Controversial Sale of .Org Domain Manager Faces Review At ICANN

An anonymous reader quotes a report from Ars Technica: ICANN is reviewing the pending sale of the .org domain manager from a nonprofit to a private equity firm and says it could try to block the transfer. The .org domain is managed by the Public Internet Registry (PIR), which is a subsidiary of the Internet Society, a nonprofit. The Internet Society is trying to sell PIR to private equity firm Ethos Capital. ICANN (Internet Corporation for Assigned Names and Numbers) said last week that it sent requests for information to PIR in order to determine whether the transfer should be allowed. "ICANN will thoroughly evaluate the responses, and then ICANN has 30 additional days to provide or withhold its consent to the request," the organization said.

ICANN, which is also a nonprofit, previously told the Financial Times that it "does not have authority over the proposed acquisition," making it seem like the sale was practically a done deal. But even that earlier statement gave ICANN some wiggle room. ICANN "said its job was simply to 'assure the continued operation of the .org domain' -- implying that it could only stop the sale if the stability and security of the domain-name infrastructure were at risk," the Financial Times wrote on November 28. In its newer statement last week, ICANN noted that the .org registry agreement between PIR and ICANN requires PIR to "obtain ICANN's prior approval before any transaction that would result in a change of control of the registry operator." The registry agreement lets ICANN request transaction details "including information about the party acquiring control, its ultimate parent entity, and whether they meet the ICANN-adopted registry operator criteria (as well as financial resources, and operational and technical capabilities)," ICANN noted. ICANN's 30-day review period begins after PIR provides those details.

ICANN said it will apply "a standard of reasonableness" when determining whether to allow the change in control over the .org domain, but it "might ultimately have to be determined by the courts," notes Domain Name Wire.

Read more of this story at Slashdot.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - Controversial Sale of .Org Domain Manager Faces Review At ICANN
id: 32967d5c-44f0-4ad9-bcfb-951a6277c9e3
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Controversial Sale of .Org Dom" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Controversial Sale of Org Domain Manager")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Controversial Sale of Org Domain Manager*"

CommonSecurityLog
| where Message has "Controversial Sale of Org Domain Manager"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc