Never buy a .online domain

https://www.0xsid.com/blog/online-tld-is-pain

by ssiddharth • 5 months ago

787 494 5 months ago

ocdtrekkie• 5 months ago

A great reminder even if you aren't a Google customer, Google's love of banning people with no notice or recourse will still screw you over.

ssiddharth8• 5 months ago

I'm shocked there was no notification, or alert, of any kind. One moment you're there, the next, you're gone and no one will talk to you. Insanity.

Citizen_Lame3• 5 months ago

That’s not fair. Google has no hesitation in banning its own customers either. Combine this with private equity vultures (namecheap) and shitty registrar, you are always one AI token away from being banned.

e402• 5 months ago

Shit, didn’t know that namecheap was acquired by PE! Very sad news. Is there any registrar left that isn’t crap?

Imustaskforhelp7• 5 months ago

Yea regarding namecheap/spaceship (their sort of subsidiary company). I once created a tool which could find me a cool short .de domain out of curiosity and I tried using namecheap bulk's domain feature.

It said that https://aid.de was available. I was out of the moon happy (silly me) thinking that its such a good domain or something.

Then I saw aid.de available in namecheap for around 2$ ish but for some reason I took a bath and hten later it showed 10$ ish.

Okay, I then went to spaceship and it also showed me aid.de available. I then took my card and signed up

Well the transaction took place but got refunded. It said that there was an issue or something and got insta refunded

Silly me, thought that the payment had issues and decided to do payment again. This time though my refund had to wait 10 days to come back because of international laws.

Now I had only very little amount stuck btu I can see someone losing substantial money/having it stuck

I contacted their support and they told me that both namecheap/spaceship have a bug where some domains show available when they aren't.

I haven't checked but since the amount was like 1-2$ now but this whole thing really soured my relationship with namecheap/spaceship.

For context, before this, I also had a hate/love relationship with namecheap because once I bought a domain with them using crypto and also bought their vpn which was like 20 cents basically

It had auto renewal on and my domain costed 1$ but crypto payment requires 10$ minimum and the VPN charged me money from that.

Luckily I had spotted before the 2nd month and to be honest, like only 1 month 10 days or something and I urged the namecheap company to do what's right (in that moment because a lapse of judgement had been made from my side/error and I hoped that namecheap could realize it and do "right" instead given that the cost was only around 10$ fwiw)

After waiting for many days, they finally did what's right and gave me my credits back as a one off thing and I then turned off their domains.

I also used a crypto swap thing to convert b/w usdc and btc (what namecheap accepts) and I had an issue of doing two times payment after the timeperiod of btc payment (15 mins) but they also fixed that issue by adding the credits manually when I raised the issue.

Their customer support at times can be good but the platform itself is a little shady in my opinion. For the VPN thing if I remember correctly, the auto renew was written with grey and I genuinely didn't read it without my specs.

I am gonna keep my domain with namecheap that I have and if I get deals from namecheap/spaceship then use them, but for individual domains without deals, hell no.

I know that many people don't like the centralized nature of cloudflare but cloudflare is a good thing for domains :/

I personally just buy domains from wherever's there's a deal right now as some domains I have are some that I keep for only 1 year or similar.

To be honest, if I want to pick a domain-thing, I'd rather pick the one which is the cheapest or if not, then the one which only sells domains

I just looked at porkbun and they only sell domain related things and at best mail (they also have a deal with proton which can be interesting to many)

Porkbun is also cheap so I think I would recommend porkbun/cloudflare.

I haven't decided if I will transfer my domains from namecheap or not but their customer service is nice but the same can't be said for their service sometimes in my opinion.

soco• 5 months ago

Enshittification at its peak (or is it at its peak already?)

FroshKiller• 5 months ago

There is no peak, because it's a hole, and we can always dig deeper.

palad1n3• 5 months ago

Are there any other TLDs that are of this ilk or are we saying nothing but .com will ever do? Or .org, perhaps?

DetroitThrow• 5 months ago

I would love a list of Radix TLDs or registrars who do this Safe Browsing ban with no appeal.

Also, go figure Namecheap works with these morons.

bjord• 5 months ago

from their site (radix.website):

.store, .online, .tech, .site, .fun, .pw, .host, .press, .space, .uno, .website

not sure about other registrars

kotaKat• 5 months ago

Some of these TLD also get thrown under weird arbitrary blacklists by security vendors.

Sorry, can’t buy a frame.work laptop because that’s a “Malicious TLD”, according to the folks at ZScaler.

kristofferR• 5 months ago

It's not exactly the same, but a lot of owners of weird TLDs have got hit with insane renewal fees,.hosting went from $20/y to $300/y overnight.

Also, some TLDs directly speculate on having very low prices for the first year or two, then 10x it on year 2 or 3.

ectospheno4• 5 months ago

Buy all 10 years you can when you get the domain. Renew yearly. When they pull silliness like this you have at least 9 years to migrate.

ranger_danger3• 5 months ago

The ones used by freenom were particularly abused:

https://prezkennedy.com/2026/01/15/the-free-domain-trap-the-...

Freenom’s terms of service allowed them to “cancel” a free domain at any time without warning. Users reported for years that as soon as their free site started getting significant traffic (and becoming valuable), Freenom would reclaim the domain and fill it with ads, effectively hijacking the user’s hard work.

palad1n3• 5 months ago

Oh, sh!t, I used to own a .tk! Have no idea what happened to it.

Macha5• 5 months ago

.com, .org have legacy contracts eliminating the shenanigans they can pull. .org did try get out of restrictions on hiking the price on renewals, but weren’t successful. So all my domains are either .com, .org or the TLD for the country where I live (of course, how trustworthy your local ccTLD is varies)

pil0u• 5 months ago

One conclusion is:

Not adding the domain to Google Search Console immediately.

I don't understand. What is Google Search Console, and should I add all my domains there right now?

notenlish• 5 months ago

By adding your site to there you can get data on how many clicks & impressions your site received on google, what keywords it ranks for etc.

You can also request Google to index your site on GSC as well.

You should probably add your websites to GSC.

onli• 5 months ago

https://search.google.com/search-console/about. Yes. It gives you options in cases as described here.

Was called webmastertools before.

techcode• 5 months ago

Can't answer if you should add them or not...

But if you do - you would get some notifications from Google about that website/domain.

I've only ever seen emails of the "There's an increase in 4xx/5xx errors on site/page(s)"

Macha5• 5 months ago

I also get “there were crawl errors”, which upon investigation are for pages that never existed (and I’ve owned the domain for 20 years, so its not a previous owner/operator thing)

joelccr• 5 months ago

If it's already in the Console when it gets blacklisted, you can appeal it without having to 'verify' ownership of the domain that, in this case, you no longer control the DNS of, because you completed that process when adding it to Console.

embedding-shape• 5 months ago

I don't understand. What is Google Search Console, and should I add all my domains there right now?

Google's way of tying real identifies of people to domains, without making it explicit.

Basically, your domain will be weirdly treated by a bunch of entities, none the less Google themselves, if you don't add your domain there (or some other Google property).

Especially with less common TLDs, like .online, they really want to be able to tie it to some identity, so unless you add it there, eventually your domain ends up on some sort of blacklist, in the case of the author it seems they used the "Google Safe Browsing" blacklist to get the author to involve Google somehow.

qingcharles• 5 months ago

Open a fake Google account under your dog's name using a VPN? It doesn't have to be tied to your own every day Goog acct. Any old account will do.

ssiddharth8• 5 months ago

To request a formal review, you must be a verified owner in Search Console.

swiftcoder4• 5 months ago

https://search.google.com/search-console

And yes, you probably should, if only to pre-register your ownership thereof if google ever decides to nuke you from orbit

inigyou• 5 months ago

But if Google decides to nuke me from orbit, and my domain is registered there, the nuke can cross between my domain and my Google account.

tucnak• 5 months ago

The .com purist advice is sound but you're not getting four-letter domain names that way, and in some ccTLD zones you can still.

I was price-gouged out of owning a single, rare .icu domain when renewal fee for it went from 20 usd to 220 usd overnight, just for this one domain... I'm pretty sure it's not Gandi, but the TLD opetator, because other .icu domains I've had were fine. I decided to eventually abandon them all anyway. Moved away from Gandi later when they started doing gouging of their own, too.

What is HN's opinion on Dynadot?

palad1n3• 5 months ago

Yeah, what the heck happened to Gandi? It used to be my go-to, but nowadays... yikes!

Citizen_Lame3• 5 months ago

Private equity cancer, same as Namecheap.

timpera2• 5 months ago

They got sold to private equity, unfortunately. I switched to Bookmyname (by Scaleway) for some TLDs, and Infomaniak for others.

mystraline2• 5 months ago

So, how is this not libel by Google? The claim was that you were running an "unsafe site". Its their job to prove that, and not just "black box says so".

And you have system and reputational damages.

Go for small claims suit, $5000. It'll cost more than that for their attorney to go to your jurisdiction.

moralestapia• 5 months ago

This is libel, indeed.

dathinab4• 5 months ago

because google safe browsing is only supposed to display a "not safe to browse" warning when using chrome browsers (and maybe some other browsers) wich you can (theoretically) dismiss(1)

it's not meant to have any other consequences

so basically what happens is that because of hearsay of google thinking you site is not bad Radix does what normally should involve a judge order (taking down the whole domain)

(1): Yes that still would cause damages on any site with customers, but like way less and way more fixable then what happened here.

otterley32• 5 months ago

It’s not libel. Defamation requires a false statement of fact. Claiming a website is “unsafe” is an opinion.

(IAAL, but this is not legal advice. Consult a licensed attorney for legal advice.)

donmcronald6• 5 months ago

The warning says something along the lines of "Dangerous Site Ahead. Attackers on [site] may trick you into doing something dangerous..."

If I'm the only one with access to the site, they're calling me an attacker and saying that I might try to steal passwords, credit card info, etc.. If they're calling me an attacker, that seems like more than an opinion. Wouldn't they have to prove I'm a bad guy if they're asserting I'm a bad guy?

merek• 5 months ago

The TLD owner in this case was Radix, which also owns

.store .online .tech .site .fun .pw .host .press .space .uno .website

https://radix.website/

g947o• 5 months ago

They seem to be almost always associated with scam sites.

So, might as well to block entire TLDs and never buy a domain under those TLDs

xnorswap• 5 months ago

The only .fun site I know is neal.fun, which regularly features on the front page here: https://news.ycombinator.com/from?site=neal.fun

jeroenhd7• 5 months ago

These alternative domains are quite popular with the fediverse and other hobbyist-run groups. Affordable domains with somewhat recognisable names still available.

Scam websites will use any TLD in my experience. Based on the ones that made it to my Google search results, .it and .info are the TLDs I should be blocking. When I search for "free roblox cash", most websites are .com. "Free robux" also brings forth a few .ca websites. "Free steam gift card" leads to .org and .com.

dist-epoch• 5 months ago

Because they are very cheap. If you are a scammer, why pay $5 for a domain when you can buy one of these for $1.

I use them when I need a random domain.

Yizahi• 5 months ago

Only .info is missing for the bingo :)

mghackerlady2• 5 months ago

funnily enough, good.store which sounds like a made up example of a scam is actually a nonprofit ran by john green and his brother hank green

eli• 5 months ago

That's just because they're relatively inexpensive

avipars2• 5 months ago

add .xyz to that list

ectospheno4• 5 months ago

Despite blocking 66 TLDs and all IDN ccTLDs on my home dns I didn’t have these blocked. Guess I’ll consider it. Once you have the hagezi rpz files including threat information feed though you really have blocked most silliness.

slekker• 5 months ago

Which other ones do you block?

jdfellow• 5 months ago

Well, dang. I've used a .tech as my personal domain and email for some years now, and didn't know this was owned by an obnoxious registry.

nickweb• 5 months ago

Hot Take: the proactive action of the registrar here is probably more beneficial than the number of false positives captured. If the registrar is aware that Google is hot on blocking potentially harmful sites, it's right that they take action expeditiously.

The bigger problem is the unbanning - for which there should be a better system, probably that should take the form of the registrar having a short grace period to aid in the Google stuff (DNS verification etc.) with additional checks by the registrar to make sure it's not being used for spam/malicious content.

The other point being why was Google banning you so quickly? This is the opaque part. Was the site reported? Was there some URL hijinks? That's the thing you'll probably never find out.

iamnothere3• 5 months ago

Relying on Google for this is actually not beneficial, as discussed here many times: https://hn.algolia.com/?q=Google+safe+browsing

If the registrar tracks this information, a possibly helpful course of action would be to notify or warn the domain owner that they are on the list.

In the modern adversarial web, I do not want a registrar that proactively disables my domain because of some third party report.

forgotaccount3• 5 months ago

The bigger problem is the unbanning

The was my first thought as well. Yes, using the Safe Browsing list feels wrong, but I don't know enough to speak definitively in that regards. However wouldn't a relatively simple solution be that if a registrar is choosing to use some third party's list of banned DNS entries that the registrar then also implement sufficient unblocked components that will allow people to be unbanned from that third party?

Add a DNS TXT or a CNAME record.

I haven't had a use-case for a TXT record come up yet, but isn't it low risk enough to allow domain owners to continue to configure TXT records even if the registrar wants to ban configuring other record types? Then the person in the article could prove ownership and could then get off of the third party ban list that the registrar was utilizing.

roblabla2• 5 months ago

There is _some amount_ of justification to ban TXT. There have been a few cases of C2 servers using DNS to send instructions to malware, so letting TXT slip through the cracks would still allow for that.

Now whether this downside justifies the massive problem it causes on false positives...

basilikum2• 5 months ago

The registry cannot ban individual record types. That is not how DNS works.

The registry only maintains a list of NameServers associated with the domain (and records for DNSSEC zone signing). Registries have nothing to do with regular records. They only record who defines those records.

ndriscoll• 5 months ago

DNS can be thought of as a distributed KV store with built in caching suitable for low write high read use cases, so TXT makes sense for that. e.g. basic feature flagging can be accomplished that way with basically no work to set it up assuming you were already using DNS.

dathinab4• 5 months ago

they didn't "just" take down the site, they took down the whole domain

Even google safe search isn't blocking you site per-se, it just adds a very annoying "this site is not safe" dialog you can "somehow" bypass (but most people wont and don't know how).

Like if this where the main site of a company (which it very much could be) this would also have taken down mail, all APIs, all Apps relying on such APIs.

so no this is absurdly unreasonable actions

that they seem to neither know nor care that this makes it impossible to "fix" false positives with google isn't helpful put this in the area of high levels of negligence which can get you into a lot of trouble in the EU

Tepix• 5 months ago

I blame both the registry and Google.

If you were a lawyer, you could have fun with this.

Btw, perhaps unrelatedly, we had a domain marked as unsafe by Google as well for no particular reason.

CodeCompost• 5 months ago

Last year, my registrar wanted €64,99 to extend an online domain which I had created for fun.

No thanks.

ryan42• 5 months ago

yeah same here. I canceled my account on name.com because I had previously obtained a .art domain maybe for ~15-20 USD / yr. Then they wanted $50 USD a year to extend it. No thanks, dropped the domain and moved to namecheap

account426• 5 months ago

If the price increase was from the registrar and not the registry you should have been able to move to a different registrar with saner prices.

mythrwy• 5 months ago

Namecheap does the same thing though, at least they did with an .online domain I have.

yanis_t• 5 months ago

I still remember how Google banned my entire account without providing a reason for a small Android app (more than 12 years ago). To this day I have no idea why, it was absolutely green-area fit tracker or something. There was absolutely no way to know the reason or unblock my account. Turned me away from Android development forever.

jkestner• 5 months ago

A relative’s business has had Google reviews frozen for years. Search results show the bad rating after some former customer and spouse left bad reviews several years ago. Appeal went into a black hole. Running a small business is at the pleasure of Silicon Valley.

pocksuppet13• 5 months ago

Check with a lawyer if this counts as tortious interference. You could potentially win quite a large sum from Google.

littlecranky67• 5 months ago

Same shit happend to me - got my google account blocked overnight and locked out of most of my digital life. Learned my lesson and ungoogled asap.

seanw444• 5 months ago

They want to make this the only way to run apps on Android too.

AshamedCaptain2• 5 months ago

The domain ... has been suspended due to its blacklisting on Google Safe Browsing

Et voilà ... ! this is precisely the slippery slope I warned about a decade ago. The indirect censorship becomes direct censorship, defeating all the arguments about the morality of such a list. And:

Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.

Yet more monopolistic power to Google.

dizhn4• 5 months ago

That is the bit that jumped at me immediately too. Why would a registrar take it upon itself to suspend a domain that another entity entirely blacklisted as part of their own completely opaque process? Who is Google? God?

On the flip side of the coin I cannot get a site removed that is a blatant rip off of one of our websites being actively used for invoice redirection fraud.

avaer• 5 months ago

It's like being unable to get a passport because Microsoft has you on The List, and Microsoft needs to see your passport to check why you're on the list.

Considering that getting a domain is a normal part of business these days, this kind of thing should be illegal. Not to mention, why does Google have any say in this?

rustyhancock• 5 months ago

Well until a human can verify.

Which likely is slow without a poke it's reasonable to base the decision on whats available.

That's just how reputation works.

bandrami• 5 months ago

Why would a registrar take it upon itself to

Because keeping Google happy or at least not bothered is an existential priority for registrars

otterley32• 5 months ago

Google’s allowed to have an opinion. But that doesn’t mean that the registrar should be suspending the domain immediately in response. These two mechanisms should be decoupled.

account426• 5 months ago

Google should not be allowed to make libelous statements without consequences.

_2d30• 5 months ago

How was this Google’s fault? Seems clearly like Radix’s fault.

account426• 5 months ago

It's both's fault. Google for making false and clearly damaging statements (libel) and Radix for acting on them.

hamdingers2• 5 months ago

If a newspaper publishes a false story about a business and someone takes it upon themselves to attack the business, it's partially the newspaper's fault.

jeroenhd7• 5 months ago

This is 100% on Radix, not on Google. Google and Microsoft can (and probably should) have a registry of known-abusive websites. False positives are inevitable, so these should be taken with a grain of salt, but in most cases they're correct. Their lists are a lot more reliable than those from the "traditional" antivirus/anti-scam vendors that will list anything remotely strange to pump up their numbers.

The external people treating these lists as absolute truths and automatically taking domains down are the ones at fault here. Google didn't grab power, Radix gave it to them without asking.

lazide2• 5 months ago

What is to stop Google et. al. from also adding a lot of excess domains to pump up there numbers?

What is to stop everyone from doing this blacklisting?

AshamedCaptain2• 5 months ago

Exactly what we predicted would happen (someone would eventually put "too much faith" on this list) has literally happened, and your defense is still "well it's not Google's fault, it's a 3rd party's!". Obviously the point is not that Google was going to do it, but that others would , analogue to the process known as "self-censorship".

kelvinjps10• 5 months ago

Wym mean external people aren't these lists integrated to the browsers? I'm sure if you try to open a website from this list your browser won't let you and I'll put a big warning sign

axus• 5 months ago

I read your comment as agreeing with the article: "Never buy a .online domain".

And Google has the right to publish a list, there should be more lists not less. But Google was at fault for not correcting their blacklist. Until the article appeared on Hacker News, this was not 0% on Google. A small, correctable mistake, but they deserved a tiny bit of blame.

the_arun• 5 months ago

Should domain name matter? Or this applicable to any domain?

TiredOfLife• 5 months ago

Where did you do the warning?

RockRobotRock• 5 months ago

That's like a business being dissolved because it got a bad rating from BBB. Absolutely insane.

iamnothere3• 5 months ago

The registrar relying on Google Safe Browsing as a “trigger” for suspension is the most horrifying thing I’ve seen in a while. This basically makes the entire TLD unviable for serious use.

RHSeeger• 5 months ago

The followup from that would appear to be don't use any domain that Radix controls.

holysoles• 5 months ago

Yeah this doesnt seem like a unique or new issue:

https://news.ycombinator.com/item?id=40195410

fc417fc802• 5 months ago

More generally, I think it's advisable to prefer the ccTLDs of places that are politically stable. And (IMO) to view com/net/org as defacto US ccTLDs (technically they aren't but for all practical purposes they might as well be).

WmWsjA6B29B4nfk• 5 months ago

Who said serious use is their business model though.

mzajc• 5 months ago

.online is one of the many TLDs that charge a dollar for registration but bump the price to $30-$35 for renewal. So far, this seems like a good signal to tell apart serious TLDs and ones just preying on customers who sort by cheapest (or capitalizing on one-off phishing domains).

volkercraig2• 5 months ago

I had a .fun domain that I was using to host a small project and they pulled that on me, I just let it expire and killed the project.

mcoliver• 5 months ago

This is the real story. This is 100% a problem with Radix. Safe browsing targets the website not the domain. No reason a registrar should be suspending an entire account over something a company reports. Black-holing the A and CNAMEs on a subdomain? Maybe..... But even then I don't think it's the registrars place to do that. Freezing the entire account? Absolutely not.

NewJazz7• 5 months ago

Blackholing the a and cnames would prevent getting off the safe browsing list, as mentioned in the blog post.

NewJazz7• 5 months ago

Registry, not registrar

iamnothere3• 5 months ago

Thanks, yes, even worse! The registry should act on only legal orders IMHO.

TLDRisk• 5 months ago

It's the registry, not the registrar. I made a website that tries to help explain some of the lesser known nuances and risks relating to domains. The section about domain reclassification is based on first hand experience and is especially interesting IMO:

https://tldrisk.com/beyond-basics/reclassification/

This basically makes the entire TLD unviable for serious use.

It doesn't just make the TLD in question unusable. I think it makes most of the new gTLDs unusable. Registries can enact policies and systems like this, regardless of the detriment to registrants, due to a lack of oversight and registrant consideration by ICANN. That creates uncertainty and makes it pragmatic for registrants to simply choose the gTLDs with lots of history and precedence; .com, .org, etc..

The only two TLDs I'd personally rely on are .com (gTLD) and .ca (ccTLD).

eappleby2• 5 months ago

Unfortunate story. It wasn't clear to me that the .online TLD led to Google blacklisting the site. Why did you think that was connected?

NikolaNovak4• 5 months ago

My understanding from the article is that because the registrar for this domain is using Google safe browsing for their domain suspension, something that a) shouldn't be the case and b) isn't the case for other, perhaps more mainstream TLDs

eappleby2• 5 months ago

Right. Sounds more like a registrar problem than a TLD problem. They should change the article title to "Never buy a domain from Radix"

nguyenkien2• 5 months ago

The registrar suspense domain because it on Google blocked list. And Google refuse to review the ban because he can't prove he own that domain (because it suspended :D).

dathinab4• 5 months ago

The problem isn't Google Safe Search backlisting the side (I mean that also is a problem, but a very different one).

The problem is the vanity domain registrar Radix using that as a reason to _put the whole domain on hold, including all subdomains, email entries etc._

This means:

- no way to fix accidental wrong "safe search" blacklisting

- if it was your main domain no mails with all the things it entails

- no way to redirect API servers, apps etc. to a different domain. In general it's not just the website which it's down it's all app, APIs, or anything you had on that domain

Google Safe search is meant to help keep chrome users safe from phishing etc. it is fundamentally not designed to be a Authority Institute which can unilaterally dictate which domains are no longer usable at all.

Like basically what Radix did was a full domain take down of the kind you normally need a judge order for... cause by a safe browsing helper service misfiring. That is is RALLY bad, and they refuse to fix their mistake, too.

You normally don't have _that_ level of fundamentally broken internal processes absurdity with the more reputable TLD operators (which doesn't mean you don't have that in edge cases, but this isn't an edge case this is there standard policy).

Avamander5• 5 months ago

At the same time given the already terrible reputation of such vanity TLDs, being this hard on abuse might be the only survivable way.

That's not me saying there shouldn't be a warning and a recourse, but the time-to-profit for domain abuse is really short so anti-abuse actions have to be quick.

NikolaNovak4• 5 months ago

Oh man. The infinite loops of impossible verification by large companies that should know better are massive pain peeve of mine.

This goes right to the top for me, along the ubiquitous "please verify your account" emails with NO OPTION to click "that's NOT me, somebody misused my email". Either people who do this for a living have no clue how to do their job, or, depressingly more likely, their goals are just completely misaligned to mine as a consumer and it's all about "removing friction" (for them).

integralid• 5 months ago

No need to look for malicious intentions, this is just a feature that costs money so it's very low (or zero) priority for profit driven organisations.

I wonder if finding people responsible and spamming then with their own service emails would make the team care enough to fix this. But of course that's mostly dubious, probably illegal, and shouldn't be a responsibility of some vigilante hacker

loloquwowndueo• 5 months ago

With AI these days it’d cost almost zero money. /s

b1122• 5 months ago

If bartenders are legally (including criminally!) liable in some jurisdictions for their customers, then certainly a chain of legal liability can exist in other industries.

justinclift• 5 months ago

No need to look for malicious intentions, this is just a feature that costs money so it's very low (or zero) priority for profit driven organisations.

Malicious in-attention then, by the profit driven org? :)

wat10000• 5 months ago

What is the word for harming other people in order to make more money for yourself, if not "malicious"?

rationalist3• 5 months ago

Someone constantly adds my Gmail address as their Gmail account's backup address.

I constantly remove it whenever Gmail sends me the notification.

I can't help but think there is some method for the other person to steal my Gmail account if I never remove my email as their backup.

Romario77• 5 months ago

I logged in several times to other people's accounts and reset their passwords. But it's too tiring, people keep adding my email.

I hope it's because I have small simple email and not because they want to steal it.

tecleandor• 5 months ago

My Gmail account is a funny word in Spanish that I got when there was still plenty of names available.

I get TONS of emails of people trying to join services that use my address as a "fake email".

parable• 5 months ago

This happens to me several times a month. I'm more concerned about account termination, in that if their Gmail account is terminated for some reason, mine would be as well due to it being the backup email address.

ChrisMarshallNY• 5 months ago

I have an "OG" mac.com account (got it about five minutes after Steve announced it). My wife actually has her first name.

We both get hit with "OG Hell," where people are constantly entering our emails. I think most time, it is accidental (maybe they meant "XXX1234", and forgot the number).

What makes it worse, is that Apple aliases mac.com, icloud.com, and me.com together, and there's no way to turn off one of the aliases.

mac.com is really in retirement. No one sets up new ones, but the miscreants typo icloud.com, which gets routed to me.

I have a rule, where I shitcan every mail to icloud.com, but I wish I could simply turn off the forwarder.

pocksuppet13• 5 months ago

You could try stealing theirs. Surely, one of the forgot-password flows must use the recovery email.

plagiarist2• 5 months ago

I prefer "please verify your account" to "thanks for joining" by a lot. The former presumably does not verify when I ignore it. The latter should be illegal but somehow isn't.

I do wish there was a requirement for some sort of "no" button that would stop sending sign up requests entirely.

Aachen• 5 months ago

Any idea what the incentive is for them to put in an email address they can't access?

I run a few websites that accept an email address (all noncommercial, I have no interest in spamming anyone). One of them is the "contact me" feature on my personal website. To prevent spam, I had people just put in their email address and it'll automatically email them my email address. This works perfectly to this day, haven't got a single spam email on any of the addresses I've handed out, but the ratio of emails sent out to received is probably 50 to 1. Why would anyone put an email address in there if not to contact me? I've been wondering if it's used by mail bombing services, idk if that's a thing but I know of the concept of annoying someone by signing them up for a hundred newsletters. My site doesn't send recurring emails, though, and it doesn't allow putting more than two email addresses per month in, per /24 IPv4 block (and even more strict on v6). It's useless for mail bombing services but the (presumed) bots keep submitting a steady rate of maybe 2 new email addresses per day, each time from a new ISP in a random country. No email addresses is ever submitted twice. No rhyme or reason to it. If anyone can make sense of this, that might help me in stopping the abuse

prmoustache2• 5 months ago

The former presumably does not verify when I ignore it.

That doesn't prevent a huge majority of them from sending you notification emails all the time even if you never verify.

cucumber3732842• 5 months ago

The point of the system is what it does.

They can't just say "we don't want to deal with small timers who will not pay us big bucks doing nonstandard things" without pushback but they can write the policy so that a huge fraction of those use cases fall into some crack that can only be got out of by incurring the kind of expense that's a non-starter for those users. Your municipal code is rife with examples of this.

db48x3• 5 months ago

This is a catchy aphorism, but not really true. Things can be badly implemented so that they fail to achieve their purpose.

squeefers3• 5 months ago

Either people who do this for a living have no clue how to do their job,

how naive. most of the world work to survive, not because its their dream vocation. they probably dont care as much as you do

duped• 5 months ago

A chronic problem is the idea that if something can't be automated with a human in the loop then it simply can't be done at scale. Technologists will do anything except employ humans to solve social problems.

jagged-chisel• 5 months ago

s/technologists/venture capitalists/

Pxtl2• 5 months ago

Ah the old "reverse identity theft".

Relevant xkcd:

https://xkcd.com/1279/

Yeah, I get the same regularly.

thesuitonym2• 5 months ago

Smartly, I got firstnamemiddleinitiallastname@gmail.com. I never get anybody else' details.

On the other hand... Occasionally someone gets my info because some careless person entered my email address into their system incorrectly. You'd think this problem would be solved by moving to a custom domain, but I still once in a while find someone completely ignore what I put into the form and sign me up as firstnamelastname@gmail.com.

AtreidesTyrant• 5 months ago

happens with apple products all the time

MereInterest• 5 months ago

Oh man. The infinite loops of impossible verification by large companies that should know better are massive pain peeve of mine.

I got hit by this from google.

1. Gmail added requirement for 2FA on my primary email address. Since I had no phone number on file, it instead used my recovery email address. Thankfully, I still had the password for my recovery email address, and could continue to (2).

2. Gmail added requirement for 2FA on my recovery email address. Since I had no phone number on file, it instead used by recovery's recovery email address. Thankfully, I still had the password for my recovery's recovery email address, and could continue to (3).

3. SBC Communications no longer exists, as it merged with AT&T in 2005. Email addresses at `sbcglobal.net` were maintained up until around 2021-ish, when they started purging any mailboxes that had been idle for more than 12 months.

Fundamentally, this was google's fault for misusing a recovery email for 2FA. Unfortunately, the only way to fix it would be to contact AT&T, asking them to pretty please update the email settings for somebody who hadn't been a paying customer for two decades.

deepsun6• 5 months ago

Fundamentally, this was google's fault

Or yours, for not caring about 2FA. It's been a common practice for many years, and strongly recommended by most identity services, as well as OWASP and NIST recommendations.

What would you do in Google's place?

fencepost• 5 months ago

Google made it very clear years ago that they shouldn't be trusted with anything irreplaceable/that would cause major problems if you lost access.

Once it became clear that they'd shifted from "crappy customer service" to (IMNSHO) "we fetishize the complete absence of customer service" it became dangerous to depend on them. Really, what's the worst that could happen? Maybe someone spams emojis in live chat on a game livestream at the request of the streamer on a personal account, it gets banned for abuse, Google recognizes that it's linked to other services and locks down everything? But that's so unrealistic I'm sure it could never happen.

It's not like they also have the ability to identify links between multiple accounts accessed by the same person and have automated processes that might stomp the associated accounts as well. Why, that would probably require something like allowing poorly-understood automated agents to take actions on their own!

akoboldfrying4• 5 months ago

Fundamentally, this was google's fault for misusing a recovery email for 2FA.

While this would absolutely suck and I sympathise with anyone getting hit by this out of the blue, it's pretty clearly your fault, not Google's. What should they have done? Just permit everyone to avoid upgrading to 2FA indefinitely? That would result in relatively more account hacks overall, for which they would inevitably be roasted in the court of public opinion.

duxup2• 5 months ago

Oh man we had a person leave unexpectedly who controls our Apple organization for our dev accounts. I'm several months into me making requests, getting responses at least a week later for each email where the responder ... didn't really read my message. Then they ask for documents ... but they forgot to send me the secure link ... another week+ for them to do what they said they were going to do. Now one of my documents didn't include a sentence they needed ...

One of the requests was for a business card ... I haven't had a business card made with my name on it in 20 years.

The amazing thing is that I bet scammers working this system can get through this faster than I can.

At this point they should just give me control because no way would some scammer fail this much at this ungodly process.

praestigiare3• 5 months ago

Scammers can definitely get through it faster than you can. Whenever you attempt to address abuse in a system by increasing the complexity of that system, you implicitly bias it towards those with the time and inclination to study it, which always includes those with intent to abuse it, and generally does not include your users.

mxuribe• 5 months ago

I'm in a similar boat...and over the weeks where i have been sending the requested docs/files...Apple reps come back and state that one of docs i sent them was not valid...so i ask them to clarify their "definition" of the doc..and they just either reply with unhelpful comments, or delay a little and delay things further. When someone asks for a copy of a payslip and you send it...but then Apple says its not a payslip, i genuinely am sad about the overall state of the world...I dislike apple and all these big tech providers for their abusive control/power and at the same time vast layers and levels of incompetence. :-(

Arrowmaster• 5 months ago

I'm currently in the endless email loop because someone named Raymond used one of my Gmail names to register with State Farm. One of their agents even emails me directly when he gets really behind on his payments but won't do anything when I tell them it's the wrong email.

In the past when this happens I usually reset the password and change the email to some anon throwaway but I can't do that without Raymonds DOB (don't quote me on that, been a while since I tried).

smelendez• 5 months ago

This exact thing happened to me with a State Farm agent.

After a few months, I told them I was concerned about the privacy ramifications and would have to report it to their state insurance regulator, and it was very quickly fixed.

jacekm• 5 months ago

A couple of years ago someone associated my email with their bank account in Santander UK. I tried to get in touch with Santander but turned out that the only way to do so is to either make an international call (I don't live in UK) or send them a paper letter. I gave up and just routed these emails to separate folder.

subscribed• 5 months ago

I meticulously report every single of emails like this as spam. Every single one. If it _could_ be read as a phishing attempt, I report them as phishing.

Etc.

oooyay• 5 months ago

It's entirely on us as citizens to leaving them as pet peeves instead of crafting them into strategic law that makes them not only illegal but shunned. A little bit of structure goes a long way here.

derefr• 5 months ago

along the ubiquitous "please verify your account" emails with NO OPTION to click "that's NOT me, somebody misused my email"

What would you expect clicking that "wasn't me" link to do?

In 99% of cases, the user who signed up with your address already can't do any more with that account unless you positively confirm it was you; and the site also won't send you any more email because they don't consider the email verified (and so sending to it might result in their emails getting sent to spam -> their email-sending reputation score going down.) So things are already in the state you'd want them to be in, no?

The only problem I can think of with that state is that now you can't sign up "fresh" for an account with the same provider, because now there's already an account associated with your email address sitting there in their DB in the pending-email-verification state. (But you still can acquire that account, by clicking "forgot/reset password" and going through that flow, which will inevitably go through your email, as anything like a 2FA setup flow always waits behind email verification.)

vintermann2• 5 months ago

and the site also won't send you any more email because they don't consider the email verified

Netflix, for one, didn't do this. They kept allowing this guy to "resend his confirmation email" periodically over several months (I never had a Netflix account).

My theory is that it was an affiliate scam of some sort; someone probably got paid for everyone who signed up with his code. So he "signed up" thousands of random mails in the hope that some of them would click through on the "you're almost ready to start your Netflix journey!" mail and actually subscribe to Netflix.

BobbyTables2• 5 months ago

Once got one of those with a disclaimer that clicking any link was giving permission to subscribe me…

I believe they included the “unsubscribe” link too…

dangus• 5 months ago

I don’t know that the advice is solid in terms of never buying an alternate TLD.

swiftcoder4• 5 months ago

There are always the actual country TLDs, which (mostly) have specific regulations governing their use, and an actual government body to appeal to in case of unsolvable issues like this

drcongo• 5 months ago

Google have way too much power to mess people's lives up. Especially for an organisation with basically zero customer support.

shit_game• 5 months ago

Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.

I'm not particularly familiar with SEO or the massive black box that is Google Search - is this really as critical as the author makes it seem? I have both .lol and .party domains, both through porkbun (and the TLDs seem to be administrated by Uniregistry and Famous Four Media, respectively), and both are able to be found on Google Search. It seems like this preemtive blacklisting would be the result of some heuristics on Google's end; is .online just one of the "cursed" TLDs like .tk?

swiftcoder4• 5 months ago

is this really as critical as the author makes it seem?

It is critical in the sense that if you want to appeal the decision in a case like this, it will go much better if you pre-verified that you own the domain.

(I don't think it has much effect on google search placement at all)

kyle-rb• 5 months ago

Yeah I'm guessing the TLD was the main signal, based on other comments linking to a thread about "Pinggy", who was also using a .online. The fact that Namecheap is giving them out for free means they probably are more scammy on average.

I've also never added domains to Google Search Console and haven't had blacklisting issue other than with a free .ml (another "cursed" TLD) site that was by default assumed to be spam by Facebook Messenger.

It's unfortunate that this category exists, but I don't share the OP's .com purism; I've used a mix of TLDs and even the cheap ones like .fyi and .cc haven't come under extra scrutiny as far as I can tell.

ranger_danger3• 5 months ago

One time I bought a .dev domain, which is/was run by Google, and after missing the renewal deadline by less than 24 hours, the renewal price jumped from less than $30, to $800.

Imustaskforhelp7• 5 months ago

Is this even legal?

ranger_danger3• 5 months ago

No idea, but it would cost me more to fight it than it's worth. And other people have reported similar issues but people refused to believe them, so I doubt I would get much sympathy.

blenderob• 5 months ago

Why was the domain blacklisted though? What can we do to prevent blacklisting in the first place?

nguyenkien2• 5 months ago

From false alarm to something previous owner did. Remember domain is recycled.

ssiddharth8• 5 months ago

The domain has no history as far as I could search and the site was up for almost 6 weeks with no issues before it was nuked. I used it with Apple's review process!

xp84• 5 months ago

Most definitely nothing, as no sentient humans are probably involved in the process except possibly malicious people that report a site in bad faith.

otterley32• 5 months ago

That’s my question. I’ve launched many fresh websites that have not been marked as unsafe by Google. If they were habitually doing this, there would be far more reports of it.

I suspect there is something the author is not telling us.

bilkow• 5 months ago

Even if the false-positive rate is very small (e.g. 0.01%), you probably won't be affected, but more than a hundred thousand of websites would be and that would still be an issue. I have no idea how big is the false-positive rate.

There are many of reports of the same happening to other sites, some of the top ones (you can find many more by searching HN for "google safe browsing"):

- https://news.ycombinator.com/item?id=33526893

- https://news.ycombinator.com/item?id=25802366

- https://news.ycombinator.com/item?id=45675015

ssiddharth8• 5 months ago

The site is already back online after the post. You can check yourself. If I really did have malicious content on the site, this post would have had zero effect on the result.

kccqzy2• 5 months ago

The big scary red warning page should at least tell you it’s phishing or malware or something else. OP didn’t have a screenshot of that. You can easily go to a safe browsing test site yourself at testsafebrowsing.appspot.com and find that Google does divulge the category of the blacklisting.

OP says:

no gore or violence or anything of that sort

That’s not even the right criteria. OP is confused about Google Safe Browsing vs Safe Search.

ssiddharth8• 5 months ago

I just wanted to cover all the bases. The site has one outgoing link to the App Store and 3 screenshots.

voidUpdate• 5 months ago

If the domain is being given away for free, it will be used a lot for scams etc, so a lot of systems will just start blocking it immediately. When I got my first domain, I used one of the free TLDs and my university blocked it completely due to it being a scam. Not for any of the content on it, just the TLD being commonly used by scammers

zadikian3• 5 months ago

Probably cause of things like "southwest.online"

ghoshbishakh• 5 months ago

We posted this warning on HN before: https://news.ycombinator.com/item?id=40195410

We struggled a lot when we opted for the .online domain for https://pinggy.io urls

basilikum2• 5 months ago

This sounds like something ICANN should prevent. Is this not against ICANN rules? These fuckers ban emoji domains, maybe they should ban registries from arbitrarily stealing domains with no recourse. Maybe write to them and see if they can move something.

cmsp12• 5 months ago

honestly all of these weird tld are expensive in the long term i dont see the point of getting them

twapi• 5 months ago

OP shouldn't blame .online registry operator Radix.

post-it• 5 months ago

It's literally 100% Radix's fault?

hobs• 5 months ago

Because? It seems like the blame is very squarely on their shoulders.

__MatrixMan__• 5 months ago

We need to rethink the web so that fewer third parties are involved in things that seem on the surface to be an A-B conversation. To say nothing of the trustworthiness of those parties, having them involved at all is needlessly brittle.

account426• 5 months ago

Update: Within 40 minutes of posting this on HN, the site has been removed from Google's Safe Search blacklist. Thank you, unknown Google hero! I've emailed Radix to remove the darn serverHold.

I wouldn't party too soon - from my experience getting something removed from Google's libel machine doesn't mean the same process that put it there in the first place is fixed and it you will most likely go through the same thing again and again.

Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.

This is just another way how Google has inserted themselves as the gatekeeper of the web.

elAhmo• 5 months ago

Another case of Google extorting users and showing mafia-like behaviour.

siliconunit• 5 months ago

tried to roll my own email server on a .xyz domain...basically a big no go, couple of emails went through, then nothing, just a black hole. Thanks corpos and the safety theatre.

bombcar2• 5 months ago

Call me a luddite but if it isn't one of the original big TLDs, a country TLD, or similar, I just don't trust it for anything serious.

Imustaskforhelp7• 5 months ago

I believe that .de domains are pretty cool (written another comment about it) but .de are $3.25 for registration and .de is the second most common after .com so from webatla, I see approx 16 million domains.

I don't think that they could ban emails from .de for what its worth.

Personally I like .in domains too. Makes more sense to me because I am well Indian and we all use it quite frequently/sort of intutitively know fwiw but if I just want a domain for email purposes for cheap. Honestly, .de could be good.

https://tld-list.com/ [Try seeing the cheapest renewal rate with top level TLD and ignore .storage which costs 465$ for registration smh]

Some other domains like .top exist as well in this league imo but .de is one of the best if you can find a relevant domain in .de

jabroni_salad• 5 months ago

In Defender for Exchange (or whatever they call the filter in exchange online these days), there is a checkbox that blocks .xyz and .biz as a bundle. Why those two? dunno, but microsoft especially hates them.

hyperionultra• 5 months ago

Having .online already 5 years. No problems with email or website. Don’t understand that blog post. More problems can be with .xyz

pverheggen• 5 months ago

I wonder if Radix has unknowingly created a negative feedback loop here. From Google's perspective, the DNS records disappear shortly after being flagged by Safe Browsing, which their heuristics may interpret as scammy behavior.

_el1s7• 5 months ago

This is one of the pains of centralization. And honestly, it could happen with any TLD.

zadikian3• 5 months ago

But was this because it's .online? I got one and it was fine.

The only issue was the usual trap with all Namecheap domains: They tell you it's all set, and it works, until they randomly email you a week later asking for email verification. If you don't do that promptly, they suspend your domain until you trigger a resend. Which is easy to fix but also strange.

NewJazz7• 5 months ago

The blog post details that the TLD registry, Radix, decided that getting put on Google's safe browsing list means they put a serverhold on your domain, which prevents you from getting off the safe browsing list.

So yes, this appears to be a TLD- (or at least registry-) specific issue.

zadikian3• 5 months ago

Oh, I did read but didn't understand that Radix was the TLD owner. Makes sense.

icase• 5 months ago

“never buy a non-.(com|net|org) domain”

ftfy

bombcar2• 5 months ago

I agree, but if I ever get a chance at .edu, .mil, or .gov I'm gonna take it.

quesera• 5 months ago

There are still some fun domains grandfathered into the .edu hierarchy, from back in the day when registration criteria was not-so-strict.

.mil and .gov have always been too strict for ordinary folks though.

petterroea• 5 months ago

Side note: My empirical experience is that vanity domains are disliked by some enterprise security systems. I have a friend who owns a .homes domain which ended up being blocked by quad9 as well as the enterprise security system of a friend's work for ~half a year. The block cleared by itself.

I had the same experience while buying another TLD. For ~1 month, certain people whose ISP "helpfully" had "safe browsing" features, simply blocked us outright. For being new and different.

The learning for me was that new domains are no longer trusted, and seemingly some vanity domains get even more strict treatment.

roger1103• 5 months ago

Because the entire security mechanism of the www today is "look at the domain name to make sure it matches." And the TLD is at the end where people might miss it.

mavamaarten• 5 months ago

Even (uncommon) country TLD's too. I own a .vg domain which is a perfect match with the initials of my last name. My mails end up in spam quite often too, despite having set up SPF, DKIM, DMARC and all that stuff correctly. It's just not common so some security systems block it.

Avamander5• 5 months ago

It's not just about being common, it's also about the share of abuse coming from such domains.

mghackerlady2• 5 months ago

Fortinet blocks new domains by default so I can never check out cool new projects on the front page when I'm procrastinating nowadays :(

snailmailman• 5 months ago

This does unfortunately actually work pretty well as a security measure. The new domains that are cheap and good for fun side projects, are also cheap for scammers.

For a while I noticed all the scam links my grandmother was getting were from ‘.top’ domains. I fully blocked it at the DNS level. Her DNS settings also block all newly registered sites for 90 days. She hasn’t ever had issues with it. But these have actively prevented her from clicking on scam links multiple times.

Facebook, google, and all the popular sites are all older than 90 days, on popular well known TLDs. My grandmother doesn’t seek out new trendy sites.

It was definitely something I considered when buying a new domain. I sorted by price, and then immediately ignored all the cheapest domains that were ~$1 because I’ve seen them being used for scams. They may be cheap but good luck using them.

MattSayar• 5 months ago

Took me a minute to realize Sid isn't associated with 0xide.computer. Clever domain name!

Getting Google to index my personal site has been a pain. Every other search engine works fine, but ever since I switched the images on my site to .webp (a format created by Google!), my site's content just doesn't get indexed anymore. I've given up since web search traffic matters less and less these days with LLMs, and it only really bothers me when I'm trying to search for my own articles.

ssiddharth8• 5 months ago

Ha, thank you. I spent more time than I'm willing to admit to come up with it.

I use my older, much longer domain for email and identity (it used to be #3 on SERP for "Sid"). This one is just for giggles so I can blog in peace without affecting the main one.

OutOfHere3• 5 months ago

The logic doesn't automatically extend to other TLDs unless they too are owned by the same firm. Alternative TLDs are often preferable because they're so much cheaper than wasting money on a .com, etc.

Macha5• 5 months ago

Most alternative tlds are more expensive than .com after first year teaser rates expire though

Imustaskforhelp7• 5 months ago

https://tld-list.com/ Try looking at this website with cheapest renewal rate and removing second country TLD (so only Top level)

In my opinion, .de , .ovh , .uk or personally my country's .in (yes OVH has their own TLD that you can use)

.de is one of the more interesting domains to me personally even though I am not german.

OutOfHere3• 5 months ago

There are various gTLD that are cheaper. For example, .top is great and among the cheapest. It however is falsely maligned by those with small brains who stereotype things.

squeefers3• 5 months ago

sorry but you cant have a domain if google ban it? how does this work?

dzonga• 5 months ago

why not just buy a .co.xx (country) or simply .com / .net

and if hectic maybe .io

trey-jones• 5 months ago

I'm sorry that the author got bitten by this. But .com purism is funny to me. I only buy GTLDs for personal projects, and I've never had a problem before. But then, I've never bought .online.

metalliqaz• 5 months ago

Top of HN. Well, I guess you could say that Radix's strategy to give away domains backfired spectacularly.

fortran77• 5 months ago

Never use a “free” domain is a better rule. Even if there were no technical or administrative issues, nobody trusts them.

kkl• 5 months ago

I could also buy that the free domains were ran up by scammers which could have caused some of the hair trigger Safe Browsing denylisting.

iryndin• 5 months ago

A list of all registered (3,231,464 domain so far) .online domains is here: https://allzonefiles.io/zone/online

bjt• 5 months ago

It's not about the .online TLD being "weird". The problem is that it was free. That's going to attract a swarm of fraudsters, spammers, etc, and then turn into a strong "this is probably fraud" signal in all kinds of fraud scoring systems.

There are lots of domains out there other than .com that are just fine.

garganzol• 5 months ago

Probably this is what's happened here. Either the OP's domain was previously used for shady activities, or the almost-free stigma puts the whole .TLD in the grey list of high-risk assets. Probably is also explains the nuclear behavior of the registrar (suspension).

Free is good, but sometimes it's not.

fckgw• 5 months ago

.online, .top, .xyz. info and .shop are some of the top TLDs that scammers use, precisely because of their rock bottom registrar fees that make them attractive for sites that have a shelf life of a few hours or a few days before being blocked. As a result, many places have a blanket "suspicious" flag for fresh domains under these TLDs.

If you plan on building a legit site, do not use any of these cheap TLDs.

al_borland• 5 months ago

Paying through the nose for a .com that is remotely memorable and easy to spell is not a great path forward for a hobbyist or someone who simply wants their own domain for email.

I know someone with a .org domain, and even they have a ton of issues with false flags on their emails due to not coming from a big email provider. They’ve been blacklisted a couple times and regularly get flagged as spam. I’m surprised he hasn’t given up after dealing with this stuff for 25 years.

These new TLDs, I thought, were supposed to open up more options for regular people to get a domain that is semi-decent. Instead they’re essentially useless. Some of the prices are also still insane, due to assumed “premium” status or domain squatters.

There has to be a better way to police this stuff.

mixmastamyk2• 5 months ago

Try finding a pithy domain these for under 10,000 these days. I tried a week ago and had to settle for something a lot longer than I wanted and even then it was something from outside the common three letter TLDs.

peanut-walrus• 5 months ago

It sucks so much that there is no standard way of linking additional domains to your main one and inheriting the reputation.

Want to set up a new domain for whatever purposes (conference, new product, etc)? Be prepared to spend the first half a year fighting the various blacklists before people can actually reliably connect.

Would make so much sense if you could just have a .well-known/other-domains.txt (or something something DNS) with a list of domain names that should be considered just as trustworthy as your main domain.

It's not even about .online or other weird TLDs, it's just that the domain is new and therefore "not trustworthy". Even worse if you need to use your existing branding on the new domain - instantly flagged as a phishing site everywhere.

thayne2• 5 months ago

Google should really be seeing some anti-trust action for requiring you to create an account with them on their search console in order to contest being added to a blacklist used by all the major browsers.

bhartzer• 5 months ago

Are you 100 percent certain that the domain name wasn't registered before and then got on the blacklist because of prior misuse?

It's quite possible that the domain you chose was registered previously and dropped because the previous owner misused it and burned that domain. The .ONLINE extension has been around for several years now.

NewJazz7• 5 months ago

I feel like google should be sophisticated enough to tell when a domain has expired and gone up for auction/resale?

ssiddharth8• 5 months ago

I can't be 100% sure but googling showed nothing. My site was up for almost 6 weeks with no issues. I used the domain for Apple's review process too. No issues at all.

Habgdnv• 5 months ago

I am 100 percent certain that one of my domains i registered before and now I am still looking for lawyer to help me sue my government for blocking my domain for something I never commit and refusing to remove the block - just be cause they can. short .com domain! I even paid it for 2 years because I was willing to commit.

lasgawe• 5 months ago

also I don't recommend using a .xyz domain for email sending. These domains are often marked as spam, and some email providers don’t support them.

bradgessler• 5 months ago

I got og.plus that expands to OpenGraphPlus.com.

At first I was stoked to have a two letter domain, but then I looked into it and learned these companies will get you hooked with a low initial price, then jack up the prices as the domain becomes established.

Quite the grift. My plan is to tread lightly on that domain and be ready to back away from it when the rent seekers move in.

You’d think there would be some sort of rules to the neutrality of these TLD administrators, but nope.

The second time around I wised up and go ogplus.net for an API domain instead of ogplus.media. I’ll take neutrality over vanity any day.

AndyMcConachie• 5 months ago

https://www.icann.org/compliance/complaint

defraudbah• 5 months ago

never buy anything than com domain

especially country level domains, they are not regulated and your register can ignore whatever requirements they have to fullfil

ksdme9• 5 months ago

On a side note, thanks for wisp. I was looking for something like it so I could use it to quickly test the web builds of my tauri mobile app.

ssiddharth8• 5 months ago

Oh wow, I didn’t even think of this use case. Could I please get in touch for a bit more info?

jarek83• 5 months ago

So this happened only because google is so big, that it can point to any website and say that it's not safe. Even if owner of a site just don't want to be in their search engine in the first place.

How on earth we ended up with this company bother anyone including those that want their services? Imagine that you could get your driving license banned because you did not buy a toyota...

nelsonic• 5 months ago

The first mistake anyone makes is thinking they are “buying” anything with a domain. You’re renting it. And the company you are renting from can arbitrarily push up the price above inflation. NameCheap is good for the basics. But a .site or .online domain is a no-go beyond an MVP/test.

deepsun6• 5 months ago

So Google can single-handedly break any domain? Sounds like total control of the Web.

tamimio2• 5 months ago

.com is definitely the gold standard, I got an .io more than a decade ago and if I would go back in time, I would just use .com, the pricing for .io been increasing for no apparent reason.

giobox• 5 months ago

People often make the mistake of treating .io like a gTLD, when it's actually a ccTLD for the "British Indian Ocean Territory" etc. ccTLDs have always had risks, especially when they are for a really tiny region.

Similar issues to .io happened with the popularity of .tv domains, which again is a ccTLD. The government of Tuvalu sought to increase income from sales of their ccTLD and prices went up. Tuvalu is such a small nation .tv domain sales ended up making a significant part of the State's income.

Another fun example of the mess you can get into with ccTLDs was when the UK left the EU. All UK registered .eu domain names were cancelled following the UK exit from the bloc.

gTLDs generally have some degree of insulation from State-level politics. ccTLDs permit the nation or territory they represent much more say in how they are priced and who they are sold to.

tamimio2• 5 months ago

Interesting, thanks for the info, definitely didn’t know that back in ~2012, but lessons learned, only .com or .org I have been buying in the past years.

agentifysh2• 5 months ago

Does anybody know any good alternative to Name Cheap? It seems like they keep raising prices on all the domains. Website is very sluggish, especially for finding domains quickly.

mdhen• 5 months ago

cloudflare is the cheapest - they do it at cost.

agentifysh2• 5 months ago

Wow, thanks. You were right. I Googled and it says Cloudflare is cheaper by twenty-five to fifty percent on renewals. I'm really sick of namecheap. They seem to never stop raising prices. but I'm also I'm kinda wary and afraid of moving domains and losing it.

themafia• 5 months ago

The AWS registrar is actually not bad.

s_dev• 5 months ago

I've heard good things about https://www.inwx.com/ I'm contemplating moving my domains from namecheap to there as they have a reputation for supporting lots of exotic domains which will make migrating easier.

Lots of good stuff in this thread I was not aware of. I have a few vanity domains with personal projects so it's not a big deal if they have low SEO but good to know going forward that I should be prioritising country domains like the Irish .ie one instead of 'fun' looking domains that are memorable.

shaky-carrousel• 5 months ago

Morale of the story: never ever use a registry that bases its decisions on Google Safe Browsing. Radix in this case. A very modern looking website for a really caveman support.

pocksuppet13• 5 months ago

There's no way to know this until it happens to you or someone else.

atleastoptimal• 5 months ago

Domains are signaling. If you have a .online domain you are signaling you can't afford the equivalent .com domain. All the TLD annoyance is a consequence of the lack of status pressure ameliorating the experience of those domain holders (in the same way you never see public health crises in rich neighborhoods)

NewJazz7• 5 months ago

If you have a .online domain you are signaling you can't afford the equivalent .com domain.

Or don't want to pay a $2k ransom to a name squatter... For some businesses that is a rounding error (saas, other high volume high margin stuff), but for small businesses like restaurants or event planners, spending that much on a domain name would be foolish.

greatgib2• 5 months ago

Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.

That should be enough to trigger an antitrust case against Google and a split of its activities. When despite unrelated, it becomes the gatekeeper of your presence in internet.

halapro• 5 months ago

A registrar using Google's signal to deactivate your service isn't Google's fault.

Safe Browsing itself has an appeal process so I think legally they're covered. Users and governments surely appreciate someone filtering bad actors online, even if casualties don't.

greatgib2• 5 months ago

It is the moment like that where it looks obvious for third parties to use it and only it to vet customers. To the point where you are forced to deal with Google because parties "can't do anything about it".

The moment that 80%+ users go to internet through their browser but at the same time control which we site can be accessed with their safe list.

The moment that you need to create an account and start using their services and accept their terms and conditions to be removed from wrongfully added "list" impacting someone.

mustaphah• 5 months ago

Worth noting: emails from .online domain (and many other TLDs [1]) are also way more likely to end up in the spam folder.

https://www.spamhaus.org/reputation-statistics/gtlds/malware...

anonzzzies• 5 months ago

So never buy tlds managed by Radix then ; what a crazy thing to kill domains that are blacklisted by Google AI...

chrishacken• 5 months ago

Google loves doing stuff like this. At my last company, before we sold it, I had to reverify our Google Business page about once a week because it would constantly just remove the verification for seemingly no reason.

trklausss• 5 months ago

Does anyone know which platform this webpage uses? I like the aesthetics and functionality :)

sbinnee• 5 months ago

The product[1] looks super cool! I can immediately think of my use case, though not for gamin. I am using LibreChat to call LLMs, installed on my home server. But when I open a webtab, it has all these browser tabs I don't want to see. I am sure there are many cases where this product can shine.

[1] https://getwisp.online/

miki123211• 5 months ago

This story (and many others like it) just goes to show that systems that rely on domains in any way can't be called decentralized.

Email isn't decentralized. Mastodon isn't decentralized. Matrix isn't decentralized. XMPP isn't decentralized. The web certainly isn't either.

All of them can be killed by Safe browsing. All of them can be killed by ICAN (which is under significant influence from the US government). All of them can be killed by their domain registrar and registry operator. All of them can be killed by Let's Encrypt adding their certificates to a CRL, and refusing to issue new ones. All of these will eventually be weaponized, when the war over who controls information truly begins.

eviks2• 5 months ago

All of them can be killed
Anyone can be killed, my Lord!

So nothing is decentralized?

mixmastamyk2• 5 months ago

Was just thinking that our workstations should save DNS lookups for our most used domains over time.

Galanwe• 5 months ago

ICANN really is a shame. There is no oversight, no enforcement, no sense of duty of what being the custodian of internet naming system entails.

Animats• 5 months ago

My only adventure with off-brand TLDs has been "aether.ltd". This was for my steampunk telegraph office, "The Aetheric Message Machine Company", an elaborate setup we ran at steampunk conventions from 2011 through 2019.[1] Text in a message, and it's banged out on a restored Teletype machine from the 1930s in a brass and glass case, then delivered by a costumed messenger.[1] This got some press coverage back when steampunk was a thing.

Somehow, Zoominfo picked up the site, and rated The Aetheric Message Machine Company as having revenue of about $5 million a year and, at peak, 24 employees. We had a back story for roleplay purposes, in the operating manual for the cosplayers.[2] Someone apparently took it seriously.

That was a fun project.

[1] https://vimeo.com/124065314

[2] https://aetherltd.com/public/othermanuals/operatormanual05.p...

nazgulsenpai• 5 months ago

Idk, I'd still roll the dice for $0.20 TBH

avipars2• 5 months ago

Malwarebytes automatically blacklisted any .xyz sites, and I had to file for an exception for a domain I bought... I feel your pain

RadixRegistry• 5 months ago

Hi Sid,

We understand how frustrating it can be when a domain stops resolving unexpectedly. We’ve sent you an email with more details on what happened and the steps taken so far. We’re also reviewing this internally to understand why the domain was flagged and how we can reduce friction in similar cases going forward. We’re happy to continue the conversation over email and share any additional context if helpful.

Thank you.

SergeAx• 5 months ago

The culprit here is the TLD operator. Why on Earth would they suspend a domain because of some private web browsing blocklist? FWIW, the client may not even bother with the web browsing; there are hundreds of other things we use DNS for.

Alas, the .tech domain is quite popular.

Never buy a .online domain

Related Stories