ICANN 81: WHOIS Update
The ICANN 81 meeting in Istanbul, Turkey is upon us, and WHOIS data access issues continue to be of significant concern for businesses and other stakeholders seeking to protect their customers and brands from online harms.
October marks a major milestone in the evolution of WHOIS data access due to the October implementation deadline for Europe’s revised Network Information Security Directive (commonly known as NIS2). Article 28 of NIS2 includes robust requirements to maintain complete, accurate and verified contact information of domain name registrants. It includes obligations to publish the domain name registration data of legal persons and to disclose the data of natural persons to legitimate access seekers. While many countries are delayed in implementing NIS2, we’re hopeful that these developments will improve the effectiveness of WHOIS requests in the months to come.
Reveal Rates in 2024 Hover at Only 5%
According to our most recent report, Tracer has submitted 2856 WHOIS requests during the period of January through September 2024. Of those 2856 requests, 130 were compliant (5%), 956 did not receive a response (33%), and 1770 were denied (62%).
Of the 1770 non-compliant responses, 56% took irrelevant action, such as forwarding our request to the registrant. Another 31% cited legal authority and 6% of requests received an auto-response acknowledging receipt without a follow up response. On a positive note, 7% of our requests resulted in domain suspension or deletion, but did not provide the requested information.
Compliant – received registrant data
Citing Legal Authority – citing GDPR or requiring legal action (UDRP, subpoena, court)
Took Irrelevant Action – took action that did not result in obtaining registrant data (forwarded request to registrant, sent link to contact registrant directly, proxy removed but data still redacted)
Requires Additional Action – new email address or webform, additional documents requested
Suspended/Deleted – Domain status is server hold, client hold, pending delete, or redemption period
Privacy/Proxy Compliance Rates Have Significantly Declined
Of the 2856 requests for registrant data, 716 were submitted to proxies. As depicted in the chart below, there has been a significant decrease in proxy compliance since the implementation of RDRS in November 2023. This is problematic since the industry has observed a growing trend of using privacy/proxy services especially with respect to abusive domain names. The DNS Research Federation reports that privacy/proxy services are much more prevalent for abusive domains (65% vs. 29.2%),
ICANN’s Registration Data Request System (RDRS) Compliance Rates Remain Low
Of the total reveal requests, we attempted to submit 1808 requests via the Registration Data Request System (RDRS). 443 were successfully submitted through RDRS, while 1365 of those domains were registered to non-participating registrars.
Of the 443 requests submitted via RDRS, only 14% of them were compliant and provided the requested data.
As we have stated, it is critical that ICANN continue to address these WHOIS data access issues in order to protect the privacy rights of individuals without compromising the ability of law enforcement, security, and IP professionals to obtain the critical information they need to protect the public from online fraud and abuse.
