Zoho says its domain registrar, TierraNet, pulled its service offline for a few hours after it received phishing complaints, is now looking for a new registrar
and even messaged me back within 10 minutes of my email earlier today. Credit where credit's due. http://tcrn.ch/2zqrF6j https://twitter.com/... Matthew Garrett / @mjg59 : This advert didn't age super well given http://twitter.com/... http://twitter.com/... Troy Hunt / @troyhunt : Oh wow, this thread, what a mess... http://twitter.com/...
Context & Ripple Effects
Registrars have been edging into the enforcement business for years: Google's cancellation of the Daily Stormer's registration set the template for registrars acting on abuse pressure rather than court orders. TierraNet has now applied the same logic to a paying customer — pulling Zoho's domains offline for several hours on phishing complaints — and Zoho is responding by taking its registration business elsewhere.
The episode lands awkwardly for both sides: security researchers Matthew Garrett and Troy Hunt flagged the handling publicly, and within days a report emerged that Zoho's own domains were being abused at scale to exfiltrate malware-collected data. The complaint process that felled Zoho was aimed at exactly the kind of abuse its infrastructure was later accused of hosting.
First-order effects
- Zoho's domains — and whatever services resolve through them — went dark for several hours on a third party's complaint, with no apparent appeal window before restoration.
- Zoho is now running a registrar search mid-incident, making abuse-response process, not price, the selection criterion.
Second-order effects
- Every registrar's phishing-complaint playbook is now under scrutiny by its own customers; GoDaddy's earlier move to reset hundreds of compromised accounts and kill 15,000+ scam subdomains on legitimate sites shows how quickly takedown volume can scale once a process exists.
- Rival registrars gain a sales pitch — 'we investigate before we pull the zone' — turning abuse handling from back-office cost into a competitive differentiator.
Third-order effects
- If complaint-triggered suspensions become standard, the registrar relationship becomes a single point of failure for any online business, pushing larger companies toward registrar diversification or holding their own registrations across multiple accreditations.
- The pattern points toward registrars functioning as a de facto content-and-abuse enforcement layer above ICANN policy — a role the compromise of ICANN's own systems in 2014 already showed carries systemic risk when the control plane itself is attacked.
The trend: Domain registrars are evolving from passive name sellers into an ad hoc internet enforcement tier, where a single abuse complaint can take an entire company offline.