Dear At-Large folks, In 2008 KnujOn published a report indicating that 70 ICANN accredited Registrars had no publicly disclosed business location (http://www.knujon.com/news2008.html#06102008). The fundamental problem was one of community trust and consumer faith. Registrars extend their legitimacy to their domain customers who then transact and communicate with the public. It is difficult enough when registrants conduct illicit commerce and wrap themselves in mystery, for a Registrar to do the same shames the entire industry. Much to our shock, we found that Registrars were not required to publicly disclose their address. Since then the ICANN Registrar directory (http://www.internic.net/alpha.html) has been updated to include all the addresses and the Registrar Accreditation Agreement (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm) has been amended to include the following language: “3.16 Registrar shall provide on its web site its accurate contact details including a valid email and mailing address.(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3)” But what constitutes a “valid mailing address” other than it can accept mail. This probably would have been better worded as “valid business address” as we recommended (http://www.knujon.com/news2008.html#11022008), but that will have to wait for the next round of RAA changes. In the meantime we ask the question, does it support openness and accountability if the gatekeepers of domain registration run out of public mailboxes? Some may immediately argue that it is an immediacy of running a small business since they may not have to staff or facilities to accept mail. And I would guess this would be the case for companies like Domain Monkeys, LLC who use a P.O. box but have a real brick-and-mortar shop just up the street. The same goes for DomainsToBeSeen.com, DOMERATI and Sundance Group. But we are puzzled by Hosting.com, Inc., which has a P.O. Box in Kentucky when their business is really in Colorado. Honestly, the issue disappears if the Registrar clearly posts its business address where consumers can find it. Enetica Pty Ltd uses a PO box in Australia but clearly states its street address on their website. Contrast this with DomReg Ltd. (AKA LIBRIS.COM), which runs from a PO box in Russia and has no other contact information posted on its website not even a phone number. Now, we have many Registrars using P.O. boxes in the Cayman Islands and other Caribbean locations. DirectNIC, LTD, AKA Intercosmos, used to have an address in New Orleans but now has a PO box in the Caymans. Bargin Register also has a Caymans PO box listed as their address. It has been explained to us multiple times that “all addresses in Caymans are PO boxes,” but this is only partly true. For the purposes of mailing in the Caymans PO Boxes must be used, however, all businesses do in fact have street addresses. Example, The Royal Bank of Canada in the Caymans lists two addresses on its website: 24 Shedden Road, George Town, Grand Cayman (street address) and PO Box 245 Grand Cayman KY1-1104 (mailing address). In this case the Registrar can and should list both addresses but DirectNIC and Bargin Register do not. And then there are “suites.” Suite is a deceptive address term since it could mean a leased space in an office building or hotel, but suite is also the term UPS and other private mailbox services use to refer to their rented postal boxes. There are at least a dozen Registrars with suite numbers in their addresses that need to be clarified. Estdomains ran out of a Delaware proxy address and business registration. This was part of their overall policy of hiding any information concerning the true nature of the Registration business (http://www.informationweek.com/news/services/data/showArticle.jhtml?articleI...). Secrecy and misdirection are primary indications of potential fraud. Of course all of these issues are moot in the face of a falsified address as in the case of Parava Networks, AKA 10-Domains (http://www.knujon.com/news2008.html#07222008). Parava were later de-accredited for other contract violations (http://www.icann.org/correspondence/burnette-to-valdes-27feb09-en.pdf). In the name of accountability and transparency we need to know that the Registrars are legitimate companies and the first step is identification. This brings us to the most extreme case of location obfuscation: OnlineNIC. OnlineNIC claims to be in the U.S. but they are not. The California address they feature on their website and in the ICANN directory is an auto-body shop or barren lot (http://dotsnews.com/domain-name-news/184). There are two other addresses they use and one is a residential address with no apparent business taking place. The second is an office building, but we could not find OnlineNIC there, but we did find a UPS Store. There are actually more red-herring California addresses for OnlineNIC, but the point is made. It is no surprise to many people that documents related to OnlineNIC lead back to Hong Kong and ultimately to mainland China. Does ICANN even know where OnlineNIC really is? Why are they pretending to be in the United States when other Chinese Registrars operate with full location disclosure? This is a shameful charade that has mislead consumers for too long. We’re calling for OnlineNIC to publicly disclose their address and for ICANN to post that real address in the directory. Address disclosure is critical to consumer trust and ICANN’s pledge of transparency and openness. The public should see the same address used in Registrar accreditation applications. More info: http://www.circleid.com/posts/should_a_domain_name_registrar_run_from_a_po_b... Thanks for your consideration, Garth ------------------------------------- Collect, analyze, enforce, repeat... Garth Bruen gbruen@knujon.com http://www.knujon.com http://www.linkedin.com/pub/4/149/724 Linkedin Group: http://www.linkedin.com/groups?gid=1870205 Blog: http://www.circleid.com/members/3296/ Twitter: @Knujon