Nameservers Changed Issues on Sav.com

[xmarthost]

My nameservers for all domains have been changed to ns1.all-harmless.domains and ns2.all-harmless.domains, and I am unable to change the DNS again. What could be the issue?

Also, a friend of mine is facing the same problem with over 600 domains. What's going on with sav.com?

 

[Future Sensors]

I would also like to hear from CleanDNS General Counsel Mr. Alan Woods his thoughts on CleanDNS COO handling sensitive Sav.com abuse tickets via non-private DMs on this external NamePros forum without there being a client relation with CleanDNS — as discussed earlier in this thread, with all the context provided at that time.

Compliant? Not compliant?

Has this initiative been discussed with you in advance?

Be as detailed as possible about privacy and security, covering the jurisdictions that matter, and with reference to all contractual and legal sources that you deem relevant.

 

[alcy]

Thanks @Nick R.

It's good to see you active again here on the forum, with the intention of getting the situation at Sav back on track.

Be sure to also check out the other things written in this thread.

You don't have to comment on every single post, but it would be nice if it appears that Sav has learned some lessons and can convincingly indicate how things will improve in the future on key elements as discussed in this thread.

Cheers.

how do u know its nick? in fact I've often seen posts from this account employ word ... we..... just saying

 

[Future Sensors]

how do u know its nick? in fact I've often seen posts from this account employ word ... we..... just saying

Let us be honest with you.

It's indeed just a nick for us, but quite a Savvy nick by now.

 

[alcy]

Let us be honest with you.

It's indeed just a nick for us, but quite a Savvy nick by now.

ah ok lol

nickrus it is then

 

[zotix]

I would also like to hear from CleanDNS General Counsel Mr. Alan Woods his thoughts on CleanDNS COO handling sensitive Sav.com abuse tickets via non-private DMs on this external NamePros forum without there being a client relation with CleanDNS

Thanks! That’s one point. Sure, they are allowed to, same goes with for example debt collection agency’s. But definitely not via DM on a forum. So in theory I could make a new account, pick a domain which is affected (out of this thread, which was posted), write them via DM and they either provide data (what they holefully not do, or give false information to their team regarding this specific user. How can they even legitimate him? Imagine, a company acting against abuse, offers support via DM, without knowing his real identity- at least for GDPR that’s something that is 100% „abuse“. It’s not even allowed here to sent sensitive documents to third party’s. Even if I tell them to do so, did full legitimation on phone. Data protection. Had this a few weeks ago.

Well and this job description:

Quoting two requirements:

• Excellent written and verbal communication skills, with the ability to create compelling content and deliver engaging presentations.
• Creative mindset with the ability to think outside the box and generate innovative marketing ideas.

The new marketing specialist be like: Hey, boss I have an excellent idea let’s just adjust our detection system a bit to prove that we are capable to find the real fraudulent domains!
Boss: Why?
Marketing specialist: We have so many data, SAV opted in, there is bunch of data we can make use of it since we are processor and operator. That will be amazing findings

….
A few days later, 600k accounts domains banned
Marketing post released
Boss: That’s my boy

Mustafa

 

[Nick R]

Good Morning All,

I want to cover a few things in this post:

Sav & CleanDNS
Sav and many other domain-related companies work with @CleanDNS to help prevent abuse on the Internet. The data available to any single registrar or registry is very limited to just our domains which means malicious actors can just jump from one place to another after getting caught and start the abuse over again. @CleanDNS can bring its holistic view and expertise and more easily detect the same malicious actor as they move around the internet and, help prevent innocent users from being victimized much faster than if any one registrar or registry was working alone. Since Sav does not currently provide hosting and our DNS is powered by Cloudflare, data used to verify abuse complaints all comes from sources external to Sav. The only data shared between Sav and Clean DNS is basic registrant data and links between domains and registrants. You can review our data privacy policy which includes EU and Business Function Outsourcing provisions here: https://www.sav.com/terms/privacy


Our Obligation to Prevent Abuse
Every registrar is required by ICANN to investigate abuse complaints and take action per section 3.18 of our ICANN Registrar agreement (https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en) Earlier this year, ICANN expanded our obligations to define abuse and the actions that we must take (https://www.icann.org/resources/pages/advisory-compliance-dns-abuse-obligations-raa-ra-2024-02-05-en). If anyone is interested in some light reading, see the "Section 3.18 of the RAA" and "After Actionable Evidence, Prompt Action Is Required" sections specifically.

Sav & CleanDNS does not and, will not shut down an entire account for a single abuse complaint. A single spam complaint from a big-name blocklist is not weighted. However, a spam complaint compounded by multiple related abuse are. The accounts we shut down are filled with numerous verified complaints of spreading malware, phishing, pharming, and botnets. When we start to see this, we also reach out to the registrant multiple times to help them correct the issue in the case of a compromised domain. However, registrants do not usually respond or will correct the issue on one domain and start the abuse on another domain days later.

While these registrant conversations are usually private, when we have registrants posting in NamePros that their account was shut down for no reason, we are going to respond publicly both to eliminate misinformation and alert other NP users of someone that they may want to be cautious of. You can see an example of that here https://www.namepros.com/threads/nameservers-changed-issues-on-sav-com.1331172/page-16#post-9224990

Since this post was flagged for moderation before being published, I think most users missed it.

Our Future Participation in NamePros
We are happy to participate in threads that have a clear focus on a Sav-related issue and stay on topic. However, should they be disrespectful, speculative or go wildly off track (like into a company's job postings), will pause our participation and refer people to our very-capable 24/7 support team. That was the case in the past but we are happy to try again. We are not always able to keep up with a forum thread that has 30 posts a day so should we have missed anything specific, and I’m sure we did, please DM me or @CleanDNS directly.

Bug Bounty Program
Members of NamePros have been an amazing source of bug reports in the past and will continue to be so in the future. Some of our top customers are also NamePros users and know our site better than we do at times. Should you encounter a bug that is a security P1 – P3 risk, Sav would love to offer you a reward for reporting it to us. Please follow the details of the program exactly or we may not receive your report (for example, if the subject is not in the correct format). You can view the details here: https://help.sav.com/hc/en-us/articles/26129438833819-Bug-Bounty-Program


Our Communication Policy Moving Forward
I would like to personally apologize for our lack of communication with registrants who were suspended. While we all want the Internet to be as safe as possible, we should have given multiple warnings to registrants that we are about to move from a domain-level suspension to an account-level if the abuse continues. We do stand by or decision, but could have gone about it better. We appreciate everyone’s feedback and are working on new communication policies as we speak.

 

[bmugford]

Sav & CleanDNS does not and, will not shut down an entire account for a single abuse complaint. A single spam complaint from a big-name blocklist is not weighted. However, a spam complaint compounded by multiple related abuse are. The accounts we shut down are filled with numerous verified complaints of spreading malware, phishing, pharming, and botnets. When we start to see this, we also reach out to the registrant multiple times to help them correct the issue in the case of a compromised domain. However, registrants do not usually respond or will correct the issue on one domain and start the abuse on another domain days later.

Your justification of locking entire accounts is based on the "trust us" metric, which is a problem.

CleanDNS has been working with you for 3 years, so why where the Sav.com abuse rates so high to start with? I think some people, including me, are questioning how effective they have been in that time.

If they can't limit abuse over those 3 years, well then who is to say they are doing a good job now with this drastic move.

I have no doubt there is legit abuse. I also have no doubt that mistakes have been made, and in some cases reversed. In other cases, maybe they were not reversed.

I am going to ask this question again...

What happens to domains in accounts that are locked and unable to be renewed or transferred?

Are they going to be sold via the Sav.com expired auction platform?

If so, I am sure you can see the serious financial conflict of interest there.

Brad

 

[Future Sensors]

We are happy to participate in threads that have a clear focus on a Sav-related issue and stay on topic.

You are here on a forum where you cannot influence the responses like you do on Trustpilot and X. I'm very sorry. Everything said here is done with respect and out of genuine concern for the state of Sav, CleanDNS and the security of the Internet and its users. It is now up to you to improve your bad reputation in the cybersecurity community. Sure, you can choose to leave immediately if there is criticism, but you can also think about improving your business.

https://www.namepros.com/threads/sav-official-thread.1202323/page-86#post-9225395

 

[Nick R]

The entire premise of locking entire accounts is based on the "trust us" metric, which is a problem.

I have no doubt there is legit abuse. I also have no doubt that mistakes have been made, and in some cases reversed. In other cases, maybe they were not reversed.

I am going to ask this question again...

What happens to domains in accounts that are locked and unable to be renewed or transferred?

Are they going to eventually be sold via the Sav.com expired auction platform?

If so, I am sure you can see the serious financial conflict of interest there.

Brad

Domains that are disabled for confirmed abuse are locked and are unable to be renewed or transferred. We do start an auction for most TLDs as they are just about to be given back to the registry anyway and are usually just a few weeks away from being able to be hand-registered by anyone. I would love it if registries would allow us to hold these domains at no-cost or lock them themselves but that is not currently the case.

Regarding whose job it is to evaluate abuse. We were not part of the ICANN negotiations for the current contract so I can't speak as to why the responsibility is on the registrar. Should ICANN wish, we are open to an independent body to evaluate abuse and determine the action, just like the UDRP process is currently. However, as that is not currently the case today, we do specify that we may disable an entire account at our discretion in our terms, which must be agreed to before a domain is registered:

"We reserve the right to cancel or terminate your use of the Site and/or Services if you engage in any of the activities described above..." https://www.sav.com/terms/universal_terms

 

[bmugford]

Domains that are disabled for confirmed abuse are locked and are unable to be renewed or transferred. We do start an auction for most TLDs as they are just about to be given back to the registry anyway and are usually just a few weeks away from being able to be hand-registered by anyone. I would love it if registries would allow us to hold these domains at no-cost or lock them themselves but that is not currently the case.

Alright, so that just confirms that Sav.com will benefit financially from the domains expiring in locked accounts.

You won't allow the registrant to renew or transfer the domain, but will sell their domain and keep the profit.

You don't see an issue with that, and how this opens Pandora's box for potential abuse?

It's completely unacceptable that you would profit from these domains.

Brad

 

[Nick R]

You are here on a forum where you cannot influence the responses like you do on Trustpilot and X. I'm very sorry. Everything said here is done with respect and out of genuine concern for the state of Sav, CleanDNS and the security of the Internet and its users. It is now up to you to improve your bad reputation in the cybersecurity community. Sure, you can choose to leave immediately if there is criticism, but you can also think about improving your business.

https://www.namepros.com/threads/sav-official-thread.1202323/page-86#post-9225395

We do not have the ability to remove any review on Trustpilot. They control that on their own. I did remove the comment though as this one is clearly spam.

 

[Nick R]

Alright, so that just confirms that Sav.com will benefit financially from the domains expiring in locked accounts.

You won't allow the registrant to renew or transfer the domain, but will sell their domain and keep the profit.

You don't see an issue with that, and how this is rife for potential abuse?

It's completely unacceptable that you would profit from these domains.

Brad

The gist of that is our policy at the time and is covered publically in our terms. While we want to be able to serve all customers, we do understand if some disagree and choose not use Sav because of it. We are trying to be as open as possible about it though.

 

[bmugford]

Regarding whose job it is to evaluate abuse. We were not part of the ICANN negotiations for the current contract so I can't speak as to why the responsibility is on the registrar. Should ICANN wish, we are open to an independent body to evaluate abuse and determine the action, just like the UDRP process is currently. However, as that is not currently the case today, we do specify that we may disable an entire account at our discretion in our terms, which must be agreed to before a domain is registered:

1.) You decided to hire CleanDNS as an agent or contractor. Your choice.

2.) CleanDNS has been working with Sav.com for 3+ years. In that time Sav.com was near the worst in abuse metrics.

3.) Why should their actions be trusted now, when the the numbers seem to show that they were not doing great over the last 3+ years?

Brad

 

[bmugford]

The gist of that is our policy at the time and is covered publically in our terms. While we want to be able to serve all customers, we do understand if some disagree and choose not use Sav because of it. We are trying to be as open as possible about it though.

The issue is you are locking entire accounts, based on alleged abuse complaints that might or might not be legit.

The entire thing is based on trust.

You are acting as judge, jury, and executioner in a situation which financially benefits Sav.com.

That is a clear conflict of interest.

Brad

 

[Nick R]

1.) You decided to hire CleanDNS as an agent or contractor. Your choice.

2.) CleanDNS has been working with Sav.com for 3+ years. In that time Sav.com was near the worst in abuse metrics.

3.) Why should their actions be trusted now, when the the numbers seem to show that they were not doing great over the last 3+ years?

Brad

Those are the exact reasons we expanded our capabilities with @CleanDNS. They did not have the tools they needed from us to address abuse at an account-wide level, thus Sav having a high abuse score. These new tools were jointly developed to resolve those issues.

 

[Future Sensors]

Those are the exact reasons we expanded our capabilities with @CleanDNS. They did not have the tools they needed from us to address abuse at an account-wide level, thus Sav having a high abuse score. These new tools were jointly developed to resolve those issues.

You forget to mention how your company compares with other registrars.

 

[bmugford]

Those are the exact reasons we expanded our capabilities with @CleanDNS. They did not have the tools they needed from us to address abuse at an account-wide level, thus Sav having a high abuse score. These new tools were jointly developed to resolve those issues.

You do understand that if CleanDNS was doing a bad job before, as the numbers seem to show, it is reasonable to assume they might be doing a bad job now?

Like from not enough action to an overcorrection.

Brad

 

[Future Sensors]

DM me or @CleanDNS directly

You honestly haven't understood the gist of this thread yet. If you just want to have a nice talk without actually listening, then just leave.

 

[Nick R]

You forget to mention how your company compares with other registrars.

The policies of other registrars are set independently and should be accessible in their terms as well.

@CleanDNS - Ill refer to my comment above.

 

[Future Sensors]

The policies of other registrars are set independently and should be accessible in their terms as well.

I'm not talking about policies here. It's about execution.

You're a relatively small registrar, and yet you still score insanely bad on keeping the Internet safe, objectively measured by the organizations that matter and (some) in which CleanDNS also has a seat.