Back

28 Abuse Prevention and Mitigation

gTLDFull Legal NameE-mail suffixDetail
.netbankCOMMONWEALTH BANK OF AUSTRALIAcba.com.auView
28 ABUSE PREVENTION AND MITIGATION

CBA, working with Afilias, will take the requisite operational and technical steps to promote WHOIS data accuracy, limit domain abuse, remove outdated and inaccurate data, and other security measures to ensure the integrity of the TLD. The specific measures include, but are not limited to:

- Posting a TLD Anti-Abuse Policy that clearly defines abuse, and provide point-of-contact information for reporting suspected abuse;

- Committing to rapid identification and resolution of abuse, including suspensions;

- Ensuring completeness of WHOIS information at the time of registration;

- Publishing and maintaining procedures for removing orphan glue records for names removed from the zone, and;

- Establishing measures to deter WHOIS abuse, including rate-limiting, determining data syntax validity, and implementing and enforcing requirements from the Registry-Registrar Agreement.

Furthermore CBA the registry operator intends to operate the .netbank gTLD with the strict eligibility requirements on registrants set out in the draft registration policy appended to the response to this question. The strict eligibility requirements mean that the scope for abuse in the TLD is low as the registry will operate as a single registrant registry.

As stated in response to Question 18, CBA’s registration policy will address the minimum requirements mandated by ICANN including rights abuse prevention measures. CBA will implement its draft registration policy as means of abuse prevention and mitigation ** (see end of document).


ABUSE POLICY

The Anti-Abuse Policy stated below will be enacted under the contractual authority of CBA as CBA, through the Registry-Registrar Agreement, and the obligations will be passed on to and made binding upon registrants. This policy will be posted on the TLD web site along with contact information for registrants or users to report suspected abuse.

The policy is designed to address the malicious use of domain names. CBA and its registrars will make reasonable attempts to limit significant harm to Internet users. This policy is not intended to take the place of the Uniform Domain Name Dispute Resolution Policy (UDRP) or the Uniform Rapid Suspension System (URS), and it is not to be used as an alternate form of dispute resolution or as a brand protection mechanism. Its intent is not to burden law-abiding or innocent registrants and domain users; rather, the intent is to deter those who use domain names maliciously by engaging in illegal or fraudulent activity.

Repeat violations of the abuse policy will result in a case-by-case review of the abuser(s), and CBA reserves the right to escalate the issue, with the intent of levying sanctions that are allowed under the TLD anti-abuse policy.

The below policy is a recent version of the policy that has been used by the .INFO registry since 2008, and the .ORG registry since 2009. It has proven to be an effective and flexible tool.

.netbank ANTI-ABUSE POLICY

The following Anti-Abuse Policy is effective upon launch of the TLD. Malicious use of domain names will not be tolerated. The nature of such abuses creates security and stability issues for the registry, registrars, and registrants, as well as for users of the Internet in general. CBA definition of abusive use of a domain includes, without limitation, the following:

- Illegal or fraudulent actions;

- Spam: The use of electronic messaging systems to send unsolicited bulk messages. The term applies to email spam and similar abuses such as instant messaging spam, mobile messaging spam, and the spamming of web sites and Internet forums;

- Phishing: The use of counterfeit web pages that are designed to trick recipients into divulging sensitive data such as personally identifying information, usernames, passwords, or financial data;

- Pharming: The redirecting of unknowing users to fraudulent sites or services, typically through, but not limited to, DNS hijacking or poisoning;

- Willful distribution of malware: The dissemination of software designed to infiltrate or damage a computer system without the ownerʹs informed consent. Examples include, without limitation, computer viruses, worms, keyloggers, and Trojan horses.

- Malicious fast-flux hosting: Use of fast-flux techniques with a botnet to disguise the location of web sites or other Internet services, or to avoid detection and mitigation efforts, or to host illegal activities.

- Botnet command and control: Services run on a domain name that are used to control a collection of compromised computers or ʺzombies,ʺ or to direct distributed denial-of-service attacks (DDoS attacks);

- Illegal Access to Other Computers or Networks: Illegally accessing computers, accounts, or networks belonging to another party, or attempting to penetrate security measures of another individualʹs system (often known as ʺhackingʺ). Also, any activity that might be used as a precursor to an attempted system penetration (e.g., port scan, stealth scan, or other information gathering activity).

Pursuant to the Registry-Registrar Agreement, CBA reserves the right at its sole discretion to deny, cancel, or transfer any registration or transaction, or place any domain name(s) on registry lock, hold, or similar status, that it deems necessary: (1) to protect the integrity and stability of the registry; (2) to comply with any applicable laws, government rules or requirements, requests of law enforcement, or any dispute resolution process; (3) to avoid any liability, civil or criminal, on the part of CBA, as well as its affiliates, subsidiaries, officers, directors, and employees; (4) per the terms of the registration agreement and this Anti-Abuse Policy, or (5) to correct mistakes made by CBA or any registrar in connection with a domain name registration. CBA also reserves the right to place upon registry lock, hold, or similar status a domain name during resolution of a dispute.

The policy stated above will be accompanied by notes about how to submit a report to CBA’s abuse point of contact, and how to report an orphan glue record suspected of being used in connection with malicious conduct (see below).

ABUSE POINT OF CONTACT AND PROCEDURES FOR HANDLING ABUSE COMPLAINTS

CBA will establish an abuse point of contact. This contact will be a role-based e-mail address of the form “abuse@registry.netbank”. This e-mail address will allow multiple staff members to monitor abuse reports on a 24x7 basis, and then work toward closure of cases as each situation calls for. For tracking purposes, CBA will have a ticketing system with which all complaints will be tracked internally. The reporter will be provided with the ticket reference identifier for potential follow-up. Afilias will integrate its existing ticketing system with CBA’s to ensure uniform tracking and handling of the complaint. This role-based approach has been used successfully by ISPs, e-mail service providers, and registrars for many years, and is considered a global best practice.

CBA’s designated abuse handlers will then evaluate complaints received via the abuse system address. They will decide whether a particular issue is of concern, and decide what action, if any, is appropriate.

In general, CBA will find itself receiving abuse reports from a wide variety of parties, including security researchers and Internet security companies, financial institutions such as banks, Internet users, and law enforcement agencies among others. Some of these parties may provide good forensic data or supporting evidence of the malicious behavior. In other cases, the party reporting an issue may not be familiar with how to provide such data or proof of malicious behavior. It is expected that a percentage of abuse reports to CBA will not be actionable, because there will not be enough evidence to support the complaint (even after investigation), and because some reports or reporters will simply not be credible.

The security function includes a communication and outreach function, with information sharing with industry partners regarding malicious or abusive behavior, in order to ensure coordinated abuse mitigation across multiple TLDs.

Assessing abuse reports requires great care, and CBA will rely upon professional, trained investigators who are versed in such matters. The goals are accuracy, good record-keeping, and a zero false-positive rate so as not to harm innocent registrants.

Different types of malicious activities require different methods of investigation and documentation. Further, CBA expects to face unexpected or complex situations that call for professional advice, and will rely upon professional, trained investigators as needed.

In general, there are two types of domain abuse that must be addressed:

a) Compromised domains. These domains have been hacked or otherwise compromised by criminals, and the registrant is not responsible for the malicious activity taking place on the domain. For example, the majority of domain names that host phishing sites are compromised. The goal in such cases is to get word to the registrant (usually via the registrar) that there is a problem that needs attention with the expectation that the registrant will address the problem in a timely manner. Ideally such domains do not get suspended, since suspension would disrupt legitimate activity on the domain.

b) Malicious registrations. These domains are registered by malefactors for the purpose of abuse. Such domains are generally targets for suspension, since they have no legitimate use.

The standard procedure is that CBA will forward a credible alleged case of malicious domain name use to the domain’s sponsoring registrar with a request that the registrar investigate the case and act appropriately. The registrar will be provided evidence collected as a result of the investigation conducted by the trained abuse handlers. As part of the investigation, if inaccurate or false WHOIS registrant information is detected, the registrar is notified about this. The registrar is the party with a direct relationship with—and a direct contract with—the registrant. The registrar will also have vital information that CBA will not, such as:

- Details about the domain purchase, such as the payment method used (credit card, PayPal, etc.);

- The identity of a proxy-protected registrant;

- The purchaser’s IP address;

- Whether there is a reseller involved, and;

- The registrant’s past sales history and purchases in other TLDs (insofar as the registrar can determine this).

Registrars do not share the above information with registry operators due to privacy and liability concerns, among others. Because they have more information with which to continue the investigation, and because they have a direct relationship with the registrant, the registrar is in the best position to evaluate alleged abuse. The registrar can determine if the use violates the registrar’s legal terms of service or the registry Anti-Abuse Policy, and can decide whether or not to take any action. While the language and terms vary, registrars will be expected to include language in their registrar-registrant contracts that indemnifies the registrar if it takes action, and allows the registrar to suspend or cancel a domain name; this will be in addition to the registry Anti-Abuse Policy. Generally, registrars can act if the registrant violates the registrar’s terms of service, or violates ICANN policy, or if illegal activity is involved, or if the use violates the registry’s Anti-Abuse Policy.

If a registrar does not take action within a time period indicated by CBA (usually 24 hours), CBA might then decide to take action itself. At all times, CBA reserves the right to act directly and immediately if the potential harm to Internet users seems significant or imminent, with or without notice to the sponsoring registrar.

CBA will be prepared to call upon relevant law enforcement bodies as needed. There are certain cases, for example, Illegal pharmacy domains, where CBA will contact the Law Enforcement Agencies to share information about these domains, provide all the evidence collected and work closely with them before any action will be taken for suspension. The specific action is often dependent upon the jurisdiction of which CBA, although the operator in all cases will adhere to applicable laws and regulations.

When valid court orders or seizure warrants are received from courts or law enforcement agencies of relevant jurisdiction, CBA will order execution in an expedited fashion. Compliance with these will be a top priority and will be completed as soon as possible and within the defined timelines of the order. There are certain cases where Law Enforcement Agencies request information about a domain including but not limited to:

- Registration information

- History of a domain, including recent updates made

- Other domains associated with a registrant’s account

- Patterns of registrant portfolio


Requests for such information is handled on a priority basis and sent back to the requestor as soon as possible. Afilias sets a goal to respond to such requests within 24 hours.

CBA may also engage in proactive screening of its zone for malicious use of the domains in the TLD, and report problems to the sponsoring registrars. CBA could take advantage of a combination of the following resources, among others:

- Blocklists of domain names and nameservers published by organizations such as SURBL and Spamhaus.

- Anti-phishing feeds, which will provide URLs of compromised and maliciously registered domains being used for phishing.

- Analysis of registration or DNS query data [DNS query data received by the TLD nameservers.

CBA will keep records and track metrics regarding abuse and abuse reports. These will include:

- Number of abuse reports received by the registry’s abuse point of contact described above;

- Number of cases and domains referred to registrars for resolution;

- Number of cases and domains where the registry took direct action;

- Resolution times;

- Number of domains in the TLD that have been blacklisted by major anti-spam blocklist providers, and;

- Phishing site uptimes in the TLD.


REMOVAL OF ORPHAN GLUE RECORDS

By definition, orphan glue records used to be glue records. Glue records are related to delegations and are necessary to guide iterative resolvers to delegated nameservers. A glue record becomes an orphan when its parent nameserver record is removed without also removing the corresponding glue record. (Please reference the ICANN SSAC paper SAC048 at: http:⁄⁄www.icann.org⁄en⁄committees⁄security⁄sac048.pdf.) Orphan glue records may be created when a domain (example.tld) is placed on EPP ServerHold or ClientHold status. When placed on Hold, the domain is removed from the zone and will stop resolving. However, any child nameservers (now orphan glue) of that domain (e.g., ns1.example.tld) are left in the zone. It is important to keep these orphan glue records in the zone so that any innocent sites using that nameserver will continue to resolve. This use of Hold status is an essential tool for suspending malicious domains.

Afilias observes the following procedures, which are being followed by other registries and are generally accepted as DNS best practices. These procedures are also in keeping with ICANN SSAC recommendations.

When a request to delete a domain is received from a registrar, the registry first checks for the existence of glue records. If glue records exist, the registry will check to see if other domains in the registry are using the glue records. If other domains in the registry are using the glue records then the request to delete the domain will fail until no other domains are using the glue records. If no other domains in the registry are using the glue records then the glue records will be removed before the request to delete the domain is satisfied. If no glue records exist then the request to delete the domain will be satisfied.

If a registrar cannot delete a domain because of the existence of glue records that are being used by other domains, then the registrar may refer to the zone file or the “weekly domain hosted by nameserver report” to find out which domains are using the nameserver in question and attempt to contact the corresponding registrar to request that they stop using the nameserver in the glue record. CBA does not plan on performing mass updates of the associated DNS records.

CBA will accept, evaluate, and respond appropriately to complaints that orphan glue is being used maliciously. Such reports should be made in writing to CBA, and may be submitted to the registry’s abuse point-of-contact. If it is confirmed that an orphan glue record is being used in connection with malicious conduct, CBA will have the orphan glue record removed from the zone file. Afilias has the technical ability to execute such requests as needed.

METHODS TO PROMOTE WHOIS ACCURACY

The creation and maintenance of accurate WHOIS records is an important part of registry management. As described in our response to question #26, WHOIS, CBA will manage a secure, robust and searchable WHOIS service for this TLD.

WHOIS DATA ACCURACY

CBA will offer a “thick” registry system. In this model, all key contact details for each domain name will be stored in a central location by the registry. This allows better access to domain data, and provides uniformity in storing the information. CBA will ensure that the required fields for WHOIS data (as per the defined policies for the TLD) are enforced at the registry level. This ensures that the registrars are providing required domain registration data. Fields defined by the registry policy to be mandatory are documented as such and must be submitted by registrars. The Afilias registry system verifies formats for relevant individual data fields (e.g. e-mail, and phone⁄fax numbers). Only valid country codes are allowed as defined by the ISO 3166 code list. The Afilias WHOIS system is extensible, and is capable of using the VAULT system, described further below.

Similar to the centralized abuse point of contact described above, CBA can institute a contact email address which could be utilized by third parties to submit complaints for inaccurate or false WHOIS data detected. This information will be processed by Afilias’ support department and forwarded to the registrars. The registrars can work with the registrants of those domains to address these complaints. Afilias will audit registrars on a yearly basis to verify whether the complaints being forwarded are being addressed or not. This functionality, available to all CBAs, is activated based on CBA’s business policy.

Afilias also incorporates a spot-check verification system where a randomly selected set of domain names are checked periodically for accuracy of WHOIS data. Afilias’ .PRO registry system incorporates such a verification system whereby 1% of total registrations or 100 domains, whichever number is larger, are spot-checked every month to verify the domain name registrant’s critical information provided with the domain registration data. With both a highly qualified corps of engineers and a 24x7 staffed support function, Afilias has the capacity to integrate such spot-check functionality into this TLD, based on CBA’s business policy. Note: This functionality will not work for proxy protected WHOIS information, where registrars or their resellers have the actual registrant data. The solution to that problem lies with either registry or registrar policy, or a change in the general marketplace practices with respect to proxy registrations.

Finally, Afilias’ registry systems have a sophisticated set of billing and pricing functionality which aids CBAs who decide to provide a set of financial incentives to registrars for maintaining or improving WHOIS accuracy. For instance, it is conceivable that CBA may decide to provide a discount for the domain registration or renewal fees for validated registrants, or levy a larger cost for the domain registration or renewal of proxy domain names. The Afilias system has the capability to support such incentives on a configurable basis, towards the goal of promoting better WHOIS accuracy.

ROLE OF REGISTRARS

As part of the RRA (Registry Registrar Agreement), CBA will require the registrar to be responsible for ensuring the input of accurate WHOIS data by their registrants. The Registrar⁄Registered Name Holder Agreement will include a specific clause to ensure accuracy of WHOIS data, and to give the registrar rights to cancel or suspend registrations if the Registered Name Holder fails to respond to the registrar’s query regarding accuracy of data. ICANN’s WHOIS Data Problem Reporting System (WDPRS) will be available to those who wish to file WHOIS inaccuracy reports, as per ICANN policy (http:⁄⁄wdprs.internic.net⁄ ).

CONTROLS TO ENSURE PROPER ACCESS TO DOMAIN FUNCTIONS

Several measures are in place in the Afilias registry system to ensure proper access to domain functions, including authentication provisions in the RRA relative to notification and contact updates via use of AUTH-INFO codes.

IP address access control lists, TLS⁄SSL certificates and proper authentication are used to control access to the registry system. Registrars are only given access to perform operations on the objects they sponsor.

Every domain will have a unique AUTH-INFO code. The AUTH-INFO code is a 6- to 16-character code assigned by the registrar at the time the name is created. Its purpose is to aid identification of the domain owner so proper authority can be established. It is the ʺpasswordʺ to the domain name. Registrars must use the domain’s password in order to initiate a registrar-to-registrar transfer. It is used to ensure that domain updates (update contact information, transfer, or deletion) are undertaken by the proper registrant, and that this registrant is adequately notified of domain update activity. Only the sponsoring registrar of a domain has access to the domain’s AUTH-INFO code stored in the registry, and this is accessible only via encrypted, password-protected channels.

Information about other registry security measures such as encryption and security of registrar channels are confidential to ensure the security of the registry system. The details can be found in the response to question #30b.

VALIDATION AND ABUSE MITIGATION MECHANISMS

Afilias has developed advanced validation and abuse mitigation mechanisms. These capabilities and mechanisms are described below. These services and capabilities are discretionary and may be utilized by CBA based on their policy and business need.

Afilias has the ability to analyze the registration data for known patterns at the time of registration. A database of these known patterns is developed from domains and other associated objects (e.g., contact information) which have been previously detected and suspended after being flagged as abusive. Any domains matching the defined criteria can be flagged for investigation. Once analyzed and confirmed by the domain anti-abuse team members, these domains may be suspended. This provides proactive detection of abusive domains.

Provisions are available to enable CBA to only allow registrations by pre-authorized and verified contacts. These verified contacts are given a unique code that can be used for registration of new domains.

REGISTRANT PRE-VERIFICATION AND AUTHENTICATION

One of the systems that could be used for validity and identity authentication is VAULT (Validation and Authentication Universal Lookup). It utilizes information obtained from a series of trusted data sources with access to billions of records containing data about individuals for the purpose of providing independent age and id verification as well as the ability to incorporate additional public or private data sources as required. At present it has the following: US Residential Coverage - 90% of Adult Population and also International Coverage - Varies from Country to Country with a minimum of 80% coverage (24 countries, mostly European).

Various verification elements can be used. Examples might include applicant data such as name, address, phone, etc. Multiple methods could be used for verification include integrated solutions utilizing API (XML Application Programming Interface) or sending batches of requests.

- Verification and Authentication requirements would be based on TLD operator requirements or specific criteria.

- Based on required WHOIS Data; registrant contact details (name, address, phone)

- If address⁄ZIP can be validated by VAULT, the validation process can continue (North America +25 International countries)

- If in-line processing and registration and EPP⁄API call would go to the verification clearinghouse and return up to 4 challenge questions.

- If two-step registration is required, then registrants would get a link to complete the verification at a separate time. The link could be
specific to a domain registration and pre-populated with data about the registrant.

- If WHOIS data is validated a token would be generated and could be given back to the registrar which registered the domain.

- WHOIS data would reflect the Validated Data or some subset, i.e., fields displayed could be first initial and last name, country of registrant and date validated. Other fields could be generic validation fields much like a “privacy service”.

- A “Validation Icon” customized script would be sent to the registrants email address. This could be displayed on the website and would be dynamically generated to avoid unauthorized use of the Icon. When clicked on the Icon would should limited WHOIS details i.e. Registrant: jdoe, Country: USA, Date Validated: March 29, 2011, as well as legal disclaimers.

- Validation would be annually renewed, and validation date displayed in the WHOIS.

ABUSE PREVENTION RESOURCING PLANS

Since its founding, Afilias is focused on delivering secure, stable and reliable registry services. Several essential management and staff who designed and launched the Afilias registry in 2001 and expanded the number of TLDs supported, all while maintaining strict service levels over the past decade, are still in place today. This experiential continuity will endure for the implementation and on-going maintenance of this TLD. Afilias operates in a matrix structure, which allows its staff to be allocated to various critical functions in both a dedicated and a shared manner. With a team of specialists and generalists, the Afilias project management methodology allows efficient and effective use of our staff in a focused way. Abuse prevention and detection is a function that is staffed across the various groups inside Afilias, and requires a team effort when abuse is either well hidden or widespread, or both. While all of Afilias’ 200+ employees are charged with responsibility to report any detected abuse, the engineering and analysis teams, numbering over 30, provide specific support based on the type of abuse and volume and frequency of analysis required. The Afilias security and support teams have the authority to initiate mitigation.

Afilias has developed advanced validation and abuse mitigation mechanisms. These capabilities and mechanisms are described below. These services and capabilities are discretionary and may be utilized by CBA based on their policy and business need.

This TLD’s anticipated volume of registrations in the first three years of operations is listed in response #46. Afilias and CBA’s anti-abuse function anticipates the expected volume and type of registrations, and together will adequately cover the staffing needs for this TLD. CBA will maintain an abuse response team, which may be a combination of internal staff and outside specialty contractors, adjusting to the needs of the size and type of TLD. The team structure planned for this TLD is based on several years of experience responding to, mitigating, and managing abuse for TLDs of various sizes. The team will generally consist of abuse handlers (probably internal), a junior analyst, (either internal or external), and a senior security consultant (likely an external resource providing CBA with extra expertise as needed). These responders will be specially trained in the investigation of abuse complaints, and will have the latitude to act expeditiously to suspend domain names (or apply other remedies) when called for.

The exact resources required to maintain an abuse response team must change with the size and registration procedures of the TLD. An initial abuse handler is necessary as a point of contact for reports, even if a part-time responsibility. The abuse handlers monitor the abuse email address for complaints and evaluate incoming reports from a variety of sources. A large percentage of abuse reports to CBA may be unsolicited commercial email. The designated abuse handlers can identify legitimate reports and then decide what action is appropriate, either to act upon them, escalate to a security analyst for closer investigation, or refer them to registrars as per the above-described procedures. A TLD with rare cases of abuse would conform to this structure.

If multiple cases of abuse within the same week occur regularly, CBA will consider staffing internally a security analyst to investigate the complaints as they become more frequent. Training an abuse analyst requires 3-6 months and likely requires the active guidance of an experienced senior security analyst for guidance and verification of assessments and recommendations being made.

If this TLD were to regularly experience multiple cases of abuse within the same day, a full-time senior security analyst would likely be necessary. A senior security analyst capable of fulfilling this role should have several years of experience and able to manage and train the internal abuse response team.

The abuse response team will also maintain subscriptions for several security information services, including the blocklists from organizations like SURBL and Spamhaus and anti-phishing and other domain related abuse (malware, fast-flux etc.) feeds. The pricing structure of these services may depend on the size of the domain and some services will include a number of rapid suspension requests for use as needed.

For a large TLD, regular audits of the registry data are required to maintain control over abusive registrations. When a registrar with a significant number of registrations has been compromised or acted maliciously, CBA may need to analyze a set of registration or DNS query data. A scan of all the domains of a registrar is conducted only as needed. Scanning and analysis for a large registrar may require as much as a week of full-time effort for a dedicated machine and team.

** .netbank’S DRAFT REGISTRATION POLICY

1. DOMAIN NAME LICENCES

Upon registration of a Domain Name, the Registrant holds a licence to use the Domain Name for a specified period of time in accordance with the Registry Rules. Domain Names may be registered and renewed for 1, 2, 3, 4, 5, 6, 7, 8, 9 or 10 years.

2. SELECTION OF REGISTRARS

Registrars eligible to register domain names must meet the following non-discriminatory criteria (in compliance with clause 2.9 (a) of the Registry Agreement):

(i) be an accredited ICANN Registrar;

(ii) demonstrate a level of understanding of the Domain Name registration policies of the Registry;

(iii) have experience of managing the Domain Names of major corporations;

(iv) have proven tools for domain name portfolio management;

(v) have business processes to perform automated validation (and any additional human checks as required by the Registry) of the eligibility of the domain name for registration according to the Domain Name policies of .netbank;

(vi) demonstrate a sufficient level of security to protect against unauthorised access to the Domain Name records;

(vii) demonstrate experience and have appropriate resources in managing abuse prevention, mitigation and responses;

(viii) provide multi-language support for the registration of IDNs;

(ix) comply with any re-validation of its Registry-Registrar agreement at such regular intervals as are determined by the Registry or as required by ICANN from time to time;

(x) meet applicable technical requirements of .netbank; and

(xi) comply with all conditions, dependencies, policies and other requirements reasonably imposed by CBA, including maintenance of suitable systems and applications that are capable of interacting with the Registry system.



3. ELIGIBLE REGISTRANTS

The Registrant must be:

(i) an Affiliate entity of CBA; or

(ii) an organisation explicitly authorised by CBA; or

(iii) a natural person explicitly authorised by CBA.

If the Registrant does not meet one of the above eligibility criteria, there is no entitlement to register a Domain Name under the .netbank TLD. If the Registrant ceases to be eligible at any time in the future, the .netbank Registry may cancel or suspend the licence to use the Domain Name immediately.



4. REGISTRY APPROVAL REQUIREMENT

Registration of Domain Names under the .netbank TLD must be approved by CBA in addition to meeting all requirements under the Registry Rules. CBA’s approval for a complete and validly submitted application will be authorised by:

(i) a head of appropriate department as nominated by CBA (“Authorisation Provider”); or

(ii) an authorised person as nominated by CBA (“Authorised Person”) and notified to the Registrar from time to time.

The Authorisation Provider will notify the Registrar of its decision.



5. REQUIRED CRITERIA FOR DOMAIN NAME REGISTRATION

An application for Domain Name registration must meet all the following criteria:

(i) availability;

a. the Domain Name is not already registered;

b. it is not reserved or blocked by the .netbank Registry; or

c. it meets all .netbank Registry’s technical requirements.

(ii) technical requirements;

a. a maximum of 63 characters (after its conversion into the ASCII for IDNs);

b. use of characters selected from the list of supported characters as nominated by the .netbank Registry; and

c. any additional technical requirements as required by the .netbank Registry from time to time.

(iii) the Domain Name must be consistent with the mission and purposes of the .netbank TLD and consistent with the Domain Name registration policy of .netbank, and include but not be limited to:

a. product name;

b. service name;

c. marketing term;

d. geographic identifier; or

e. any relevant name or term as approved by Authorisation Provider or Authorised Person.

(iv) compliance with all requirements under the Registry Rules: the Registrant must comply with all provisions contained in the Registry Rules.




6. OBLIGATION OF REGISTRANTS

The Registrant must enter into an agreement with the Registrar for Domain Name registration under which the Registrant will be bound by the Registry Rules specified through the Registry-Registrar agreement as amended by the Registry from time to time.

The Registrant must also agree to be bound by the minimum requirements in clause 3.7.7 of ICANNʹs Registrar accreditation agreement.

The Registrant must represent and warrant that:

(i) it meets, and will continue to meet, the eligibility criteria at all times and must notify the Registrar if it ceases to meet such criteria;

(ii) the registration, renewal and use of the Domain Name does not violate any third party intellectual property rights, applicable laws or regulation;

(iii) it is entitled to register the Domain Name;

(iv) the registration and use of the Domain Name is made in good faith and for a lawful purpose;

(v) if the use of registered Domain Name is licensed to a third party,

a. the Registrant must have a licencing agreement with the licensee for the use of the Domain Name that is not less onerous than the obligation of the Registrant contained in the Registry Rules; and

b. where there is a breach of any provisions contained in the Registry Rules by the licensee of the Domain Name, Registry may revoke the Domain Name at its sole discretion.

(vi) it owns or otherwise has the right to provide all registration data (including personal information) for each Domain Name registered and provision of such registrant data complies with all applicable data protection laws and regulations; and

(vii) it has appropriate consent and licences to allow for publication of registration data in the WHOIS database.




7. REGISTRANT CONTACT INFORMATION

The Registrant must provide complete and accurate contact information of the Registrant (in accordance with clause 3.7.7.1 of the ICANN’s Registrar accreditation agreement), including but not limited to the following;

(i) if the Registrant is a company or organisation:

a. name of a company or organisation;

b. registered office and principal place of business; and

c. contact details of the Registrant including e-mail address and telephone number;

(ii) if the Registrant is a natural person:

a. full name of the Registrant;

b. address of the Registrant; and

c. contact details of the Registrant including e-mail address and telephone number.


All Registrant contact information must be complete and accurate. Any changes to such Registrant information must be promptly notified to the Registrar, and no later than one (1) month of such change.




8. REVOCATION OF DOMAIN NAMES

The Registrant acknowledges that the .netbank Registry may revoke a Domain Name immediately at its sole discretion:

(i) in the event the Registrant breaches any .netbank Registry Rules;

(ii) to comply with applicable law, court order, government rule or under any dispute resolution processes;

(iii) where such Domain Name is used for any of the following prohibited activities (Prohibited Activities):

a. spamming;

b. intellectual property and privacy violations;

c. obscene speech or materials;

d. defamatory or abusive language;

e. forging headers, return addresses and internet protocol addresses;

f. illegal or unauthorised access to other computers or networks;

g. distribution of internet viruses, worms, Trojan horses or other destructive activities; and

h. any other illegal or prohibited activities as determined by the .netbank Registry.

(iv) in order to protect the integrity and stability of the domain name system and the .netbank Registry;

(v) where such Domain Name is placed under reserved names list at any time; and

(vi) where Registrant fails to make payment to the Registrar for registration, renewal or any other relevant services.



9. USE OF SECOND OR THIRD LEVEL IDNs

In addition to meeting all required criteria for registration of domain names above, an application for an IDN Domain Name must:

(i) comply with any additional registration policy on IDNs for each language;

(ii) meet all technical requirement for the applicable IDN;

(iii) comply with the IDN tables used by the .netbank Registry as amended from time to time; and

(iv) meet any other additional technical requirements as required by the .netbank Registry.




10. USE OF GEOGRAPHIC NAMES

All two-character labels and country and territory names will be initially reserved in accordance with specification 5 of the Registry Agreement.

Upon approval from ICANN and any other guidelines by applicable governments and ICANN’s Governmental Advisory Committee, the Registry may release the two-character labels and country and territory names in accordance with CBA’s response to Question 22 Geographic Names.




11. RESERVED NAMES

The .netbank Registry may place certain names in its reserved list from time to time where:

(i) the .netbank Registry believes in its sole discretion that use of such names may pose a risk to the operational stability or integrity of the .netbank Registry;

(ii) in accordance with ICANN’s specifications contained in the Registry Agreement, guidelines or recommendations;

(iii) there is a risk of trademark infringement or where the name otherwise may cause confusion taking into consideration the mission and purpose of the TLD; or

(iv) the .netbank Registry in its sole discretion decides certain names to be reserved for any reason.




12. ALLOCATION OF DOMAIN NAME

The .netbank Registry will register Domain Names on a first-come, first-served basis in accordance with the .netbank Registry Rules. The .netbank Registry does not provide pre-registration or reservation of Domain Names.




13. LIMITATION ON REGISTRATION ⁄ DOMAIN NAME LICENCES


There is no restriction on the number of Domain Names any Registrant may hold. The Registrant may further licence the use of the Domain Name to any third parties provided that the Registrant enters into an agreement with such third parties on the terms not less onerous than its obligations under the .netbank Registry Rules.



14. PROTECTION OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS

The .netbank Registry will implement all rights protection measures as required by ICANN in clause 2.8 of the Registry Agreement, including the use of the Uniform Rapid Suspension (URS) procedure, and Uniform Domain Name Dispute Resolution Policy (UDRP).




15. TERM OF REGISTRATION ⁄ RENEWAL

INITIAL TERM OF REGISTRATION:

A Domain Name can be registered for a period between one (1) to ten (10) years.


RENEWAL OF REGISTRATION:

(i) The term may be extended at any time for a period between one (1) to ten (10) years, provided that the total aggregate term of the Domain Name does not exceed ten (10) years at any time.

(ii) Upon change of sponsorship of the Domain Name from one Registrar to another, according to Part A of the ICANN Policy on Transfer of Registrations between Registrars, the term of registration of the registered Domain Name will be extended by one year, provided that the maximum term of registration at any time does not exceed ten (10) years.

(iii) The change of sponsorship of the registration of a Domain Name from one Registrar to another, accordingly to Part B of the ICANN Policy on Transfer of Registrations between Registrars will not result in the extension of the term of registration.



CANCELLATION OF REGISTRATION:

The Registrant may cancel a Domain Name registration at any time by submitting its request in writing with the Registrar.



AUTO-RENEWAL:

Upon expiry of the Domain Name, the .netbank Registry will auto-renew the Domain Name for a one year term (1) year term unless the Registrant submits its intention not to renew the Domain Name.

The .netbank Registry will implement the business rules for the renewal of Domain Names documented in appendix 7 of the .com Registry Agreement.



16. TRANSFER OF DOMAIN NAMES BETWEEN REGISTRANTS

Any transfer of a Domain Name between Registrants must be approved by the Registry through the Registrar. The legal heirs of the Registrant or purchaser of the Registrant may request the transfer provided that they meet the eligibility criteria for registration under the .netbank TLD. If the Registrant becomes subject to insolvency or any other proceeding, the administrator may request the transfer. The transferee must provide appropriate documentation as required by the .netbank Registry to approve such transfer.



17. CHANGE OF REGISTRAR

If the agreement between the Registry and the Registrar is terminated and if the Registrar has not transferred its Domain Name portfolio to another Registrar, the Registry will notify affected Registrants. The Registrants must select a new Registrar within one (1) month following such notice from the .netbank Registry. If the Registrant fails to appoint a new Registrar within the timeframe set out above, the .netbank Registry may suspend the Domain Name.

If the Registrant wishes to change the Registrar, the Registrant must obtain the auth-info code from the Registrantʹs current Registrar, and request a transfer through the gaining Registrar in compliance with ICANNʹs Inter-Registrar transfer policy.



18. PRIVACY AND DATA PROTECTION

By registering a Domain Name, the registrant authorises the .netbank Registry to process personal information and other data required for the operation of the .netbank TLD. The .netbank Registry will only use the data for the operation of the .netbank Registry including but not limited to its internal use, communication with the Registrant, and provision of WHOIS look-up facility.

The .netbank Registry may only transfer the data to third parties:

(i) with the Registrant’s consent;

(ii) in order to comply with laws, regulations or orders by a competent public authority and any Alternative Dispute Resolution (ADR) providers; or

(iii) for a publicly available and searchable WHOIS look-up facility, in accordance with specification 4 of the Registry Agreement.




19. WHOIS

The .netbank Registry provides a publicly available and searchable WHOIS look up facility, where information about the Domain Nameʹs status (including creation and expiry dates), and registrant, administrative and the technical contact administering the Domain Name can be found, in accordance with specification 4 of the Registry Agreement.

In order to prevent misuse of the WHOIS look up facility, the .netbank Registry requires that any person submitting a WHOIS database query will be required to read and agree to the terms and conditions, which will provide that:

(i) the WHOIS database is provided for information purposes only; and

(ii) the user agrees not to use the WHOIS information to allow or enable the transmission of unsolicited commercial advertising or other communication via email or other methods to the Registrants.




20. PRICING ⁄ PAYMENT

The .netbank TLD does not charge a separate fee for the Registrar to register domain names, as the TLD is used only for the specified mission and purpose of .netbank TLD. CBA shall bear the cost of operating the .netbank Registry.

The .netbank Registry will provide Registrars with 30 days’ notice of any price change for new registrations, and 180 days advance notice of any price change for renewals in accordance with clause 2.10 of the Registry Agreement.



21. DISPUTE RESOLUTION

The Registrant agrees to be bound by ICANN’s Dispute Resolution Policies in respect of all disputes in connection with the Domain Name.




22. COMPLIANCE WITH CONSENSUS AND TEMPORARY POLICIES

The Registrant agrees to be bound by all applicable consensus and temporary policies as required and mandated by ICANN.



23. DEFINITIONS

Affiliate means in relation to a party any corporation or other business entity controlling, controlled by, or under common control of that party and for the purposes of this definition, a corporation or other business entity shall be deemed to control another corporation or business entity if it owns directly or indirectly:

(i) fifty percent (50%) or more of the voting securities or voting interest in any such corporation or other entity; or

(ii) fifty percent (50%) or more of the interest in the profit or income in the case of a business entity other than a corporation; or

(iii) in the case of a partnership, any other compatible interest equal to at least a fifty percent (50%) share in the general partner.



Domain Name means a domain name registered directly under the .netbank TLD or for which a request or application for registration has been filed with the Registry;


ICANN’s Dispute Policy means the dispute policy currently known as the Uniform Domain Name Dispute Resolution Policy (UDRP) issued and as may be updated from time to time by the Internet Corporation of Assigned Names and Number (ICANN) and the Uniform Rapid Suspension (URS) (see Specification 7 of the Registry Agreement).


Registrar means an ICANN accredited registrar which enters into and is in compliance with the registry-registrar agreement for the TLD, and which provides domain name registration services to Registrants;


Registry Agreement means the agreement between CBA and ICANN;


Registry Rules mean:

(i) Registration terms and conditions agreed between the Registry and Registrant for registration of a Domain Name; and

(ii) Registration policies provided and amended by the Registry from time to time.



Registrant means a natural person, company or organisation who holds a Domain Name registration or who has requested or applied for the registration of a Domain Name.


gTLDFull Legal NameE-mail suffixDetail
.vanguardThe Vanguard Group, Inc.vanguard.comView
A. ABUSE PREVENTION AND MITIGATION TO BE IMPLEMENTED BY VANGUARD


Vanguard’s proposed use for .vanguard should, by its very nature, preclude abusive registrations from occurring, as all domains names may only be registered in the name of Vanguard and its affiliates (for the purposes of this response, “affiliates” means in relation to a party any corporation or other business entity controlling, controlled by, or under common control of that party and for the purposes of this definition, a corporation or other business entity shall be deemed to control another corporation or business entity if it owns directly or indirectly (i) fifty percent (50%) or more of the voting securities or voting interest in any such corporation or other entity; or (ii) fifty percent (50%) or more of the interest in the profit or income in the case of a business entity other than a corporation; or (iii) in the case of a partnership, any other compatible interest equal to at least a fifty percent (50%) share in the general partner).

Vanguard is intending to operate .vanguard for the benefit of Internet users that would like to interact with Vanguard. There is no incentive for Vanguard to confuse Internet users, nor otherwise use domain names in bad faith, since Vanguard’s branded keyword gTLD is inherently intertwined with all uses of .vanguard domain names.

Notwithstanding the above, Vanguard understands and agrees that it must comply with the different rights protection mechanisms such as the Uniform Domain Name Dispute Resolution Policy (UDRP) and the Uniform Rapid Suspension System (URS) as described in the gTLD Applicant Guidebook (as may be later amended via Consensus Policy) and the Registry Agreement. The aforementioned policies provide a strong incentive to ensure that relevant and effective checks are in place to ensure that all .vanguard domain names are only registered and used in an appropriate manner so as to benefit Internet users who would like to interact with Vanguard, rather than in any manner that may be deemed inappropriate or in bad faith.

Vanguard will implement a clear written policy which requires the relevant corporate authorization and approvals to be procured and evidenced in order for any .vanguard domain name to be registered for Vanguard’s use. In the event that Vanguard resolves to permit third parties (other than affiliates) that have a relationship with either Vanguard or its business, to register (or license) and use domain names within the top level domain (TLD), then additional corporate authorizations and approvals may be required to ensure internal responsibility for permitting and enforcing the terms of use of the .vanguard domain. In addition to these safeguards, all registered domain names in the TLD will be regularly monitored for abusive use.



B. .VANGUARD ANTI-ABUSE POLICIES


Although domain names will only be registered to Vanguard and its affiliates, all domain names will be subject to specific internal registration policy for .vanguard domain. The registration policy will set out in writing a methodology for corporate authorization, approval and evidence in order for any domain name to be registered for Vanguard’s use. This will prohibit any abusive use of a domain name. These policies include not only the required URS, but also the supplemental Anti-Phishing Takedown Process, Vanguard’s Acceptable Use Policy, and Vanguard’s strict controls on registration.



C. DEFINITION OF ABUSE


Vanguard defines abuse as an action that causes actual and substantial harm, or is a material predicate of such harm, and is illegal, illegitimate, or otherwise contrary to registration policy. Abuse includes, without limitation, the following:

- Content or actions that attempt to defraud members of the public in any way (for example, ʺphishingʺ sites);

- Content that is hateful, defamatory, derogatory or bigoted based on racial, ethnic, political grounds or which otherwise may cause or incite injury, damage or harm of any kind to any person or entity;

- Content that is threatening or invades another personʹs privacy or property rights or is otherwise in breach of any duty owed to a third party;

- Content or actions that infringe the trademark, copyright, patent rights, trade secret or other intellectual property rights, or any other legal rights of Vanguard or any third party;

- Content or actions that violate any applicable local, state, national or international law or regulation;

- Content or actions that promote, are involved in or assist in, the conduct of illegal activity of any kind or promote business opportunities or investments that are not permitted under applicable law;

- Content that advertises or offers for sale any goods or services that are unlawful or in breach of any national or international law or regulation; or

- Content or actions associated with the sale or distribution of prescription medication without a valid prescription;

- Content that depicts minors engaged in any activity of a sexual nature or which may otherwise harm minors;

- Activities that mislead or deceive minors into viewing sexually explicit material;

- Spam: The use of electronic messaging systems to send unsolicited bulk messages. The term applies to e-mail spam and similar abuses such as instant messaging spam, mobile messaging spam, and the spamming of Web sites and Internet forums. An example, for purposes of illustration, would be the use of email in denial-of-service attacks;

- Phishing: The use of counterfeit Web pages that are designed to trick recipients into divulging sensitive data such as usernames, passwords, or financial data;

- Pharming: The redirecting of unknowing users to fraudulent sites or services, typically through Domain Name System (DNS) hijacking or poisoning;

- Willful distribution of malware: The dissemination of software designed to infiltrate or damage a computer system without the ownerʹs informed consent. Examples include, without limitation, computer viruses, worms, keyloggers and trojan horses;

- Botnet command and control: Services run on a domain name that are used to control a collection of illegally compromised computers or ʺzombies,ʺ or to direct denial-of-service attacks (DDoS attacks); and

- Illegal Access to Other Computers or Networks: Illegally accessing computers, accounts, or networks belonging to another party, or attempting to penetrate security measures of another individualʹs system (often known as ʺhackingʺ). Also, any activity that might be used as a precursor to an attempted system penetration (e.g., port scan, stealth scan, or other information gathering activity).



As stated in response to Question 18, Vanguard’s registration policy will address the minimum requirements mandated by ICANN including rights abuse prevention measures. Vanguard will implement the following as means of abuse prevention and mitigation:

1. Vanguard’s draft registration policy ** (See end of document)

2. Vanguard’s draft procedure for management of trademark infringement claims *** (see end of document)


Any employee found to have violated any of Vanguard’s policies may be subject to disciplinary action, up to and including termination of employment.

Every Vanguard employee should be aware that the data they create on the corporate systems, including on any domain name hosted in .vanguard, remains the property of Vanguard. For security and network maintenance purposes, authorized individuals within Vanguard may monitor equipment, systems and network traffic at any time. Vanguard reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.

Vanguard recognizes that, notwithstanding all of Vanguard’s internal policies having been meticulously followed by all employees and affiliates, the Internet remains an open and ubiquitous system that provides access and anonymity to participants around the world. This is one of the Internet’s strengths and also a source of difficulty as malicious or criminal perpetrators exploit these characteristics for their own benefit. The frequency of activities such as phishing, pharming, spam and DDoS attacks have increased dramatically on the Internet and there is strong evidence to suggest this will continue.

Vanguard has resolved to ensure that abusive use of the .vanguard domain names will not be permitted nor tolerated. The nature of such abuses creates security and stability issues for Vanguard, as well as for users of the Internet in general, and particularly those who wish to interact with Vanguard in a secure and reliable manner. The nature of such abuses also inherently creates negative publicity and loss of brand integrity and goodwill and, therefore, any such abuse must be swiftly and effectively addressed, and systems must continue to evolve in accordance with evolving threats.



SCANNING TO IDENTIFY MALICIOUS OR ABUSIVE BEHAVIOR

All domain names within the .vanguard domain shall be continually executing approved virus-scanning software with a current virus database, unless overridden by departmental or group policy for legitimate business reason.

Vanguard will conduct automated and regular scanning for malware of all domain names in the Registry through its selected back end Registry services provider, Verisign. Registrants are often unknowing victims of malware exploits. Verisign has developed proprietary code to help identify malware in the zones it manages, which in turn helps registrars by identifying malicious code hidden in their domain names. Verisign’s malware scanning service helps prevent websites from infecting other websites by scanning web pages for embedded malicious content that will infect visitors’ websites. Verisign’s malware scanning technology uses a combination of in-depth malware behavioral analysis, anti-virus results, detailed malware patterns, and network analysis to discover known exploits for the particular scanned zone. If malware is detected, the service sends the registrar a report that contains the number of malicious domains found and details about malicious content within its TLD zones. Reports with remediation instructions are provided to help registrars and registrants eliminate the identified malware from the registrant’s website.



D. ADDITIONAL PROCESSES TO ADDRESS ABUSIVE USE OF REGISTERED DOMAIN NAMES


SUSPENSION PROCESSES CONDUCTED BY BACKEND REGISTRY SERVICES PROVIDER.

In the case of domain name abuse, Vanguard or Vanguard’s approved registrar(s) will determine whether to take down the subject domain name. Verisign, Vanguard’s selected backend registry services provider, will follow the auditable processes to comply with the suspension request as set out Diagram 1 of the Attachment.



VERISIGN SUSPENSION NOTIFICATION.

Vanguard or Vanguard’s approved registrar(s) submits the suspension request to Verisign for processing, documented by:

- Threat domain name

- Registry incident number

- Incident narrative, threat analytics, screen shots to depict abuse, and⁄or other evidence

- Threat classification

- Threat urgency description

- Recommended timeframe for suspension⁄takedown

- Technical details (e.g., Whois records, IP addresses, hash values, anti-virus detection results⁄nomenclature, name servers, domain name status that are relevant to the suspension)

- Incident response, including surge capacity



VERISIGN NOTIFICATION VERIFICATION.

When Verisign receives a suspension request from Vanguard or Vanguard’s approved registrar(s), it performs the following verification procedures:

- Validate that all the required data appears in the notification

- Validate that the request for suspension is for a registered domain name

- Return a case number for tracking purposes



SUSPENSION REJECTION.

If required data is missing from the suspension request, or the domain name is not registered, the request will be rejected and returned to Vanguard or Vanguard’s approved registrar(s) with the following information:

- Threat domain name

- Registry incident number

- Verisign case number

- Error reason


Vanguard will notify the registrar of record in relation to a complaint.



E. ABUSE POINT OF CONTACT AND PROCESS FOR ADDRESSING COMPLAINTS

Vanguard will act as the primary abuse point of contact for the gTLD. Vanguard may use its third party registrar(s) or its selected back end registry services provider, Verisign, to perform some or all of the functions associated with handling inquiries relating to malicious conduct in the gTLD. Contact details (including at least a valid email and mailing address) for the abuse primary contact will be displayed prominently on Vanguard’s main website. The primary contact will investigate and respond to all complaints and incidents within a reasonable time and be empowered to take effective action within well-defined written criteria to guide those actions. Action will be taken in line with what is set out in this answer and the registration policy for the .vanguard domain. Changes to contact details will be clearly and effectively communicated to ICANN and prominently displayed on Vanguard’s website.

The above mentioned email address will be set up to receive complaints for any potential malicious conduct in the TLD. Furthermore, the email address will be routinely monitored over a 24 hour period, 365 days a year. Complainants will be provided with a written email response communication containing an auditable tracking or case number. Vanguard will investigate all reasonable complaints and take any reasonably necessary and appropriate action. Verified law enforcement requests will be addressed in no more than twenty-four hours from verified receipt. All other requests will be addressed in no more than seventy-two hours from receipt.

Abuse complaint metrics will be tracked, and adequate resources will be expended to ensure appropriate trending of those metrics by providing the abuse point of contact with sufficient resources. The complaint metrics will be gathered by the registrar(s) and regularly forwarded to Vanguard for the purposes of identifying gaps in the Registry’s current policies and areas of improvement. Given Vanguard’s belief that infrastructure protection, rights protection and user security are paramount goals of operating the TLD, Vanguard intends to engage a third party registrar(s), who will be required to ensure that sufficient resources are provided to satisfy this critical requirement, and to do whatever is reasonably necessary to ensure a secure and trusted zone.

Vanguard will have strict controls over the registration and use of the .vanguard domain names. Vanguard will devise and document strict criteria and authority levels which will need to be satisfied before a domain name can be registered for use. To ensure independence of this function, a third party registrar will be responsible for ensuring strict compliance with the criteria and authority levels designated. Only authorized personnel within Vanguard organization will be permitted to request and⁄or authorize DNS changes to be made either by the third party registrar or the registry services provider. Vanguard’s documented criteria and authority levels for registering a domain name ensure multiple, unique points of contact are needed to request and⁄ or approve, update, transfer and⁄ or deal with deletion requests, and will require notification of multiple unique points of contact when a domain name has been updated, transferred, or deleted.



F. ORPHAN GLUE RECORDS

Vanguard will ensure proper attention is paid to orphan glue records. While orphan glue often supports correct and ordinary operation of the DNS, Vanguard understands that it will be required, via Specification 6 of the Registry Agreement, to take action to remove orphan glue records when provided with evidence in written form that such records are present in connection with malicious conduct. Vanguard’s robust controls on registration and use, and ongoing monitoring of the .vanguard zone, should ensure that this is not an area of concern. Furthermore, Vanguard’s selected backend registry services provider’s (Verisign’s), registration system is specifically designed to not allow orphan glue records. Registrars are required to delete⁄move all dependent DNS records before they are allowed to delete the parent domain. To prevent orphan glue records, Verisign performs the following checks before removing a domain or name server:



CHECKS DURING DOMAIN DELETE:

- Parent domain delete is not allowed if any other domain in the zone refers to the child name server

- If the parent domain is the only domain using the child name server, then both the domain and the glue record are removed from the zone



CHECK DURING EXPLICIT NAME SERVER DELETE:

- Verisign confirms that the current name server is not referenced by any domain name (in-zone) before deleting the name server



ZONE-FILE IMPACT:

- If the parent domain references the child name server AND if other domains in the zone also reference it AND if the parent domain name is assigned a server Hold status, then the parent domain goes out of the zone but the name server glue record does not

- If no domains reference a name server, then the zone file removes the glue record



CONTROLS ON NEW REGISTRATIONS OF DOMAIN NAMES

Vanguard will adopt and impose strict controls over the registration and use of .vanguard domain names. Vanguard will devise and document strict criteria and authority levels which will need to be satisfied before a domain name can be registered for Vanguard’s use. To ensure appropriate verification of this function, third party registrar(s) will be appointed to perform the administrative aspects of the registration of domain names in strict compliance with the defined criteria and designated authority levels. The registry services provider will be provided with the defined criteria and will be required to ensure that only domains which comply with the criteria are registered. Only authorized personnel within Vanguard organization will be able to request and⁄or authorize DNS changes to be made either by the third party registrar(s) or the registry services provider. Vanguard’s documented criteria and authority levels for domain name registration will ensure multiple, unique points of contact are needed to request and⁄ or approve, update, transfer and⁄ or deal with deletion requests, and will require notification of multiple unique points of contact when a domain name has been updated, transferred, or deleted.

Vanguard confirms that it will meet the standards set out in the Registry Agreement, with respect to the Sunrise and Trademark claims process for any domain names registered.



G. ENSURING WHOIS ACCURACY

A complete and accurate Whois database promotes the prevention of identity theft, fraud and other on-line crime, promotes the public’s ability to police its rights against unlawful copyright and trademark infringement, and minimizes technical errors. Vanguard has a compelling interest in accounting to itself and the public for the use of Applicant assets, and in ensuring those assets are only used by persons or entities authorized by Vanguard. That interest is especially strong with respect to the .vanguard and all domain names registered or used therein, since it is a core component of Vanguard’s online branding and technological platform.

Vanguard will enforce the Whois data accuracy provisions in ICANN’s Registry Agreement, Registrar Accreditation Agreement and all relevant Consensus Policies. Those agreements generally require all registrants to provide accurate and reliable contact details and promptly update any changes made during the registration term. Vanguard’s registrars must present to the registrant the current Whois information, and remind the registrant that provision of false Whois information can be grounds for cancellation of the domain name registration. Vanguard and⁄or its affiliates (as defined in this response) will be listed as the sole registrant of all domains within the .vanguard. Vanguard’s clear written policy which requires the relevant corporate authorisation and approvals to be procured and evidenced for any .vanguard domain name to be registered for Vanguard’s use, and the subsequent verification through a registrar will ensure thorough pre-verification of all Whois data. Therefore, all Whois information will be complete and accurate at the time of registration. In the event of any change in the Whois contact information for a domain name, that change will be promptly updated in the Whois database.

Verisign, Vanguard’s selected backend registry services provider, has established policies and procedures to encourage registrar compliance with ICANN’s Whois accuracy requirements. Verisign provides the following services to Vanguard for incorporation into its full-service registry operations.



REGISTRAR SELF CERTIFICATION.

The self-certification program consists, in part, of evaluations applied equally to all operational ICANN accredited registrars and conducted from time to time throughout the year. Process steps are as follows:

- Verisign sends an email notification to the ICANN primary registrar contact, requesting that the contact go to a designated URL, log in with his⁄her Web ID and password, and complete and submit the online form. The contact must submit the form within 15 business days of receipt of the notification;

- When the form is submitted, Verisign sends the registrar an automated email confirming that the form was successfully submitted;

- Verisign reviews the submitted form to ensure the certifications are compliant;

- Verisign sends the registrar an email notification if the registrar is found to be compliant in all areas;

- If a review of the response indicates that the registrar is out of compliance or if Verisign has follow-up questions, the registrar has 10 days to respond to the inquiry;

- If the registrar does not respond within 15 business days of receiving the original notification, or if it does not respond to the request for additional information, Verisign sends the registrar a Breach Notice and gives the registrar 30 days to cure the breach;

- If the registrar does not cure the breach, Verisign terminates the Registry-Registrar Agreement (RRA).



WHOIS DATA REMINDER PROCESS.

Verisign regularly reminds registrars of their obligation to comply with ICANN’s Whois Data Reminder Policy, which was adopted by ICANN as a consensus policy on 27 March 2003. Verisign sends a notice to all registrars once a year reminding them of their obligation to be diligent in validating the Whois information provided during the registration process, to investigate claims of fraudulent Whois information, and to cancel domain name registrations for which Whois information is determined to be invalid.



H. RESOURCE PLANNING

Vanguard has effectively mitigated the risk of abuse in the gTLD and foresees dedicating a member of staff to act as the primary points of contact for handling inquiries relating to malicious or abusive conduct in the TLD. Vanguard is committed to ensuring that sufficient resources are made available at all times. Vanguard may engage its third party registrar(s) and its selected back end registry services provider, Verisign, to perform some or all of the tasks associated with abuse issues. This will ensure that highly skilled, specialized and scalable resources are on hand to address any possible abuse issues both during the startup phase of the TLD and continually during operations of the TLD.

Verisign, Vanguard’s selected backend registry services provider, is an experienced backend registry provider that has developed a set of proprietary resourcing models to project the number and type of personnel resources necessary to operate a TLD. Verisign routinely adjusts these staffing models to account for new tools and process innovations. These models enable Verisign to continually right-size its staff to accommodate projected demand and meet service level agreements as well as Internet security and stability requirements. Using the projected usage volume for the most likely scenario (defined in Question 46, Template 1 – Financial Projections: Most Likely) as an input to its staffing models, Verisign derived the necessary personnel levels required for this gTLD’s initial implementation and ongoing maintenance. Verisign’s pricing for the backend registry services it provides to Vanguard fully accounts for cost related to this infrastructure, which is included in the registry services provider costs in Section I.K “Outsourcing Operating Costs” within the Question 46 financial projections response.

Verisign employs more than 1,040 individuals of which more than 775 comprise its technical work force. (Current statistics are publicly available in Verisign’s quarterly filings.) Drawing from this pool of on-hand and fully committed technical resources, Verisign has maintained DNS operational accuracy and stability 100 percent of the time for more than 13 years for .com, proving Verisign’s ability to align personnel resource growth to the scale increases of Verisign’s TLD service offerings.

Verisign projects it will use the following personnel roles, which are described in Section 5 of the response to Question 31, Technical Overview of Proposed Registry, to support abuse prevention and mitigation:

- Application Engineers: 19

- Business Continuity Personnel: 3

- Customer Affairs Organization: 9

- Customer Support Personnel: 36

- Information Security Engineers: 11

- Network Administrators: 11

- Network Architects: 4

- Network Operations Center (NOC) Engineers: 33

- Project Managers: 25

- Quality Assurance Engineers: 11

- Systems Architects: 9


To implement and manage the .vanguard gTLD as described in this application, Verisign, Vanguard’s selected backend registry services provider, scales, as needed, the size of each technical area now supporting its portfolio of TLDs. Consistent with its resource modeling, Verisign periodically reviews the level of work to be performed and adjusts staff levels for each technical area.

When usage projections indicate a need for additional staff, Verisign’s internal staffing group uses an in-place staffing process to identify qualified candidates. These candidates are then interviewed by the lead of the relevant technical area. By scaling one common team across all its TLDs instead of creating a new entity to manage only this proposed gTLD, Verisign realizes significant economies of scale and ensures its TLD best practices are followed consistently. This consistent application of best practices helps ensure the security and stability of both the Internet and this proposed gTLD, as Verisign holds all contributing staff members accountable to the same procedures that guide its execution of the Internet’s largest TLDs (i.e., .com and .net). Moreover, by augmenting existing teams, Verisign affords new employees the opportunity to be mentored by existing senior staff. This mentoring minimizes start-up learning curves and helps ensure that new staff members properly execute their duties.




I. CONCLUSION

The approach outlined in this answer clearly shows that the risk of abuse in the .vanguard TLD has been extensively mitigated and as a direct result is very low. Vanguard is committed to ensuring that abuse will not be tolerated. The proposed policies and methods for addressing any abuse exceed the standard outline in the gTLD Applicant Guidebook and is more than commensurate with the risks identified, Vanguard is, therefore, entitled to a score of two points for its response to Question 28.




** VANGUARD’S DRAFT REGISTRATION POLICY



1. DOMAIN NAME LICENCES

Upon registration of a Domain Name, the Registrant holds a licence to use the Domain Name for a specified period of time in accordance with the Registry Rules. Domain Names may be registered and renewed for 1, 2, 3, 4, 5, 6, 7, 8, 9 or 10 years.



2. SELECTION OF REGISTRARS

Registrars eligible to register domain names must meet the following non-discriminatory criteria (in compliance with clause 2.9 (a) of the Registry Agreement):

(i) be an accredited ICANN Registrar;

(ii) demonstrate a level of understanding of the Domain Name registration policies of the Registry;

(iii) have experience of managing the Domain Names of major corporations;

(iv) have proven tools for domain name portfolio management;

(v) have business processes to perform automated validation (and any additional human checks as required by the Registry) of the eligibility of the domain name for registration according to the Domain Name policies of Vanguard;

(vi) demonstrate a sufficient level of security to protect against unauthorised access to the Domain Name records;

(vii) demonstrate experience and have appropriate resources in managing abuse prevention, mitigation and responses;

(viii) provide multi-language support for the registration of IDNs;

(ix) comply with any re-validation of its Registry-Registrar agreement at such regular intervals as are determined by the Registry or as required by ICANN from time to time;

(x) meet applicable technical requirements of Vanguard; and

(xi) comply with all conditions, dependencies, policies and other requirements reasonably imposed by Vanguard, including maintenance of suitable systems and applications that are capable of interacting with the Registry system.



3. ELIGIBLE REGISTRANTS

The Registrant must be:

(i) an Affiliate entity of Vanguard; or

(ii) an organisation explicitly authorised by Vanguard; or

(iii) a natural person explicitly authorised by Vanguard.
If the Registrant does not meet one of the above eligibility criteria, there is no entitlement to register a Domain Name under the .vanguard gTLD. If the Registrant ceases to be eligible at any time in the future, the Registry may cancel or suspend the licence to use the Domain Name immediately.



4. REGISTRY APPROVAL REQUIREMENT

Registration of Domain Names under the .vanguard gTLD must be approved by Vanguard in addition to meeting all requirements under the Registry Rules. Vanguard’s approval for a complete and validly submitted application will be authorised by:

(i) Legal Department- Intellectual Property Unit⁄Manager (“Authorisation Provider”); or

(ii) an authorised person as nominated by Vanguard (“Authorised Person”) and notified to the Registrar from time to time.
The Authorisation Provider will notify the Registrar of its decision.



5. REQUIRED CRITERIA FOR DOMAIN NAME REGISTRATION

An application for Domain Name registration must meet all the following criteria:

(i) availability;
a. the Domain Name is not already registered;
b. it is not reserved or blocked by the Registry; or
c. it meets all Registry’s technical requirements.

(ii) technical requirements;
a. a maximum of 63 characters (after its conversion into the ASCII for IDNs);
b. use of characters selected from the list of supported characters as nominated by the Registry; and
c. any additional technical requirements as required by the Registry from time to time.

(iii) the Domain Name must be consistent with the mission and purposes of the gTLD and consistent with the Domain Name registration policy of Vanguard, and include but not be limited to:
a. product name;
b. service name;
c. marketing term;
d. geographic identifier; or
e. any relevant name or term as approved by Authorisation Provider or Authorised Person.

(iv) compliance with all requirements under the Registry Rules: the Registrant must comply with all provisions contained in the Registry Rules.



6. OBLIGATION OF REGISTRANTS

The Registrant must enter into an agreement with the Registrar for Domain Name registration under which the Registrant will be bound by the Registry Rules specified through the Registry-Registrar agreement as amended by the Registry from time to time.

The Registrant must also agree to be bound by the minimum requirements in clause 3.7.7 of ICANNʹs Registrar accreditation agreement.

The Registrant must represent and warrant that:

(i) it meets, and will continue to meet, the eligibility criteria at all times and must notify the Registrar if it ceases to meet such criteria;

(ii) the registration, renewal and use of the Domain Name does not violate any third party intellectual property rights, applicable laws or regulation;

(iii) it is entitled to register the Domain Name;

(iv) the registration and use of the Domain Name is made in good faith and for a lawful purpose;

(v) if the use of registered Domain Name is licensed to a third party,
a. the Registrant must have a licencing agreement with the licensee for the use of the Domain Name that is not less onerous than the obligation of the Registrant contained in the Registry Rules; and
b. where there is a breach of any provisions contained in the Registry Rules by the licensee of the Domain Name, Registry may revoke the Domain Name at its sole discretion.

(vi) it owns or otherwise has the right to provide all registration data (including personal information) for each Domain Name registered and provision of such registrant data complies with all applicable data protection laws and regulations; and

(vii) It has appropriate consent and licences to allow for publication of registration data in the WHOIS database.



7. REGISTRANT CONTACT INFORMATION

The Registrant must provide complete and accurate contact information of the Registrant (in accordance with clause 3.7.7.1 of the ICANN’s Registrar accreditation agreement), including but not limited to the following;

(i) if the Registrant is a company or organisation:
a. name of a company or organisation;
b. registered office and principal place of business; and
c. contact details of the Registrant including e-mail address and telephone number;

(ii) if the Registrant is a natural person:
a. full name of the Registrant;
b. address of the Registrant; and
c. contact details of the Registrant including e-mail address and telephone number.


All Registrant contact information must be complete and accurate. Any changes to such Registrant information must be promptly notified to the Registrar, and no later than one (1) month of such change.



8. REVOCATION OF DOMAIN NAMES

The Registrant acknowledges that the Registry may revoke a Domain Name immediately at its sole discretion:

(i) in the event the Registrant breaches any Registry Rules;

(ii) to comply with applicable law, court order, government rule or under any dispute resolution processes;

(iii) where such Domain Name is used for any of the following prohibited activities (Prohibited Activities):
a. spamming;
b. intellectual property and privacy violations;
c. obscene speech or materials;
d. defamatory or abusive language;
e. forging headers, return addresses and internet protocol addresses;
f. illegal or unauthorised access to other computers or networks;
g. distribution of internet viruses, worms, Trojan horses or other destructive activities; and
h. any other illegal or prohibited activities as determined by the Registry.

(iv) in order to protect the integrity and stability of the domain name system and the Registry;

(v) where such Domain Name is placed under reserved names list at any time; and

(vi) where Registrant fails to make payment to the Registrar for registration, renewal or any other relevant services.



9. USE OF SECOND OR THIRD LEVEL IDNs

In addition to meeting all required criteria for registration of domain names above, an application for an IDN Domain Name must:

(i) comply with any additional registration policy on IDNs for each language;

(ii) meet all technical requirement for the applicable IDN;

(iii) comply with the IDN tables used by the Registry as amended from time to time; and

(iv) meet any other additional technical requirements as required by the Registry.



10. USE OF GEOGRAPHIC NAMES

All two-character labels and country and territory names will be initially reserved in accordance with specification 5 of the Registry Agreement.

Upon approval from ICANN and any other guidelines by applicable governments and ICANN’s Governmental Advisory Committee, the Registry may release the two-character labels and country and territory names in accordance with Vanguard’s response to Question 22 Geographic Names.



11. RESERVED NAMES

The Registry may place certain names in its reserved list from time to time where:

(i) the Registry believes in its sole discretion that use of such names may pose a risk to the operational stability or integrity of the Registry;

(ii) in accordance with ICANN’s specifications contained in the Registry Agreement, guidelines or recommendations;

(iii) there is a risk of trademark infringement or where the name otherwise may cause confusion taking into consideration the mission and purpose of the gTLD; or

(iv) the Registry in its sole discretion decides certain names to be reserved for any reason.




12. ALLOCATION OF DOMAIN NAME

The Registry will register Domain Names on a first-come, first-served basis in accordance with the Registry Rules. The Registry does not provide pre-registration or reservation of Domain Names.



13. LIMITATION ON REGISTRATION ⁄ DOMAIN NAME LICENCES

There is no restriction on the number of Domain Names any Registrant may hold. The Registrant may further licence the use of the Domain Name to any third parties provided that the Registrant enters into an agreement with such third parties on the terms not less onerous than its obligations under the Registry Rules.



14. PROTECTION OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS

The Registry will implement all rights protection measures as required by ICANN in clause 2.8 of the Registry Agreement, including the use of the Uniform Rapid Suspension (URS) procedure, and Uniform Domain Name Dispute Resolution Policy (UDRP).



15. TERM OF REGISTRATION ⁄ RENEWAL


INITIAL TERM OF REGISTRATION:

A Domain Name can be registered for a period between one (1) to ten (10) years.



RENEWAL OF REGISTRATION:

(i) The term may be extended at any time for a period between one (1) to ten (10) years, provided that the total aggregate term of the Domain Name does not exceed ten (10) years at any time.

(ii) Upon change of sponsorship of the Domain Name from one Registrar to another, according to Part A of the ICANN Policy on Transfer of Registrations between Registrars, the term of registration of the registered Domain Name will be extended by one year, provided that the maximum term of registration at any time does not exceed ten (10) years.

(iii) The change of sponsorship of the registration of a Domain Name from one Registrar to another, accordingly to Part B of the ICANN Policy on Transfer of Registrations between Registrars will not result in the extension of the term of registration.



CANCELLATION OF REGISTRATION:

The Registrant may cancel a Domain Name registration at any time by submitting its request in writing with the Registrar.



AUTO-RENEWAL:

Upon expiry of the Domain Name, the Registry will auto-renew the Domain Name for a one year term (1) year term unless the Registrant submits its intention not to renew the Domain Name.

The Registry will implement the business rules for the renewal of Domain Names documented in appendix 7 of the .com Registry Agreement.



16. TRANSFER OF DOMAIN NAMES BETWEEN REGISTRANTS

Any transfer of a Domain Name between Registrants must be approved by the Registry through the Registrar. The legal heirs of the Registrant or purchaser of the Registrant may request the transfer provided that they meet the eligibility criteria for registration under the .vanguard gTLD. If the Registrant becomes subject to insolvency or any other proceeding, the administrator may request the transfer. The transferee must provide appropriate documentation as required by the Registry to approve such transfer.



17. CHANGE OF REGISTRAR

If the agreement between the Registry and the Registrar is terminated and if the Registrar has not transferred its Domain Name portfolio to another Registrar, the Registry will notify affected Registrants. The Registrants must select a new Registrar within one (1) month following such notice from the Registry. If the Registrant fails to appoint a new Registrar within the timeframe set out above, the Registry may suspend the Domain Name.

If the Registrant wishes to change the Registrar, the Registrant must obtain the auth-info code from the Registrantʹs current Registrar, and request a transfer through the gaining Registrar in compliance with ICANNʹs Inter-Registrar transfer policy.



18. PRIVACY AND DATA PROTECTION

By registering a Domain Name, the registrant authorises the Registry to process personal information and other data required for the operation of the .vanguard gTLD. The Registry will only use the data for the operation of the Registry including but not limited to its internal use, communication with the Registrant, and provision of WHOIS look-up facility.


The Registry may only transfer the data to third parties:

(i) with the Registrant’s consent;

(ii) in order to comply with laws, regulations or orders by a competent public authority and any Alternative Dispute Resolution (ADR) providers; or

(iii) for a publicly available and searchable WHOIS look-up facility, in accordance with specification 4 of the Registry Agreement.



19. WHOIS

The Registry provides a publicly available and searchable WHOIS look up facility, where information about the Domain Nameʹs status (including creation and expiry dates), and registrant, administrative and the technical contact administering the Domain Name can be found, in accordance with specification 4 of the Registry Agreement.

In order to prevent misuse of the WHOIS look up facility, the Registry requires that any person submitting a WHOIS database query will be required to read and agree to the terms and conditions, which will provide that:

(i) the WHOIS database is provided for information purposes only; and

(ii) the user agrees not to use the WHOIS information to allow or enable the transmission of unsolicited commercial advertising or other communication via email or other methods to the Registrants.



20. PRICING ⁄ PAYMENT

The new gTLD does not charge a separate fee for the Registrar to register domain names, as the gTLD is used only for the specified mission and purpose of Vanguard. Vanguard shall bear the cost of operating the Registry.

The Registry will provide Registrars with 30 days’ notice of any price change for new registrations, and 180 days advance notice of any price change for renewals in accordance with clause 2.10 of the Registry Agreement.



21. DISPUTE RESOLUTION

The Registrant agrees to be bound by ICANN’s Dispute Resolution Policies in respect of all disputes in connection with the Domain Name.



22. COMPLIANCE WITH CONSENSUS AND TEMPORARY POLICIES

The Registrant agrees to be bound by all applicable consensus and temporary policies as required and mandated by ICANN.



23. DEFINITIONS

Affiliate means in relation to a party any corporation or other business entity controlling, controlled by, or under common control of that party and for the purposes of this definition, a corporation or other business entity shall be deemed to control another corporation or business entity if it owns directly or indirectly:

(i) fifty percent (50%) or more of the voting securities or voting interest in any such corporation or other entity; or
(ii) fifty percent (50%) or more of the interest in the profit or income in the case of a business entity other than a corporation; or
(iii) in the case of a partnership, any other compatible interest equal to at least a fifty percent (50%) share in the general partner.


Domain Name means a domain name registered directly under the .vanguard gTLD or for which a request or application for registration has been filed with the Registry;


ICANN’s Dispute Policy means the dispute policy currently known as the Uniform Domain Name Dispute Resolution Policy (UDRP) issued and as may be updated from time to time by the Internet Corporation of Assigned Names and Number (ICANN) and the Uniform Rapid Suspension (URS) (see Specification 7 of the Registry Agreement).


Registrar means an ICANN accredited registrar which enters into and is in compliance with the registry-registrar agreement for the TLD, and which provides domain name registration services to Registrants;


Registry means Vanguard Group Inc. (Vanguard);


Registry Agreement means the agreement between Vanguard and ICANN;


Registry Rules mean:
(i) Registration terms and conditions agreed between the Registry and Registrant for registration of a Domain Name; and
(ii) Registration policies provided and amended by the Registry from time to time.


Registrant means a natural person, company or organisation who holds a Domain Name registration or who has requested or applied for the registration of a Domain Name.




*** DRAFT PROCEDURE FOR MANAGEMENT OF TRADEMARK INFRINGEMENT CLAIMS:


It is almost impossible to devise a standard response⁄process for all claims made of trademark infringement, as the seemingly small individual differences between each complaint and between each domain name registration make the course of action potentially different in each case. This draft procedure is a guide to the general approach required, but thought should be given to the appropriateness of any action in each case, with assistance from designated senior manager where appropriate.


(a) DOMAIN NAME ITSELF IS CLAIMED TO BE AN INFRINGEMENT OF A PARTY’S TRADEMARK RIGHTS:


i. ACTIONS

- Determine if the name is being used for any “visible” fraudulent activity such as phishing. If so, follow the phishing process.
- If no fraudulent content , send “invalid whois” notice to the registrant of the domain name



ii FORMULATING A RESPONSE TO COMPLAINANT

- It is outside of a registrar’s scope to determine if a domain name infringes a party’s rights
- Cannot transfer or delete a domain name based on complaint alone – will need to be issued with copies of relevant court orders or other appropriate documentation
- Outline invalid whois process and inform complainant that a notice has already been sent to the registrant in respect of this
- If applicable, inform the complainant that the complaint has also been forwarded to the reseller who may be able to take action.
- Suggest Uniform Dispute Resolution Policy action




(b) WEBSITE LOCATED AT THE DOMAIN NAME CONTAINS LOGOS OR TEXT WHICH ARE CLAIMED TO INFRINGE ANOTHER PARTIES RIGHTS:

i. ACTIONS (WHERE THE REGISTRAR IS NOT THE HOST)
- Determine if the name is being used for any “visible” fraudulent activity such as phishing. If so, follow the phishing process.
- If no fraudulent content, send “invalid whois” notice to the registrant of the domain name



ii FORMULATING A RESPONSE TO COMPLAINANT (WHERE REGISTRAR IS NOT THE HOST):

- Inform complainant that the Registrar is not hosting the content, and therefore has no ability to access, modify or delete the content.
- Outline who the host is, and, if able to determine, steps to contact them.
- Outline invalid whois process and inform complainant that a notice has already been sent to the registrant in respect of this (use prepared template)
- If applicable, inform the complainant that the complaint has also been forwarded to the relevant third party Registrar



iii. WHERE REGISTRAR IS THE HOST:

- Review, formulate a proposed course of action based on the circumstances and applicable policies,
- Discuss proposed course of action with designated senior manager and base response to complainant around this.