.NGO and .ONG Domains Under Review Following Gambling Domain Concerns

The Public Interest Registry (PIR) is currently undertaking a thorough review of domain registrations within its .NGO and .ONG namespaces. This action follows the identification of a significant number of domains seemingly associated with online gambling activities. PIR has also stated that it is exploring the implementation of additional safeguards to prevent future misuse of these domain extensions.

PIR, a reputable non-profit organization responsible for managing the widely recognized .ORG top-level domain, introduced .NGO and .ONG during the 2012 expansion of new top-level domains. The original intent behind launching these extensions was to cater specifically to the needs of non-governmental organizations (NGOs). Unlike the .ORG domain, which is generally open for various uses, .NGO and .ONG were designed to be exclusively used by legitimate NGOs.

However, recent investigations by security researcher Jim Yan have brought to light a concerning trend. Yan’s research identified approximately 500 domains within the .NGO and .ONG namespaces that exhibit characteristics suggesting their use for online gambling operations. Examples cited include domain names such as bet365.ngo and 333win.ong, raising questions about the effectiveness of the current registration and verification processes.

Initially, PIR implemented a robust verification process requiring organizations to provide supporting documentation before their .NGO and .ONG domains could be activated. This rigorous approach aimed to ensure that only eligible entities gained access to these domain extensions. However, in 2020, PIR made a significant shift towards a self-certification model. Under this revised system, registrants are no longer mandated to submit documentary evidence during the registration process. Instead, they are entrusted to self-certify their eligibility. While this streamlined approach simplifies the registration process, PIR retains the right to suspend domains that are subsequently found to be in violation of the established eligibility criteria.

The practical implementation of this self-certification process varies depending on the registrar through which the domain is registered. For instance, Namecheap presents potential registrants with a clear message and a direct link to PIR’s comprehensive registration terms and conditions. This ensures that registrants are fully informed about the intended purpose of the .NGO domain and the eligibility requirements they must meet.

Similarly, GoDaddy, another popular domain registrar, also displays a notice during the .NGO and .ONG registration process, highlighting the importance of meeting specific eligibility requirements. This serves as a preliminary warning to potential registrants, emphasizing the need to comply with the namespace’s intended use.

However, GoDaddy’s implementation of the self-certification process has raised concerns. The registration form primarily focuses on collecting contact information from the registrant, neglecting to explicitly inquire about the intended purpose of the domain or to provide a detailed explanation of the namespace’s inherent restrictions. This lack of clarity could potentially lead to inadvertent or intentional misuse of the .NGO and .ONG domain extensions.

While the overall number of flagged gambling-related domains may appear relatively small, it is crucial to consider the context. The .NGO and .ONG namespaces themselves are significantly smaller compared to more established top-level domains. Currently, approximately 10,000 domains are actively registered within the .NGO and .ONG zones. Therefore, the presence of nearly 500 questionable registrations represents a considerable proportion of the total domain count, raising legitimate concerns about the integrity and intended purpose of these namespaces.

In response to these concerns, PIR issued a formal statement to Domain Name Wire, articulating its commitment to maintaining the integrity of the .NGO and .ONG namespaces. The statement reads:

“We take trust in the .NGO/.ONG space seriously and are investigating the 471 names identified outside of our scheduled audit process to see if they meet the relevant requirements for .NGO/.ONG. We are also examining additional ways to review new registrations to ensure compliance. Responsible engagement like this helps us keep the namespace aligned with its mission to serve nonprofits and civil society organizations around the world.”

While PIR has initiated an investigation, the specific timeline for its scheduled audit process remains unclear. Some of the identified gambling-related domains have been registered for more than a year, suggesting that the current monitoring mechanisms may not be sufficiently proactive in detecting and addressing potential misuse.

Despite these challenges, PIR has demonstrated a proactive approach to combating domain name abuse in the past. In 2021, the organization established the DNS Abuse Institute, which has since been rebranded as the NetBeacon Institute. This institute is dedicated to addressing a wide range of security and trust-related issues within the Domain Name System (DNS), contributing to a safer and more reliable online environment.

Enforcing restrictions on new top-level domains has proven to be a significant challenge for numerous registries. Registrars often express reluctance to impose stringent pre-registration verification requirements due to the added complexity and friction introduced into the registration process. This can potentially hinder the adoption and growth of new domain extensions. To mitigate this issue, some registries, including PIR, have adopted a strategy of shifting towards post-registration verification or regular audits. This approach aims to strike a balance between maintaining domain integrity and encouraging broader adoption of the new top-level domains.

The current situation surrounding the .NGO and .ONG domains highlights the ongoing need for vigilance and proactive measures to ensure that these namespaces remain true to their intended purpose. By implementing robust verification processes, conducting regular audits, and collaborating with registrars to provide clear and comprehensive information to potential registrants, PIR can effectively safeguard the integrity of the .NGO and .ONG domains and ensure that they continue to serve the global community of non-governmental organizations.

Moving forward, PIR should consider strengthening its post-registration monitoring and enforcement mechanisms. This could involve implementing automated systems to detect suspicious patterns and activities, as well as establishing a clear and transparent process for reporting and investigating potential cases of domain name abuse. Furthermore, enhanced collaboration with registrars is essential to ensure consistent application of eligibility requirements and to provide registrants with the necessary guidance and support to comply with these requirements.

In addition to internal efforts, external collaboration with industry stakeholders, such as security researchers and law enforcement agencies, can also play a crucial role in combating domain name abuse. By sharing information and resources, PIR can leverage the collective expertise of the community to identify and address emerging threats and vulnerabilities.

Ultimately, the long-term success of the .NGO and .ONG domains depends on PIR’s ability to maintain a delicate balance between facilitating easy access for legitimate organizations and preventing misuse by malicious actors. By embracing a proactive and adaptive approach to domain name governance, PIR can ensure that these valuable resources continue to serve the global non-profit sector for years to come.

The situation with .NGO and .ONG domains serves as a reminder of the ongoing challenges associated with managing and protecting domain names in an increasingly complex online landscape. As new technologies and applications emerge, it is essential for registries and registrars to remain vigilant and to continuously adapt their policies and practices to address evolving threats and vulnerabilities. By prioritizing security, transparency, and collaboration, the domain name industry can collectively contribute to a safer and more trustworthy online environment for all.