

Classify Domain Name Registry as Critical Infrastructure

This is also critical national infrastructure as every domain registrar operating in the country is an intermediary, as custodian of the domain registry and more.

At one fell stroke, 70,000 (or more) organizations will go off the network – no need for a state or non-state actor to attack us! This is the fallout of an implosion which started way back in 2013 but did not raise any red flags in the relevant government offices.

The 70k domains include big names corporations, banks etc and they are organizations which constitute the definition of critical infrastructure.

Not protecting their digital presence is akin to scoring a self goal.

Call for protection

This situation requires an urgent and immediate intervention by NCSC, CERT-IN, NCIIPC, MEITY, NIXI together to decide on a course of action. Later it can be decided who will take NET4 home.

In the financial sector, Yes Bank was bailed out by SBI and is being brought to its feet. A similar strategy can be adopted and Net4 domains can be transferred to NIXI for management.

The reason for immediate intervention is to protect the domain name owners and availabiltiy of their digital infrastructure which is threatened by the lack of presence in the list of assets up for auction. And, the standard path taken by the Resolution Professional (RP).

Assets listed are the usual land, building, machinery and no one seems to be thinking about the life and livelohood of 70k entities which are tied in.

The NCSC should step in to save the day by facilitating the transfer out of domain names from Net4 for all those who are presently living under the threat of outage.

The Solution

NCSC / NIXI / MEITY can engage with the RP and have net4 folks to facilitate domain transfers by domain name owners.

In order to transfer the domain, the owner requires the registrar to provide a code which is passed on to the new registrar – it seems this is not happening and there is no reason for net4 to stop this action (it is usually automated).

If the transfer process code generation is not happening, it implies that they have tampered with th backend automation.

Another Fraud in the Making

Yes ! The Net4.com website is (shockingly) still working offering services as if it was just another sunny day. There is no announcement on the website about the debts, frauds, ICANN suspension or impending auction.

They are continuing to register domains (I was able to go through the process to search,add to cart and checkout). I wonder what will happen to the new registrants.

Net4India is one of the earliest domain registrars in the country (established in 1985) went belly up due to frauds and was declared an NPA by State Bnak of India in 2013. The founder was arrested in 2014 for tax fraud, and later ICANN suspended their domain registration business due to the insolvency proceedings etc..

References to net4

While I have taken this issue now, my friend Naavi had flagged this risk long back. He has been actively writing about this, calling attention. Alas, no one seems to be listening to this call.

https://www.naavi.org/wp/further-developments-on-net4india-since-yesterday/ from this blog you can check out the previous warnings.