/home/yhvr/blog/punto2012/

Who Took Down My Furry Fanfic?


Sorry, that was a bad title. Let me add some context.

On July 11th, I purchased the domain “goat.rest” without knowing what I wanted to do with it. I thought it’d be cool to own a domain that had a second-level domain of just “goat”, and I knew that there was only so many that exist. I liked sleeping, and it was pretty cheap for the first year, so why not? I snagged the domain, and shortly afterwards, an idea came to mind.

Nine days later, I publicly released https://goat.rest/. It’s a wholesome, thought-provoking, unapologetically furry, semi-autobiographical interactive story where you talked to an anthropomorphic goat as you stared at the stars together. I enjoyed my time writing it, and the people I shared it with gave pretty positive feedback. For an unexpected deviation from my normal content that I hastily threw together in just nine days, things were going pretty well! Until they weren’t.

On the 28th, someone pinged me to inform me that the site wasn’t loading for them. It was odd, I thought to myself, since I hadn’t changed anything about my setup since the release of goat.rest. I tried to log in to the server, and it seemed just fine. The nginx configuration file for goat.rest was still there. I was thoroughly confused, and I thought to myself “there’s no way it’s DNS, right?” So I logged into my Cloudflare account to look at the DNS records, and I could confirm that the only record present was still in place.

Next, I logged into my Namecheap account, which greeted me with this lovely message:

A screenshot of the entry for "goat.rest" in my Namecheap dashboard. Below the domain name, it reads "Suspended by the Registry, please contact legalandabuse@namecheap.com"

…Did Namecheap just take down my fucking domain? DO THEY HATE FURRIES?! WHAT is wrong with my site???

It seemed plausible. Two other domains I owned were set to expire that day, and there was a strange billing situation with my account a few weeks prior that I won’t get into here. They might think they have some sort of reason to believe my account was acting out of the ordinary. But it didn’t make sense to me—if they wanted to suspend me, why my little side project, and not galaxy.click or yhvr.me?

Despite it being a Saturday, I reached out to the email that was provided. I had no idea what their response was going to be, or if me responding would trigger some sort of investigation into my account that would cause all my domains to be suspended. In an act of terror, I moved over yhvr.me to Porkbun who, despite being slightly more expensive, seem like a really good registrar. They don’t take themselves too seriously, and their site made chuckle a few times, which sold me on them pretty quickly. While I won’t be moving my other domains over, I think I’ll stick with them for yhvr.me for now.

I heard back from Namecheap about an hour later.

Please be informed that the domain name was placed on Hold by the Registry, which is the highest level upstream provider for each Registrar. As a Registrar, we are not authorized to remove this restriction.

Ohhh, shit. That’s embarrassing for me. Well, today I learned there’s a difference between the two.

Unfortunately, the issue cannot be resolved from our end, as this part is entirely controlled by the Registry, not Registrar as Namecheap. We recommend you contacting them directly as they normally process such kinds of issues with the Registrant’s (Your) involvement. You can reach out to them via email redacted. If any assistance based on the conversations is needed from our side, let us know.

I feel kind of embarrassed for thinking Namecheap was out to get me now. Oh well.

From the email, I learned that the Registry of the .rest TLD was called Punto 2012. I reached out to them through the email provided, but wasn’t expecting a response for a while, since it was a Saturday. So I waited.

Monday passed, no response.

Tuesday passed, no respon- wait what the site is back

goat.rest was reinstated on Tuesday, July 30, the same day this article was published.

Don’t get me wrong, I’m really, really, really glad it’s back! But the whole situation has left me with some serious concerns.

During my research, I found this Webmasters StackExchange Post about someone who was in the same predicament I was, but with a different Registry. Though, in my case, I didn’t see any indication of “potential abuse” in a WHOIS lookup. Just that the domain was on serverHold.

In the post, KIKO Software shares a response they received from the Registry in an update:

The domain name cdn4.website was suspended based on or proactive analysis where similar pattern domains were reported and suspended for abuse. However, based on your update we have unsuspended it and disabled the ServerHold. Please ensure that the domain name is safe and secured to avoid any sort of abuse instances in the future. Thank you.

Wait, proactive analysis? Are they automatically taking down domains now? This worries me quite a bit. Since I’ve received absolutely zero communication from Punto 2012, I’m left to theorize about what has happened here. But my best guess is something similar to the story I’ve shared here.

I understand why Registries are able to take down domains. It makes sense, and I’m fine with that. What makes me squirm is the thought of having it happen automatically. I hadn’t generated a lot of publicity around goat.rest, but if I had, I’d be totally fucked. This can have real-world downsides, such as in the story above, “many thousands of euros in costs and lost revenue.”

Is this really a good idea?

Should Registries be allowed to do this?

an important update

(added 2 hours after initial publication.)

After publishing this blog post, though probably not as a result of it, I heard back from Punto 2012. Based on Cloudflare’s analytics of goat.rest, this was sent roughly 4 hours after the block was lifted. This is their full response:

Hi Yhvr,

The hold has been reversed and the domain should work again. Please let us know if you have any additional issues.

Thanks, The PUNTO 2012 Safety Team

I… thanks, I guess.

This experience has left a sour taste in my mouth. If anyone else has found themselves in a similar predicament, with any Registry, please reach out to me. I really have no indicator of how common this is, and I’d love to know if I’m just super unlucky or if many people have had to deal with this.