MOUNTAIN VIEW, CA – Google Ads is relaxing its business name requirements, giving verified advertisers more flexibility when their recognized brand name does not match the domain used in an advertisement. Google Ads policy changes usually mean more restrictions, more verification or another layer of compliance. This month, Google is doing something considerably less common: loosening a rule.

Beginning October 19, 2026, Google will allow differences between an advertiser’s business name and destination domain in certain circumstances. Under the updated policy, the business name must accurately represent the advertiser’s recognized name or brand, there must be a verified direct relationship between the advertiser and domain owner, and the advertiser’s products or services must actually be offered on the destination website.

The change addresses a legitimate problem for companies operating multiple websites. For example, a company called Acme Marketing Inc. might own AcmeMarketing.com, InternetAdvertisingServices.com and LocalBusinessMarketing.com. The company behind all three websites is still Acme Marketing, even though two of the domains don’t contain the company’s name.

Google’s previous approach could make that distinction difficult because business names used in ads were generally expected to closely correspond with the advertiser’s verified identity or destination domain. The new policy allows Google to focus more on who actually controls the website rather than whether the business name and domain contain matching words.

Google is not, however, opening the door for affiliates and resellers to impersonate brands. Third-party resellers, independent booking intermediaries, affiliate distributors and secondary sellers are specifically excluded from the exception. A website selling Nike products, for example, cannot simply identify itself as “Nike” unless it actually represents that business.

That distinction may be the most important part of the change. Google isn’t abandoning advertiser verification. Instead, it appears to be saying that once it can establish the identity of an advertiser and verify its relationship with a domain, an exact name-to-domain match isn’t always necessary. That is a considerably more practical approach for modern businesses.

Companies routinely operate multiple websites, acquire descriptive domains, launch product-specific properties and maintain brands that bear little resemblance to their corporate names. A business called Smith Holdings LLC might legitimately own and operate FloridaRoofing.com. The fact that those names don’t match doesn’t make the advertiser deceptive.

For businesses using descriptive or premium domain names, the change could be particularly useful. An established company may be able to advertise using the credibility of its recognized brand while directing customers to a specialized domain it legitimately operates.

There are still unanswered questions, particularly about how Google will establish a “verified direct relationship” between advertisers and domain owners in less obvious ownership structures. But the direction of the policy change itself is welcome.

Google Ads has spent years adding verification procedures, restrictions and increasingly detailed advertising requirements. This time, Google looked at a rigid requirement and apparently concluded that legitimate businesses needed more flexibility. For once, a Google Ads policy update actually makes a rule less restrictive rather than more complicated. Unprecedented.

WASHINGTON, D.C. – Two of the most security-sensitive organizations in the United States have been dealing with major data breaches at nearly the same time, exposing sensitive information connected to millions of military personnel and potentially thousands of current and former FBI employees.

The incidents involving the Federal Bureau of Investigation and the U.S. Department of Defense are separate, and there is currently no established evidence that they were carried out by the same attackers. Taken together, however, they provide a striking reminder of just how difficult it has become to protect sensitive information, even inside organizations entrusted with national security, intelligence and federal law enforcement.

The Pentagon breach is enormous by almost any measure. A breach involving the Defense Manpower Data Center, one of the Department of Defense’s central repositories for personnel information, affected approximately 2.76 million living people and another 294,000 deceased individuals, according to a U.S. defense official cited by ABC News.

The exposed information included Social Security numbers and details about jobs held by military and civilian personnel. Other reporting indicates the compromised records included names, dates of birth, contact information and military occupational information.

Unauthorized users had access to the affected system from October 2025 until July 2026, meaning the intrusion persisted for approximately nine months before the vulnerability was discovered and remediated.

The Defense Manpower Data Center maintains information involving active-duty and reserve military personnel as well as civilian employees, contractors, retirees, veterans and military family members.

The Pentagon has said it has not found evidence that the compromised information has been misused. The FBI, meanwhile, has been confronting a very different but potentially serious breach.

On September 23, the FBI publicly acknowledged that a cybercriminal group was claiming to have compromised the FBIJobs.gov portal and potentially obtained personally identifiable information belonging to FBI employees.

At the time, the bureau said it was investigating whether the point of compromise was within a third-party provider or the FBI’s own enterprise. Subsequent reporting has provided considerably more detail.

The hacking group ShinyHunters claimed responsibility for the attack and claimed to have obtained a massive collection of information associated with FBI and Justice Department personnel and applicants. Some of the group’s broadest claims have not been independently verified and should be treated as allegations.

However, reporting from multiple news organizations indicates that highly sensitive information was compromised. Reports have described exposed information including employee names, addresses, Social Security numbers, job information and, in some cases, sensitive medical records.

The incident is particularly concerning because FBI personnel can work on counterintelligence, organized crime, terrorism, drug trafficking and other investigations where protecting an employee’s identity and personal information may have implications extending well beyond ordinary identity theft.

The cause of the FBI breach has also become clearer. Reuters reported on October 6 that the FBI removed an Accenture contractor over the incident. FBI cyber chief Brett Leatherman said the breach resulted from a security failure involving a platform managed by a third-party organization after a contractor failed to install a security patch that had specifically been issued to protect the platform.

Sources told Reuters that the affected platform was Oracle PeopleSoft. That detail may be one of the most important lessons to emerge from either breach. Organizations can spend enormous amounts of money on cybersecurity and still remain vulnerable because security is ultimately dependent on an entire chain of systems, software, employees, contractors and outside vendors.

A single vulnerable server can matter. A single uninstalled security patch can matter. A third-party platform can matter. And information that appears administrative rather than operational can become extraordinarily valuable when it identifies the people performing sensitive government work.

The Pentagon incident presents another troubling example. Sensitive personnel information reportedly remained accessible to unauthorized users for months before the intrusion was discovered.

These incidents do not mean that the Pentagon’s classified military networks or the FBI’s investigative systems were broadly compromised. There is no evidence supporting such a conclusion based on the information currently available. But that distinction should not minimize what happened.

Personnel databases can contain some of the most useful information available to criminals, foreign intelligence services and sophisticated social-engineering operations. Names, addresses, Social Security numbers, employment information, occupational specialties and other personal details can potentially be combined with information obtained from previous breaches, public databases and social media. That information can then be used to build remarkably detailed profiles of individuals.

The FBI itself routinely warns businesses and the public about cybercrime, data theft, ransomware, phishing and the importance of installing security updates. The Department of Defense operates some of the most sophisticated information and cybersecurity infrastructure in the world. Yet both organizations have now found themselves confronting significant compromises of sensitive personnel information.

For businesses, the lesson should not be that cybersecurity is hopeless. It should be exactly the opposite. If institutions with enormous cybersecurity budgets, specialized personnel and national-security responsibilities can suffer damaging breaches, no business should assume that a firewall, antivirus subscription or IT provider makes its information automatically safe.

Cybersecurity increasingly depends on continuous maintenance: installing patches quickly, limiting access to sensitive information, encrypting stored data, monitoring systems for unusual activity, reviewing third-party vendors and reducing the amount of valuable information exposed through any single system.

The FBI and Pentagon incidents demonstrate another increasingly important reality. An organization’s cybersecurity may only be as strong as the least secure system, contractor or vendor connected to it. And sometimes the most consequential breach does not begin with someone breaking through the front door. It begins with a door someone forgot to lock.

WASHINGTON, D.C. – A push by President Donald Trump to replace the term “Artificial Intelligence” with “Super Intelligence” is creating an unexpected surge in demand for Slovenia’s .SI country-code domain.

More than 46,000 new .SI domain names were registered during September, according to figures cited by Domain Name Wire, with registration activity accelerating sharply at the end of the month. Roughly 12,000 .SI domains were registered per day during the final two days of September.

The sudden interest stems from the initials “SI,” which match the abbreviation for “Super Intelligence” while also serving as Slovenia’s country-code top-level domain.

Trump had publicly advocated replacing the term Artificial Intelligence with Super Intelligence, arguing that the word “artificial” makes the technology sound fake. The idea moved beyond rhetoric on September 29th when Trump signed an executive order directing executive departments and agencies, to the extent permitted by law, to use “Super Intelligence” and “SI” instead of “Artificial Intelligence” and “AI” in official communications and other non-statutory documents.

Domain investors had already begun registering .SI domains before the executive order. On September 28, Domain Name Wire reported that the .SI namespace had grown by more than 15% during the month, rising from roughly 190,000 registrations in early September to approximately 219,000.

The latest figures put September registrations at 46,066.

That growth is notable for a relatively small country-code extension, but there is an important distinction between domain registrations and actual business adoption.

So far, most visible .SI aftermarket activity appears to involve domain investors acquiring names and relisting them at higher prices. Domain Name Wire also cited data showing no Product Hunt startups launching on .SI during the preceding 30 days, while dozens continued to launch using .AI domains.

That makes the current boom primarily a speculative one.

The economics also make .SI an attractive bet for domain investors. The registry charges approximately €10 per year at the wholesale level, according to Domain Name Wire. By comparison, .AI domains carry substantially higher registry costs and generally require a two-year registration.

Whether .SI develops into a genuine technology namespace will depend on something registration statistics cannot yet answer: whether startups, technology companies and other end users actually begin using it.

The domain industry has seen similar registration rushes before. A new extension, abbreviation or technology trend can generate enormous speculative demand almost overnight, but long-term value generally depends on development, branding and end-user adoption rather than the number of names sitting in investor portfolios.

For now, .SI has unquestionably received something most domain extensions struggle to obtain: sudden global attention.

Whether “Super Intelligence” becomes common terminology outside the federal government, and whether businesses begin branding themselves around SI, will likely determine whether Slovenia’s unexpected domain boom becomes a lasting market or another short-lived registration rush.

WEST PALM BEACH, FL – This evening I was reading DN Journal’s recent profile of veteran domain investor Yoni Belousov when I found myself asking a fairly simple question:

What is the big takeaway here?

Belousov has unquestionably built an impressive career in the domain business. He started experimenting with domain names as a teenager, eventually managed more than 100,000 domains and told DN Journal that his company surpassed $100 million in domain sales to the Chinese market alone.

But by the time I reached the end of the article, the part that interested me most wasn’t the biography.

It was the size of the bet Belousov is now making on new top-level domains.

In August, Belousov and two minority investors launched Link Freedom Group, which filed applications with ICANN for 316 proposed new TLDs. According to DN Journal, the non-refundable application fees for the primary strings alone represent an initial investment of approximately $36 million, with plans to ultimately spend as much as $100 million on the effort.

That’s a serious wager on the future of the domain-name system.

And once I understood that, another part of the article became much more interesting.

Before LFG, There Was .link

Belousov didn’t enter the registry business with the 2026 ICANN round.

He got an early start several years ago.

In 2021, when Uniregistry founder Frank Schilling auctioned his portfolio of top-level domains, Belousov’s group pursued .link.

“We decided to go after .link as we believed it to be, by far, the most valuable one in the collection,” Belousov told DN Journal.

His Nova Registry ultimately acquired the extension, and IANA records show that .link was formally transferred to Nova Registry Ltd. on May 19, 2022. Nova remains the sponsoring organization for the extension.

Belousov described the acquisition as forcing his company through the “trial and error of running and growing a registry.”

That makes .link more than just another TLD in his portfolio.

It is essentially the laboratory that preceded a much larger experiment.

So before getting excited about a possible $100 million expansion into hundreds of new extensions, I wanted to see what that laboratory has produced.

What Has Happened to .link?

There is some growth here, and it should be acknowledged.

According to historical registry data compiled by nTLDData from ICANN reports, .link had 188,791 reported registrations in May 2022, around the time Nova Registry formally took control.

By December of that year it had grown to 227,145.

By May 2023, it had reached 236,740 registrations.

And by May 2026, the latest month for which ICANN registrar-level reporting was available when this article was written, .link had 308,011 reported registrations.

That means the reported registration base increased by more than 60% between May 2022 and May 2026.

That is worth noting.

But it isn’t the number that caught my attention.

The number that did was the renewal rate.

The Number I Find Hard to Ignore

According to nTLDData’s calculations using ICANN monthly registry reports, 225,638 .link domains came up for renewal during the 12 months ending May 2026.

Of those, 90,002 were renewed while 135,636 were deleted.

That works out to a keep rate of 39.89%.

For comparison, nTLDData reports that the median gTLD kept approximately 68.7% of registrations coming up for renewal, while .com, .net and .org combined kept approximately 73.2%.

To me, that is considerably more revealing than the headline registration count.

Anyone can generate registrations under the right combination of pricing, promotions and distribution. The more difficult question is whether registrants value the names enough to keep paying for them.

And a namespace in which substantially more expiring registrations are being deleted than renewed deserves scrutiny.

There Has Been Growth, But What Kind of Growth?

This is where I think the discussion becomes more nuanced.

It would be unfair to say .link has gone nowhere.

It hasn’t.

When Nova took control, the registry had fewer than 190,000 reported registrations. Four years later, the ICANN registry reports showed more than 300,000.

That’s real growth.

But registration growth alone doesn’t tell us whether a registry is creating a durable base of users, producing attractive economics or establishing an extension that businesses and consumers actively seek out.

We do not have Nova Registry’s private financial statements.

We don’t know its registry revenue, margins, premium-domain sales, wholesale pricing arrangements or operating costs. Those numbers could materially change the picture.

But those numbers aren’t public.

What we can see publicly is a namespace with roughly 300,000 reported registrations in the most recent ICANN registrar data and a recent keep rate below 40%.

I’m having a hard time looking at those numbers and seeing evidence that makes me eager to multiply the strategy hundreds of times over.

Maybe .link Was Never Supposed to Become .com

There is an obvious counterargument.

Belousov doesn’t need .link to become .com.

A registry does not necessarily require millions of registrations to be profitable, and the economics of running a TLD can differ considerably from the economics of owning individual domain names.

A smaller extension could potentially work very well financially if acquisition costs are reasonable, operating expenses are controlled and the registry generates enough recurring renewal and premium-name revenue.

That is precisely why I would be interested in hearing how Belousov measures .link’s performance internally.

Perhaps registrations and renewal percentages are not the metrics he considers most important.

Perhaps the economics look much better behind the scenes than they do from the outside.

But if .link helped provide the experience and confidence to commit tens of millions of dollars to the next ICANN round, then examining its publicly visible performance seems entirely fair.

The AI Argument

Belousov also offered a larger explanation for his new-TLD strategy.

He told DN Journal that investing in new gTLDs allows his business to scale beyond individual domains and domain portfolios while providing diversification and what he described as an interesting “moat for the post AI world.”

I actually agree with part of that thesis.

As artificial intelligence makes it dramatically easier to produce websites, applications, content and even entire businesses, recognizable brands and trustworthy digital identities may become increasingly important.

Where I am less convinced is the next step in the argument.

If domains become more valuable in an AI-heavy world, does that necessarily mean the world needs hundreds more extensions?

Those are two very different propositions.

AI could make good domain names more valuable while simultaneously concentrating demand around a relatively small group of established extensions.

More businesses could mean more competition for .com.

More automated content could increase the value of recognizable brands.

More fraud and impersonation could make consumers place even greater value on familiar namespaces.

None of those outcomes inherently requires hundreds of additional strings to the right of the dot.

And Now the Bet Gets Much Bigger

Belousov told DN Journal that his team originally considered approximately 2,000 possible strings before narrowing the list to more than 300 applications.

After seeing that the overall 2026 application round produced more than 1,600 applications, he said that, in hindsight, he would have applied for at least 100 more TLDs.

That may ultimately prove brilliant.

Belousov has certainly identified profitable domain opportunities before, including opportunities other investors overlooked.

His history alone should make anyone reluctant to dismiss the strategy casually.

But successful investors can also make investments that don’t work.

And past success doesn’t eliminate the need to examine the next thesis on its own merits.

That is what I find missing from much of the excitement surrounding the new ICANN round.

There is enormous attention being paid to which companies applied, how many strings they pursued and how much money they committed.

I am more interested in a simpler question:

What evidence do we already have that the model works?

In Belousov’s case, we actually have something unusually valuable.

We have .link.

The extension has existed since 2014.

Nova Registry has operated it since 2022.

Registrations have grown materially under that ownership.

But the extension’s most recent ICANN registrar data showed roughly 308,000 registrations, while its calculated 12-month keep rate stood below 40%.

Maybe those numbers obscure a highly profitable registry operation.

Maybe the lessons learned running .link have little to do with .link’s own registration volume and everything to do with distribution, pricing, backend operations and understanding the registry business before the next round.

Those are legitimate possibilities.

But based strictly on what I can see publicly today, .link doesn’t make me want to place a bigger bet on new gTLDs.

It makes me more cautious.

Belousov appears ready to take what he learned from one registry and scale it into potentially hundreds.

He may prove the skeptics wrong.

For now, however, when I look at the publicly available results from the registry that helped lead him there, my reaction remains pretty simple:

I’m not very impressed.

WEST PALM BEACH, FL – One of the Internet’s most recognizable geographic domain names has changed hands. Nashville.com has been sold by longtime owners Michael and David Castello, better known in the domain industry as the Castello Brothers, in a transaction brokered by Andrew Miller. The sale was publicly announced by David Castello on September 28, 2026.

“NASHVILLE.COM SOLD!” Castello wrote on LinkedIn, while crediting Miller with finding what he described as the “perfect buyer.” The announcement immediately leaves two major questions: Who bought Nashville.com, and how much did they pay?

For now, neither answer is public.

What We Know

Nashville.com is not a recently registered domain or a speculative name that spent decades sitting on a parking page. The domain was originally registered on April 14, 1993, making it more than 33 years old at the time of the sale.

The Castello Brothers acquired Nashville.com in the early 2000s and subsequently developed it into a substantial city and entertainment website covering Nashville music, events, restaurants, attractions and other local information. Historical reporting places the acquisition in 2003, while Michael Castello has separately written that he and his brother purchased the domain in 2002 for a six-figure amount.

The site became one of the Castello Brothers’ best-known developed geo-domain properties. In a 2010 interview with Venture Nashville, David Castello said the domain had become worth substantially more than the brothers paid for it and at the time estimated its value at as much as $40 million. That was the owner’s valuation in 2010, however, not a reported offer or sale price.

We also know this transaction was specifically for the domain name.

After DomainGang initially suggested the transaction might have included the developed website or other assets, David Castello responded directly: “Sale was for domain name only.”

Veteran domain broker Andrew Miller was involved in the transaction. Miller subsequently confirmed that ATM Holdings, together with HDA, oversaw the sale, describing it as a successful transaction for both sides.

What We Don’t Know

The sale price has not been disclosed. David Castello indicated in his announcement that the transaction is subject to a nondisclosure agreement, meaning the purchase price remains confidential. A reported $2.2 million asking price should not be treated as evidence of either the asking price or the eventual transaction value. David Castello specifically responded to that report by stating, “We never had an asking price of $2.2 million.”

The buyer has also not been publicly identified. Miller has said he became “new, fast friends” with the people who acquired the domain, but neither he nor the Castellos have publicly named the buyer.

It is also unclear what will ultimately happen to the longstanding Nashville.com website and its content. The domain continues to resolve to an active Nashville-focused website, but because Castello confirmed that the transaction involved the domain name only, the future of the existing publication and where its content ultimately resides remains an open question.

That may ultimately prove as interesting as the price.

Exact-match .com domains representing major American cities and regions are scarce by definition, and Nashville.com carries more than three decades of registration history along with more than two decades of development under the Castello Brothers.

For now, the domain industry knows that Nashville.com has finally changed hands. Exactly who bought it, what they paid and what they intend to do with one of the Internet’s most recognizable geo domains remain unknown.

WEST PALM BEACH, FL – Internet users have been told for years to inspect a website address before clicking a suspicious link. A phishing technique known as a homoglyph attack is designed to defeat that very habit by making a fraudulent domain name appear almost identical to a legitimate one.

The trick relies on characters, letters or combinations of letters that look like something else. A Latin “c,” for example, can be replaced with the visually similar Cyrillic character “с.” To the human eye, microsoft.com and miсrosoft.com may appear identical, but the “с” in the second address is actually the Cyrillic small letter es (Unicode U+0441), making it a completely different domain name.

The Guardian recently highlighted the technique as an emerging phishing threat, noting that attackers can use visually similar characters from different alphabets inside web and email addresses. Certain fonts and small screens can make the substitutions especially difficult to notice.

A Real Microsoft Phishing Operation

One of the clearest real-world examples surfaced through Microsoft’s investigation of RaccoonO365, a phishing-as-a-service operation that provided criminals with tools for stealing Microsoft 365 credentials.

According to Microsoft, attackers used rnicrosoft.com, replacing the lowercase “m” at the beginning of Microsoft with the letters “r” and “n.” At a glance, particularly in some fonts or on a small screen, the two letters can resemble a single “m.”

This was not a laboratory demonstration. Microsoft said more than 5,000 Microsoft customers across 94 countries had login credentials stolen using RaccoonO365. The service supplied phishing infrastructure and templates that allowed other criminals to imitate legitimate Microsoft communications. Microsoft ultimately obtained a court order allowing its Digital Crimes Unit to seize 338 domains associated with the operation.

Booking.com Attack Hid the Real Domain

Another unusually creative example appeared in 2025 in a phishing campaign impersonating Booking.com. Attackers used the Japanese hiragana character ん, which can resemble combinations such as “/n” or “/~” at a quick glance in some fonts.

The deceptive URL included text resembling a Booking.com address, but the actual registered domain was www-account-booking.com. The hiragana characters helped make portions of the address appear more like directory separators, disguising the true registered domain farther to the right. Victims who continued through the site were ultimately directed to a malicious MSI installer capable of delivering additional malware.

A Fake PayPal Domain Delivered Ransomware

The technique is not new. In 2019, researchers identified a fake PayPal website being used to distribute Nemty ransomware. The fraudulent domain used Unicode characters from another alphabet that could visually render as рayрal.com, closely resembling the legitimate paypal.com.

Behind the scenes, however, that internationalized domain was represented in the ASCII-compatible Punycode form xn--ayal-f6dc.com. The two characters that appear to be lowercase “p” letters in the Unicode version are actually Cyrillic characters.

That distinction is important. A browser does not necessarily display the deceptive Unicode version today. Modern browsers, including Chrome, apply checks to suspicious internationalized domain names and may deliberately show the xn-- Punycode form instead. That is why entering or visiting the domain today may show xn--ayal-f6dc.com in the address bar rather than something resembling paypal.com.

In the 2019 attack, visitors were offered what appeared to be a PayPal cashback application. Those who downloaded and executed the file instead received Nemty ransomware.

Lookalike Domains Are Being Used at Scale

More recent investigations show that lookalike domains are not limited to isolated phishing campaigns. Microsoft’s 2026 investigation into the cybercrime infrastructure provider RedVDS uncovered more than 7,300 IP addresses collectively hosting more than 3,700 homoglyph domains during a single 30-day period. Criminals used the infrastructure to impersonate businesses, hijack email conversations and redirect legitimate payments.

In one documented case, criminals impersonating Bellingham Marine used bellinqham-marine.com instead of bellingham-marine.com. In another case involving Alabama pharmaceutical company H2-Pharma, criminals subtly changed a vendor’s email domain from cheplapharm.com to cheplapharrm.com, adding an extra “r.” Microsoft said H2-Pharma ultimately lost more than $7.3 million.

Browsers Try to Detect the Trick

Internationalized Domain Names allow domain names to contain characters beyond the traditional Latin alphabet. To remain compatible with the Domain Name System, those Unicode characters can be converted into an ASCII-compatible representation called Punycode, which begins with xn--.

Google Chrome applies a series of checks to internationalized domain names and decides whether to display the Unicode version or the Punycode version. Suspicious character combinations, mixed writing systems and domains that closely resemble prominent websites can cause Chrome to display the Punycode address instead.

Those protections help, but they cannot eliminate every form of visual deception. Some attacks, such as rnicrosoft.com, use nothing more than ordinary Latin characters arranged to fool the eye.

The Domain Name Is Now Part of the Attack

For businesses, homoglyph and lookalike attacks create risks beyond someone landing on a fake website. Similar domains can be used for employee credential theft, vendor impersonation, fake invoices and business email compromise, where a nearly identical email domain may be inserted into an existing financial conversation.

HTTPS does not solve the problem. A secure connection means that traffic between the browser and the domain is encrypted. It does not prove that the domain belongs to the company the visitor thinks it does.

Users should avoid logging into important accounts through links delivered by unexpected email or text messages and instead navigate directly to the known website. Businesses should also monitor for domains resembling their brands, use multifactor authentication, maintain email authentication controls and independently verify unexpected requests involving payments or banking information.

The effectiveness of the attack comes from its simplicity. Criminals do not necessarily need to break the real website or compromise the real domain. Sometimes they only need to register something that looks close enough for a recipient to believe it is real.

WEST PALM BEACH, FL – EstiBot has launched SoldNames.com, a free database combining historical domain sales with live domain auctions, adding another piece to a growing collection of tools that increasingly covers the domain investor’s research workflow.

According to DomainInvesting.com, SoldNames contains hundreds of thousands of publicly reported domain sales of $250 or more. The service can be searched without creating an account or logging in, tracks live auctions across multiple marketplaces and allows data to be exported in CSV, JSON and TSV formats.

SoldNames itself is useful, but the broader development may be more significant. EstiBot and its related services now reach across several stages of domain investing. EstiBot provides automated valuations and domain metrics, DomainIQ provides domain ownership and research tools, Dropping.pro tracks expiring and auctioning domains, and DomainLeads.com shows where the same term is registered and developed across different domain extensions, providing useful data for valuation and prospective-buyer research.

SoldNames adds historical comparable sales and live auction research. Taken together, the services increasingly cover the process of discovering a domain, researching its history and ownership, estimating its value, examining comparable sales, monitoring auctions and researching potential buyers.

SoldNames Moves Into NameBio Territory

Historical domain sales research is territory long served by NameBio, which maintains a searchable database of reported domain transactions and tools for researching comparable sales, with broader access requiring a subscription and user login. SoldNames enters that market with historical sales searches available free and without requiring an account.

Strategic Revenue conducted a limited comparison of the two services using three-letter .com domains, commonly referred to as LLL.com domains, sold during the past five years. Both searches used the same basic criteria, results were ranked by reported sale price, duplicate transactions were removed and the 95 highest-ranking unique domains available from each set of results were compared.

Of the 95 unique domains examined, 78 appeared in both sets of results, an overlap of approximately 82%. The remaining 17 domains in each top-95 list were different, showing that while the two services produced largely similar results, nearly 18% of the highest-value domains returned by each service did not appear in the other’s top 95. The comparison did not determine whether those domains appeared elsewhere in the other database or were absent entirely.

Among domains appearing in both sets, Strategic Revenue also found some differences in reported transaction details, although the price differences reviewed were relatively minor. Examples include:

Transaction dates can also differ slightly. For example, NameBio records EDV.com at $58,593 with a September 7, 2025 sale date, while SoldNames records the domain at $58,500 with a September 9 date.

Those variations should not be interpreted as establishing that either database is more accurate. Historical domain sales databases can draw information from different marketplaces, brokers and public reports, and individual transactions can be reported differently depending on the source.

Overall, the comparison showed substantial agreement. More than four out of five of the unique domains in the two top-95 samples overlapped, and the price differences found among several matching transactions were relatively minor. At the same time, differences in both coverage and individual transaction details demonstrate that the databases are not identical, despite presenting a broadly similar picture of the market.

A Larger Domain Research Ecosystem

Domain investors have traditionally moved among numerous services when researching an acquisition or potential sale. Expired domains may be discovered in one place, ownership investigated somewhere else, valuations checked through another service, comparable sales researched through another database and prospective buyers identified separately.

The collection of services surrounding EstiBot is gradually bringing more of those functions into a related ecosystem. There are already signs of integration between the tools. DomainLeads’ API uses EstiBot account credentials, while DomainInvesting.com previously reported that DomainLeads data was integrated into Dropping.pro email alerts, allowing investors researching expiring domains to see additional registration and development information.

The significance may ultimately be less about any individual tool than how useful the collection becomes together. An investor can increasingly move from discovering a domain to researching ownership, estimating value, examining comparable sales and investigating potential buyers using services within the same related ecosystem.

SoldNames’ export capabilities also provide a notable advantage for researchers who want to work with the underlying search data. Results can be exported in CSV, JSON and TSV formats for use in spreadsheets, internal valuation systems and other research workflows. NameBio, by comparison, places substantial limits on exporting ordinary search results, including for logged-in users with a basic subscription, while broader API access is available separately to qualifying Business Members.

For NameBio, the immediate development is the arrival of another source of historical domain sales information that users can search without a subscription or login. For domain investors, however, the more interesting development may be the increasingly broad research ecosystem taking shape around EstiBot.

Viewed alongside DomainIQ, Dropping.pro, DomainLeads and EstiBot itself, SoldNames looks less like an isolated product launch and more like another piece of an expanding domain investing research ecosystem.

MIAMI, FL – Rick Schwartz’s Beanstalk Challenge has succeeded at one thing beyond dispute: getting valuable domain names developed. In roughly six months, dozens of premium domains that previously sat largely undeveloped have been transformed into websites, marketplaces, applications and online business concepts. Many of them look good. Some are surprisingly sophisticated for projects only months old. The harder question is whether they are becoming actual businesses with customers, transactions, recurring users and revenue.

With the inaugural Beanstalk Challenge finale approaching in Miami, Strategic Revenue reviewed the project’s current LIVE BUILDS and DOMAINS IN-BUILD lists, reconstructed earlier public project rosters, checked the Day 201 clawback announcement, visited the domains themselves where accessible and reviewed publicly posted statements from Schwartz and participating builders.

The result is a considerably larger and more complicated picture than the current Beanstalk website alone reveals.

80 Startups, 67 Current Listings – and at Least 81 Domains in the Public Record

In his six-month update, Schwartz reported 80 startups, 60 builders and 41 LIVE projects, with more than $200 million in what he described as category-defining domain assets being mobilized.

Strategic Revenue’s reconstruction of the public roster finds slightly different numbers depending on where in Beanstalk’s rapidly changing history the snapshot is taken.

As of September 21, the official Beanstalk website displayed 30 LIVE builds and 37 DOMAINS IN-BUILD, or 67 current listings. A reconstruction of the Day 182 public roster produces 79 individually identifiable domains. At least two additional domains, UsedLamborghinis.com and Bluffing.com, appeared in earlier public Beanstalk updates but had disappeared before that later roster.

That means at least 81 distinct domain names have been publicly associated with Beanstalk at some point.

That does not necessarily conflict with Schwartz’s reference to 80 startups. A “startup” and a historical domain assignment do not have to be the same unit, and assignments have changed. Projects have been reassigned, removed, moved between LIVE and IN BUILD, and placed into clawback. But it does demonstrate why any accounting of Beanstalk needs a date attached to it.

Development Is Real. Traction Is Harder to Prove.

Schwartz has been clear about the objective. In describing the Beanstalk formula, he has said builders are expected to create a real functioning business demonstrating revenue, users, traffic or meaningful traction, rather than simply placing a landing page on a valuable domain. Beanstalk’s own Builder Framework lists business execution, growth, revenue potential, operational quality, user traction and long-term viability among the factors that may be considered.

On development alone, there is plenty to point to.

JobFind.ai, for example, presents a developed AI-assisted Swiss employment platform with free and paid plans, including automated job applications and career coaching. Associations.com has been developed into a substantial association industry portal containing directories, software comparisons, employment listings and paid vendor opportunities. TradeShows.com contains a large trade-show directory and a growing collection of exhibitor resources and tools.

Booty.com is another unusually revealing example. The fitness platform contains structured workout programs, account functionality, a three-day trial, a $19 monthly subscription and individual programs priced from $29 to $69. Yet the site also candidly states that it has no ratings or download counts because nobody has trained there yet. That single disclosure illustrates the challenge facing the entire experiment. Building the product and acquiring the customer are two different accomplishments.

Strategic Revenue found numerous examples of real functionality, pricing structures, subscription models, directories, lead-generation systems, marketplaces and other substantial development. What remains much more difficult to independently verify across most of the field is actual revenue, paying customers, completed transactions, recurring active users or significant organic market adoption. That does not mean those things do not exist. Builders may possess private Stripe data, analytics, customer records, contracts or revenue figures that have never been made public. It simply means the visible evidence currently proves development far more clearly than it proves traction.

The Clawbacks Have Begun

That distinction appears to matter to Schwartz as well. On September 21, the official Day 201 clawback list identified 27 domain assignments involving 10 builders. Schwartz said DNS was being updated and gave the affected builders one final seven-day opportunity to put a legitimate operating business online before a domain could be permanently reclaimed and offered to someone else. For that reason, Strategic Revenue is not describing these 27 projects as permanent failures. As of September 21, they are clawback projects with a final cure period still running.

The announcement also exposed how quickly Beanstalk’s public status information can become inconsistent. Banker.com, assigned to Angela Chance, remained labeled LIVE on the official Beanstalk site while simultaneously appearing on the Day 201 clawback list. Numerous other clawback names were still displayed under DOMAINS IN-BUILD.

Of the 27 clawback domains, 20 could still be found on the current official Beanstalk roster during Strategic Revenue’s September 21 review. Seven others – eGold.com, CourtOrder.com, SaveMe.com, Schmaltz.com, IncomeProperty.com, Weapons.com and Boardroom.com – were no longer displayed on the current project roster. This is important when interpreting the labels below. LIVE and IN BUILD are Beanstalk’s own current classifications. They should not be read as independent verification that a project has customers or revenue.

Team Hazen Is a Significant Part of the Beanstalk Story

One participant deserves particular attention simply because of the volume of domains involved. Team Hazen, identified publicly as father-and-son team Andrew and Oliver Hazen, currently appears on 11 projects on the official Beanstalk roster. Six are currently labeled LIVE: HelicopterCharter.com, TaxiDrivers.com, PoolRepair.com, ACrepair.com, BreakfastBars.com and BirthdayParty.com. Five more are listed IN BUILD: AiDesigns.com, eDivorce.com, Solicit.com, FaceFind.com and CarLocators.com. All five of those current IN BUILD Team Hazen projects also appear on the Day 201 clawback list. Weapons.com, previously assigned to Team Hazen but no longer displayed on the current roster, is also on the clawback list.

Earlier public Beanstalk updates additionally associated Team Hazen with UsedLamborghinis.com and Homemade.com, although Homemade.com is currently listed under Christopher John. Across the public history of the challenge, at least 14 distinct domains have therefore been associated with Team Hazen at one point or another.

Full Public Domain Accounting Through September 21, 2026

The following table consolidates the broadest public domain roster Strategic Revenue could reconstruct.

LIVE and IN BUILD are the statuses displayed on the current official Beanstalk website. CLAWBACK means the domain appears on the September 21 Day 201 clawback list and, as of that announcement, still has a seven-day final opportunity before permanent reclamation. HISTORICAL means the project appeared in the later Day 182 public roster but is no longer shown on the current official project page. EARLIER PUBLIC ASSIGNMENT identifies domains documented in earlier Beanstalk updates that had disappeared before the Day 182/current rosters.

These are program-status labels, not Strategic Revenue ratings of the businesses.

Total distinct domains identified in the public record reviewed by Strategic Revenue: at least 81.

What Does “Live” Actually Mean?

The table also demonstrates why raw project counts can be misleading. A domain can be technically LIVE while still being at the beginning of customer acquisition. A domain labeled IN BUILD can already contain substantial product functionality. Conversely, a polished website can contain pricing, checkout buttons and large quantities of content without providing any public evidence that a meaningful number of people are actually buying.

There are also unusual cases created by the rapidly changing roster. Dick.com, for example, currently resolves to a developed streaming platform with multiple paid plans even though the domain no longer appears on the current official Beanstalk project page. Boardroom.com, meanwhile, currently presents an early-access concept and is on the Day 201 clawback list. For that reason, Strategic Revenue did not classify domains as successful or failed merely because an automated site check succeeded or failed. Some sites could not be reliably accessed by our checking tools, and an inaccessible automated request is not proof that a domain is offline for ordinary visitors.

How Will the Winner Be Judged?

The current Beanstalk website identifies a five-member judging panel consisting of David Castello, Ron Jackson, Ammar Kubba, Morgan Linton and Andrew Rosener. The project’s Builder Framework and FAQ describe broad considerations including execution, business growth, revenue potential, branding, operational quality, user traction, innovation, long-term viability and strategic use of the domain.

What Strategic Revenue could not locate was a publicly released numerical scoring rubric assigning weights to those factors or a detailed public procedure explaining how revenue, customer, traffic or usage claims will ultimately be authenticated. That is an important limitation of any outside assessment. A project that appears to have little publicly visible traction could conceivably present the judges with private financial records, analytics, customer information, signed agreements or other evidence unavailable to the public.

The Real Test Comes in Miami

The inaugural Beanstalk finale is scheduled for November 11-12 at CloudFest Americas and NamesCon in Miami, with the Beanstalk Challenge Finale appearing on the November 12 program. That event may provide evidence that simply cannot be observed from the public web today. If finalists arrive with paying customer counts, actual revenue, completed transactions, significant traffic, partnerships or measurable recurring usage, the picture could look considerably different by November.

For now, Beanstalk deserves substantial credit for activation. Valuable domains that might otherwise have remained parked are being used. Builders have invested real time. Real applications have been developed. Several projects contain more functionality than many established commercial websites.

But the larger promise of Beanstalk was never merely to prove that a good developer armed with modern AI tools can quickly put an impressive website on a premium domain. The promise was to create businesses. Six months in, the public record provides abundant evidence of building. Meaningful commercial traction across most of the field remains considerably harder to see.

With 27 assignments now formally facing clawback and a seven-day deadline to demonstrate execution, Beanstalk itself appears to be entering the stage where the distinction between those two things matters most.

Editor’s Note: Strategic Revenue did not interview Rick Schwartz, Beanstalk Challenge organizers, judges or participating builders for this report. This accounting was assembled entirely from publicly available material, including the official Beanstalk Challenge website and governing materials, public updates from Schwartz and participating builders, published reporting, historical project announcements and direct reviews of domain websites conducted through September 21, 2026. Project assignments, websites and statuses are changing rapidly. A failed automated website check was not treated as proof that a project was offline, and the absence of publicly verifiable revenue, users, customers or transactions should not be interpreted as proof that none exist. It means such evidence could not be independently confirmed from the public record reviewed for this report.

MOUNTAIN VIEW, CA – Google Ads is sending advertisers an unusual quarterly policy reminder specifically warning about deepfakes, non-consensual intimate imagery and other forms of unlawful synthetic content.

The email, sent under the subject line “Quarterly reminder about Google Ads terms and policies,” initially resembles a routine reminder that advertisers remain subject to Google’s terms and privacy policy. But the message quickly turns to artificial intelligence and India’s recently strengthened rules governing synthetic media.

“The generation, modification or publication of unlawful synthetic content such as deepfakes, non-consensual intimate imagery, etc is prohibited under the Rules,” Google told advertisers.

Google also warned that violations could result in content removal, loss of account access or termination, and that certain offenses may be reported to authorities.

The notice follows amendments to India’s Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules that took effect in February 2026. The changes significantly expanded requirements surrounding synthetically generated information, including deepfakes and other AI-generated material.

Importantly, the warning should not be interpreted as a prohibition on ordinary AI-generated advertising images.

India’s rules distinguish between synthetic content generally and synthetic material that violates applicable law. Government guidance specifically identifies concerns including obscene material, impersonation, misleading content, non-consensual intimate imagery and material harmful to children.

A computer-generated image of a fictional person, product, office or landscape, for example, is not inherently a prohibited deepfake simply because artificial intelligence was used to create it. The more serious concerns arise when AI is used to realistically depict an identifiable person saying or doing something that never occurred, impersonate someone, deceive viewers or create other unlawful material.

The timing and quarterly nature of Google’s notice are also notable. India’s Ministry of Electronics and Information Technology says the amended rules strengthened intermediary user-awareness requirements, including requiring certain information to be provided to users at least once every three months.

The Indian government said in August that the rules are intended to combat threats associated with AI-powered deepfakes while also requiring labeling and traceable metadata for permissible AI-generated content.

Google has separately been preparing its advertising products for broader AI transparency requirements. In July, the company announced new AI labeling capabilities allowing advertisers to identify image and video creatives generated or modified using artificial intelligence. Google cited emerging AI transparency requirements in India, the European Union and New York as reasons for the change.

The quarterly email therefore appears to be less of a warning against using generative AI itself and more of a reminder that advertisers remain responsible for how synthetic media is created and used – particularly when real people, impersonation, deception or unlawful material are involved.

NEW YORK, NY – New York prosecutors have seized 12 domain names used by websites accused of selling and distributing AI-generated pornographic deepfakes depicting approximately 1,200 real people without their consent.

Manhattan District Attorney Alvin L. Bragg Jr. announced the seizures Monday, calling the action the largest known seizure of AI-generated celebrity deepfake websites to date. The domains were taken pursuant to court orders as part of an ongoing investigation by the office’s Cyber Crime Bureau.

According to prosecutors, operators and content creators used artificial intelligence tools to manipulate existing photographs and videos into realistic-looking sexual images and videos. The approximately 1,200 people depicted were overwhelmingly women and primarily public-facing individuals, including actors, politicians, athletes, musicians, social media influencers and activists.

The websites were not simply hosting AI-generated imagery. Prosecutors say they were largely dedicated to nonconsensual intimate imagery, explicitly advertising deepfake pornography and allowing such material to be published, distributed and sold.

“1,200 individuals had their faces and bodies stolen and turned into illegal pornography on 12 different websites – without their knowledge or consent,” Bragg said.

The seizure is particularly notable because authorities targeted the domain names themselves, effectively cutting off access to the websites rather than relying solely on requests to remove individual pieces of content.

WIRED independently observed several of the affected domains displaying a “THIS DOMAIN HAS BEEN SEIZED” notice before the announcement. According to the publication, some of the websites had operated for years and videos hosted on them had accumulated tens of thousands of views.

The Manhattan DA’s office has not publicly identified the 12 seized domain names. WIRED, which independently identified several of the affected sites, also withheld their names, consistent with its practice of avoiding additional exposure for websites distributing nonconsensual deepfake pornography. Prosecutors said they will continue monitoring for attempts to reappear under new domains, while the investigation into the operators and uploaders remains ongoing.

The case is aimed specifically at realistic, nonconsensual sexual deepfakes involving identifiable people, not AI-generated imagery generally. It also shows prosecutors increasingly targeting the Internet infrastructure used to distribute and monetize illegal synthetic content.

The seizures also raise a broader issue for domain registrars, hosting providers and other online infrastructure companies as governments look for more direct ways to disrupt websites built around illegal AI-generated content.

REDMOND, WA – Microsoft Advertising is eliminating the ability to set a maximum cost-per-click limit on many new advertising campaigns, another step toward automated bidding systems controlling how advertisers’ budgets are spent.

Beginning October 1, 2026, Max CPC will no longer be available when advertisers create new non-portfolio campaigns using several of Microsoft’s automated bidding strategies, including Maximize Clicks, Maximize Conversions and Maximize Conversion Value.

For advertisers, the change means giving Microsoft’s bidding system considerably more freedom to determine what an individual click is worth. A Max CPC limit traditionally allowed an advertiser to tell the platform, in simple terms: no matter what the algorithm believes a click is worth, do not bid above this amount. Microsoft argues that those limits can actually interfere with automated bidding.

The company says that when advertisers establish a Maximum CPC while simultaneously giving the system CPA or ROAS targets, the two instructions can conflict. Microsoft says this can cause campaigns to miss their broader performance objectives even when the advertiser’s CPC ceiling is higher than the campaign’s typical click cost.

Instead, Microsoft wants advertisers to control automated campaigns through budgets, target CPA, target ROAS, conversion values and other performance signals. The shift follows a broader advertising industry trend in which platforms increasingly ask advertisers to provide the objective, budget and conversion data while algorithms determine bids, placements and, increasingly, targeting.

Microsoft has been aggressively expanding that approach. Its newer AI Max search features can expand query matching beyond an advertiser’s keyword list, generate or customize ad text and select landing pages based on Microsoft’s interpretation of user intent.

That makes the removal of Max CPC particularly noteworthy. Automation may improve efficiency in some campaigns, but advertisers are simultaneously surrendering another direct spending control.

There is an important grandfather provision. Existing campaigns already using Max CPC as of October 1 can retain the setting. However, Microsoft warns that if Max CPC is subsequently removed from one of those campaigns, the advertiser will not be able to add it back. Portfolio bid strategies are also exempt. Microsoft says Max CPC will remain available for both new and existing campaigns using portfolio bidding.

The transition will extend further in 2027. According to Microsoft’s notice to advertisers, API users, third-party advertising tools and Google Import will stop supporting Max CPC for newly created campaigns, and for existing campaigns that are not already using the setting, beginning January 12, 2027.

For agencies and advertisers, the practical takeaway is simple: campaigns currently relying on Max CPC should be reviewed carefully before October 1. Once that control is removed from an existing campaign, Microsoft says the decision cannot be reversed.

For agencies and advertisers, the practical takeaway is simple: campaigns currently relying on Max CPC should be reviewed carefully before October 1. Businesses using Microsoft Advertising should also review their broader bidding strategy to make sure automated bidding is working toward the right conversion and revenue goals.

MOUNTAIN VIEW, CA – Google is changing the way AdSense counts display advertising impressions, a move the company says will bring its measurement methodology in line with industry standards but could result in publishers reporting fewer impressions. Beginning February 17, 2027, Google AdSense and Google Ad Manager will move display advertising from a “count-on-download” methodology to what Google calls “begin-to-render.”

Under the current system, an impression can be recorded when an advertisement begins downloading to a user’s device. Under the new system, the ad must successfully load and begin rendering before Google counts the impression. That distinction matters.

If a visitor opens a page and leaves before an advertisement actually begins rendering, that impression will no longer count. Google acknowledges that publishers “may notice a decrease in total display impressions” following the transition.

Google says the change brings AdSense measurement in line with standards established by the Interactive Advertising Bureau (IAB) and Media Rating Council (MRC). Begin-to-render is indeed an established industry measurement standard designed to ensure an advertisement gets further through the delivery process before being credited as an impression.

From an advertiser’s perspective, that makes sense. An advertisement that never rendered had little opportunity to be seen.

For publishers, however, it is another tightening of the measurement system surrounding an increasingly difficult business model. Website owners have already watched search engines retain more traffic, AI-generated answers compete with traditional search clicks and advertising economics become increasingly difficult for independent publishers.

Now the definition of a countable AdSense display impression is getting narrower.

Google does not require publishers to make any changes before the February transition. It does recommend that Ad Manager publishers compare their existing impressions against begin-to-render metrics to estimate how much their reported impression totals could decline.

The change does not necessarily mean publisher revenue will decline by the same percentage as reported impressions. Fewer, higher-quality counted impressions could affect CPMs and advertiser economics differently. What Google has made clear, however, is that some impressions counted today simply won’t count anymore.

For publishers who have spent years watching the web’s economics gradually shift away from the sites producing the content, that distinction probably won’t feel particularly comforting.

Sources worth linking in the article: Google AdSense: Begin-to-render impression counting and IAB Desktop Display Impression Measurement Guidelines.

SAN FRANCISCO, CA – OpenAI released GPT-6 Astra on September 3, introducing what the company calls its most intelligent and aligned AI model yet. The bigger story, however, may not be another jump in benchmark scores. Astra is increasingly designed to actually do work on a computer rather than simply tell users how to do it.

OpenAI says Astra can navigate software, browse the web, fill out forms, update customer records in a CRM, organize calendars, conduct online research, work with spreadsheets and documents, create websites, install and test software, troubleshoot problems and perform complex multi-step professional tasks. The company says Astra can also draft summaries directly in email or document editors and perform frontend quality assurance on websites and applications.

That moves ChatGPT another step away from being primarily a question-and-answer tool and toward becoming an autonomous digital worker capable of carrying out portions of everyday business operations.

The performance numbers are significant. OpenAI reports Astra scored 72.6% on OSWorld 2.0, compared with 65.7% for GPT-5.6 Sol, while completing the evaluated computer-use tasks in roughly 47% less time. OpenAI says Astra also reaches 1.9 times faster task completion than GPT-5.6 Sol on the Mind2Web benchmark when paired with improvements to its Codex computer-use system.

Astra also posted unusually high scores on several advanced evaluations. OpenAI says the model reached 98% on FrontierMath Tier 4, 99.9% on ARC-AGI-3 and 100% on ExploitBench, while setting new records across additional tests involving software engineering, scientific reasoning and professional work.

The release has also revived the debate over whether the industry is approaching artificial general intelligence, or AGI. Axios reported that OpenAI President Greg Brockman described Astra as a generational leap and said he personally believes the model may represent the beginning of the AGI era. Exactly what qualifies as AGI remains heavily debated, but the term generally refers to artificial intelligence capable of performing a broad range of intellectual tasks rather than being limited to narrowly defined functions.

For professional users, one of Astra’s more practical improvements may be its ability to produce finished work rather than just raw information. OpenAI says the model is better at following existing company templates and producing polished documents, spreadsheets and presentations that match an organization’s established style and structure.

Astra is also designed to handle ambiguity differently than earlier models. According to OpenAI, it can use context to fill in routine gaps, ask focused questions when missing information could materially change the result, continue working on portions of a task that do not require clarification and wait for human input when a consequential decision is involved.

Perhaps the most notable advancement is cybersecurity. OpenAI says GPT-6 Astra meets the company’s “Critical” cybersecurity capability threshold under its Preparedness Framework. In testing without production safeguards, Astra was able to identify and develop zero-day exploits, including two previously unknown software vulnerabilities that OpenAI says are being disclosed to the affected maintainers.

On ExploitBench, Astra achieved a perfect 100% score compared with 78.5% for GPT-5.6 Sol. OpenAI says those capabilities could help defenders discover and patch vulnerabilities faster, but they also create obvious risks if similar capabilities are misused.

Those risks are becoming a larger issue as AI systems gain more autonomy. Reuters reported that Astra arrives amid increased scrutiny over the behavior and oversight of autonomous AI agents. OpenAI has acknowledged that increasingly capable agents create new challenges around keeping systems within their intended scope and determining when automated tasks should be stopped.

OpenAI says Astra represents an improvement in that area as well. In one internal evaluation designed around whether a model would go beyond an authorized target when faced with a difficult or impossible task, GPT-5.6 Sol exceeded its intended scope 48% of the time without production safeguards. OpenAI says Astra did so in 0% of the tested cases.

Astra is rolling out first to a limited set of organizations and is expected to become available to ChatGPT Plus, Pro, Business and Enterprise users, as well as through the OpenAI API, Microsoft Azure and AWS Bedrock.

For businesses, GPT-6 Astra represents an important shift in where artificial intelligence appears to be heading. The competitive advantage may increasingly come not from employees simply asking AI better questions, but from determining which research, administrative, development, customer-service and operational workflows can be safely delegated to AI in the first place.

As these models become more capable of navigating software, making decisions and completing tasks from beginning to end, the line between an AI assistant and an AI worker is becoming increasingly difficult to define.

OpenAI’s announcement: https://openai.com/index/gpt-6-astra/

WEST PALM BEACH, FL – The FBI is investigating what could become one of the largest exposures of government-issued identification documents ever reported, after a new dark-web service began offering access to more than 153 million driver’s license scans from people in the United States and Canada.

The service, called Nexus, surfaced in late August on the Russian-language cybercrime forum Exploit. Its operators claimed to possess identity records covering more than 170 million people, including more than 153 million driver’s licenses, 10 million identification cards, 3 million travel or international identity documents and approximately 579,000 medical cards.

The numbers have not yet been independently confirmed by law enforcement. However, cybersecurity journalist Brian Krebs, who first reported the incident, found his own Virginia driver’s license among the records and subsequently checked the database for a number of other people with their permission. Nine individuals whose licenses were found reportedly confirmed that the documents were authentic.

More troubling, the database appears to contain considerably more than ordinary photographs of identification cards. Some records include images of both sides of a driver’s license along with infrared and ultraviolet scans, which are used by identity-verification systems to examine security features built into government-issued IDs.

Evidence uncovered by Krebs points toward IDScan.net, a Louisiana-based identity-verification company whose technology is used to scan and authenticate identification documents. Several people whose licenses appeared in Nexus were able to match timestamps attached to the stolen images with occasions when their licenses had been scanned, including car-rental transactions. Other evidence connected records to businesses known to have used IDScan technology.

The connection has not yet been conclusively established. IDScan.net has not publicly confirmed that its systems were breached or that all of the Nexus records originated from its network. The company said it was investigating the matter. The FBI confirmed on September 2 that it was also looking into the incident but declined further comment because of the ongoing investigation.

The operators of Nexus claimed they had been continuously extracting information from the unidentified source for more than a year. Krebs reported that the number of driver’s license records available through Nexus increased by nearly 400,000 records within approximately 24 hours, potentially indicating continuing access to whatever system supplied the data. That claim and the precise method of intrusion remain unverified.

Shortly after the incident became public, Nexus disappeared from the dark web, with its login page replaced by a message stating that the service was no longer available. That does not mean the underlying database has disappeared or that copies were not previously sold or distributed.

The incident is particularly serious because government identification information cannot be changed as easily as a compromised password or credit-card number. High-quality scans containing photographs, addresses, birth dates, license information and document security features could potentially be valuable for identity theft, fraudulent account creation and attempts to defeat identity-verification procedures.

For now, the most important unanswered questions are whether IDScan.net was actually breached, how attackers obtained access, how long that access persisted, exactly how many unique individuals are affected and whether the stolen database has already been copied or sold elsewhere.

The FBI investigation is ongoing.

WEST PALM BEACH, FL – Search Engine Journal published an article this week suggesting that JSON-LD schema is an important technical signal for AI search visibility. But controlled testing, Google’s own documentation and even Search Engine Journal’s previous reporting tell a different story.

In “The Technical Signals AI Search Uses That Most SEOs Still Aren’t Optimizing,” Search Engine Journal places JSON-LD within its “Attribution and Meaning” layer for AI readiness and describes schema as “a vital part” of how AI understands content. The article argues that giving AI greater confidence in interpreting content can increase the likelihood of that content being cited. There is certainly evidence that schema and AI citations are correlated. But there is much less evidence that schema causes those citations.

Controlled Testing Found No Citation Boost

In May, Ahrefs analyzed 6 million URLs and initially found that AI-cited pages were almost three times more likely to contain JSON-LD. That correlation doesn’t surprise me. Websites implementing schema are probably more likely to be managed by technically advanced staff, follow better SEO practices and be better-developed websites than those that don’t. No surprise there. But that doesn’t mean schema is causing the citations. Rather than assume schema was responsible, Ahrefs conducted a second study. Researchers tracked 1,885 pages that added JSON-LD and compared them with approximately 4,000 control pages.

The results:

The increases for AI Mode and ChatGPT were statistically indistinguishable from zero. Ahrefs concluded that adding schema produced no meaningful citation increase on any platform. That is an important distinction. Websites using schema may also tend to have stronger content, better technical SEO, more authority and more backlinks, however, that just means Schema can correlate with AI citations without causing them.

Search Engine Journal Already Reported This

What makes the new article particularly interesting is that Search Engine Journal reported the Ahrefs experiment itself in May under the headline: “Schema Markup Didn’t Move AI Citations In Ahrefs Test.” SEJ reported the same results: -4.6% for AI Overviews, +2.4% for AI Mode and +2.2% for ChatGPT, with no platform showing a meaningful citation increase after schema was added.

SEJ also reported another experiment from searchVIU in which five AI systems were tested during direct webpage retrieval. According to SEJ’s coverage, the systems extracted visible HTML while ignoring information contained exclusively in JSON-LD, Microdata and RDFa. SEJ correctly noted that this does not prove schema plays no role during other processes such as indexing or retrieval. It does, however, further weaken the argument that adding schema has been demonstrated to increase AI citations.

Google Says Schema Isn’t Required for AI Search

Google’s own documentation is even more explicit. (Not that I always 100% believe them), but in its official Guide to Optimizing for Generative AI Features, Google specifically warns publishers about “overfocusing on structured data.”

Google states: “Structured data isn’t required for generative AI search, and there’s no special schema.org markup you need to add.” Google’s separate documentation for AI Overviews and AI Mode similarly says publishers do not need new machine-readable files or markup to appear in these features. That doesn’t mean schema is useless. Google continues to recommend structured data as part of an overall SEO strategy because it can help pages qualify for traditional rich results. But that is a different claim from saying schema increases AI citations.

Correlation Is Not Causation

The evidence currently supports a fairly simple conclusion: Schema markup remains useful SEO, but there is no compelling experimental evidence that adding JSON-LD makes a webpage more likely to be cited by ChatGPT, Google AI Mode or AI Overviews.

Ahrefs found a correlation and then tested whether schema itself caused the increased citations. The citation benefit disappeared. Google says structured data isn’t required for generative AI search. And Search Engine Journal itself previously reported that adding schema produced no meaningful increase in AI citations.

As AI optimization develops, distinguishing between theories, correlations and experimentally demonstrated signals will become increasingly important. For now, saying schema is useful is well supported. Saying schema increases AI citations is not.

Improving content for AI visibility is one of the most talked-about and sought-after objectives in marketing right now, which makes getting the information right especially important. I found the Search Engine Journal article particularly interesting, but after examining the research behind its claims, I also found it potentially misleading. We simply don’t have room right now for narratives that turn correlations or plausible theories into established AI optimization tactics. Marketers are already being flooded with advice about how to influence AI search, much of it based on limited evidence. Before changing strategies, spending money or implementing new tactics based on claims about AI visibility, we should demand stronger evidence and, where necessary, wait for more definitive research.

One thing I did find particularly interesting in the Search Engine Journal article, and something I had not been paying enough attention to, was its discussion of AI-specific robots.txt directives. Unlike some of the more speculative AI optimization tactics being promoted today, controlling which AI crawlers can access a website has a clear technical purpose. The article also discusses the emerging llms.txt file, which I think is worth experimenting with despite its effectiveness remaining unproven. This is one area where the article prompted me to take action: I plan to more closely review AI crawler directives across our properties and begin experimenting with llms.txt.

REDMOND, WA – Microsoft is investigating a widespread Exchange Online outage Monday that is causing email delays, failed messages and authentication problems for businesses and users across the United States.

The incident, identified by Microsoft as EX1464935, is affecting Exchange Online, the cloud infrastructure behind email for millions of Microsoft 365 business customers.

Users have reported emails failing to send or arrive, Outlook connection problems, authentication errors and difficulties accessing Exchange administration tools. Downdetector recorded thousands of reports as the disruption spread Monday.

Microsoft says engineers have isolated a common failure pattern involving authentication and protocol connectivity and are reviewing service telemetry to determine the underlying source of the problem and possible remediation. The company has not yet publicly identified the root cause.

Some IT administrators have speculated that an expired or improperly renewed certificate could be involved based on errors being reported during the outage, although Microsoft has not confirmed that theory.

The outage is particularly disruptive for businesses that rely on Microsoft 365 as their primary email platform. Because the failure appears to be occurring within Microsoft’s Exchange Online infrastructure, affected companies may have little ability to resolve the problem from their own servers, networks or Outlook installations.

It also comes after several other Exchange Online disruptions this year, including a June incident that affected mail flow in multiple regions and earlier mailbox-access problems involving several Outlook platforms.

As of Monday afternoon, Microsoft had not announced an estimated time for full restoration.

WEST PALM BEACH, FL – Bill Gates has long presented artificial intelligence as a powerful tool capable of improving productivity, education and healthcare. He is now sounding considerably less optimistic about what happens to workers along the way. In a lengthy essay published on his website, the Microsoft co-founder warned that the transition to the AI era could become one of the most turbulent periods in human history. His central concern is not simply that AI will eliminate jobs, but that governments and technology companies have no meaningful plan for managing the disruption.

“On the current course and speed, there’s a very high chance of a net negative outcome,” Gates told Axios.

That represents a significant change in tone. Gates previously described AI-related job disruption as a difficult but manageable transition. He now believes AI could replace human labor much faster than earlier technologies and leave the economy with substantially fewer jobs. The threat is not limited to office workers. AI can already perform portions of jobs involving writing, research, software development, customer service and professional analysis. As robotics improves, Gates expects many blue-collar occupations to face similar pressure.

The usual response from the technology industry is that innovation eliminates some jobs while creating others. Gates is no longer convinced that history will repeat itself so neatly. Earlier technologies largely replaced physical labor while leaving human intelligence in demand. AI is being developed specifically to reproduce and eventually exceed human cognition.

Gates has proposed several ideas, including new national and international institutions to oversee advanced AI, taxes on AI systems and robots, and the creation of “human-reserved” jobs. These would be occupations society deliberately chooses to keep human, even if machines become capable of performing them. Healthcare and caregiving are obvious examples. An AI system might eventually diagnose an illness or recommend treatment more accurately than a person, but patients may still want a human doctor delivering serious news and making life-changing decisions.

Not everyone shares Gates’s outlook. Nvidia CEO Jensen Huang has repeatedly argued that AI will ultimately create jobs and increase productivity. He maintains that people are more likely to lose their positions to someone using AI than to AI itself. Huang directly rejected Gates’s latest assessment saying he expects AI to become a net creator of jobs. That debate remains unresolved, but Gates is raising a question that has received surprisingly little attention: What happens if AI eliminates jobs faster than the economy can create meaningful replacements?

One early criticism is that Gates may have the correct diagnosis but the wrong solution. An analysis published by GeekWire argues that taxing AI usage would be difficult to connect directly to employment losses. It also suggests that the first signs of displacement may not be mass layoffs, but entry-level positions that companies simply stop creating.

Technology companies are investing heavily to make AI more capable. Businesses are under pressure to use it to reduce costs and operate with fewer employees. Governments, meanwhile, are still debating basic regulations and appear poorly prepared for widespread employment displacement.

Gates is not calling for AI development to stop. He continues to believe the technology could improve lives and become a tremendous equalizer. His warning is that without serious planning, it could just as easily concentrate wealth, eliminate opportunities and create a transition far more damaging than the technology industry has been willing to admit.

WEST PALM BEACH, FL – A federal judge is questioning whether Google is using its search monopoly to take publishers’ content while sending them increasingly little traffic in return. During a hearing in Penske Media Corporation’s antitrust lawsuit against Google, U.S. District Judge Amit Mehta reportedly described the situation as “really unfair” and questioned whether Google’s AI products are being built “on the backs of the publishers.”

Penske, which publishes Rolling Stone, Variety, Billboard and The Hollywood Reporter, argues that Google uses publisher content to generate AI Overviews that answer questions directly within its search results. Those answers can eliminate much of the reason for users to visit the websites that produced the information. Google characterizes AI Overviews as an improvement to its search product. It also argues that publishers can prevent Google from using their material, although doing so may require them to surrender visibility within the world’s dominant search engine.

That is not much of a choice.

Publishers have spent decades allowing Google to crawl their websites under an understood arrangement: Google could index the material, and publishers could receive visitors in return. AI Overviews fundamentally alter that exchange. Google can now extract information, assemble its own answer and keep the user on Google. Mehta previously ruled that Google illegally maintained a monopoly in online search. He has not ruled on Google’s request to dismiss the Penske case, but his questions suggest that he is taking the publisher’s argument seriously.

The technology is new, but the strategy is not.

In 2017, I wrote about Google placing business information, definitions, answers and other website content directly inside its search results. The article, “Who Needs Domains and Websites Anyway? Google Says You’re a Loser,” warned that Google was steadily shifting from directing people to websites to becoming the destination itself. AI Overviews are the same traffic grab on a much larger scale. Google no longer needs to display one borrowed definition or business detail. It can digest information from numerous websites and produce a complete response before the user ever reaches an organic result. Google may call that product improvement.

Publishers may reasonably call it taking the value they created and using it to replace them.

For website owners, the real question is no longer whether Google will continue keeping more search traffic for itself. It is whether courts will finally decide that Google’s control over search prevents it from rewriting the publisher relationship entirely on its own terms.

WEST PALM BEACH, FL – A lead arrived through one of my client’s websites at 4:45 p.m. Within two minutes, I had reviewed the submission, checked where the visitor came from and sent the client a brief warning: “Tread carefully here.”

The inquiry concerned a government cleanup project in Burns, Oregon, but it originated from an IP address in Morocco. It included a short deadline, referenced an attached project brief and requested a quote for cleaning and restoring areas affected by a black-water overflow. At first glance, it looked like probable spam or possibly a phishing attempt.

The Visitor’s Activity Provided More Context

Because SEARCHEN NETWORKS® closely monitors website traffic and lead activity for this client, I could see what happened before the form was submitted. The visitor arrived through Google, viewed the company’s water-quality testing page, clicked an email link, checked its social media profile, returned to the website and completed the contact form. The entire session lasted slightly more than four minutes. That looked more like someone researching the business than an automated spam submission, so I investigated further.

The person named in the inquiry had a public professional profile identifying him as an operations associate for the same company named in the message. His profile placed him in Morocco and described his work as supporting U.S. federal government contracting. The foreign IP address therefore had a plausible explanation. The company also appeared legitimate. Its website described water testing, sampling and regulatory-compliance services, as well as experience working with federal agencies.

The Government Project Was Real

Most importantly, the underlying project existed. Public contracting records showed an active Bureau of Land Management opportunity for water-contamination cleanup and restoration at the Wild Horse and Burro Corrals in Burns, Oregon. The published scope closely matched the inquiry, including cleanup of contaminated areas, sanitization of furniture, workplace safety controls and restoration work. The opportunity was identified as solicitation 140L4326Q0111, and a public listing confirmed that it was active. The earlier deadline supplied by the sender may simply have been an internal deadline for collecting subcontractor quotes before the company submitted its own proposal.

Why Hands-On Lead Monitoring Matters

My original warning was still appropriate. The client should independently verify the sender and use caution with unexpected attachments. However, the inquiry should not be discarded solely because it came from another country. What initially looked like spam may have been a legitimate subcontracting opportunity. This is where hands-on lead monitoring provides value. Many marketing companies consider their work finished once a form reaches the customer’s inbox. I typically review and respond to my clients’ leads within five minutes, particularly when something unusual deserves their attention.

SEARCHEN NETWORKS® offers lead generation services supported by traffic monitoring, lead tracking and experienced oversight. In this case, the client received an immediate warning, followed by the additional information needed to make a better decision about the opportunity.

WEST PALM BEACH, FL – More than a decade ago, the Internet was supposedly about to change forever. ICANN opened the floodgates to hundreds of new generic top-level domains, or gTLDs. Instead of relying primarily on familiar extensions such as .com, .net and .org, businesses would have seemingly endless alternatives: .guru, .agency, .solutions, .club, .online, .technology and hundreds more.

The first new gTLDs were delegated in 2013. ICANN called it the largest expansion of the Domain Name System in history and promoted the program as a way to increase competition, innovation and consumer choice. More than 12 years later, we have had plenty of time to judge the results. Consumers largely didn’t care.

Twelve Years Later, .COM Is Still .COM

New gTLDs certainly attracted registrations, and legitimate businesses operate on them. But they never fundamentally changed consumer behavior. People still expect .com. Businesses still covet good .com domains. Companies still pay substantial amounts to acquire them. As of June 30, 2026, approximately 166.6 million .com domains were registered.

The market has had more than a decade to vote, and it largely kept voting for .com. Yet here we go again. ICANN opened another application round for new gTLDs on April 30, 2026. The application window closed August 12, meaning another collection of new extensions will eventually be making its way onto the Internet. Some will have legitimate uses, particularly branded extensions controlled by large corporations and specialized geographic or community domains.

But another round of generic alternatives? We’ve seen this movie before.

What About .AI?

There is one extension that seems to contradict this argument: .ai. AI domains have exploded. Technology companies want them. Startups use them. Investors speculate on them. Premium .ai domains can command enormous prices. There’s just one problem. .AI isn’t a new gTLD. In fact, it isn’t a generic top-level domain at all.

.ai is the country-code top-level domain for Anguilla, the small British Overseas Territory in the Caribbean. It was delegated in 1995, almost two decades before the new-gTLD expansion. Its success has nothing to do with ICANN creating another clever alternative to .com. Anguilla simply happened to own two letters that became extraordinarily valuable.

Artificial intelligence exploded. AI became one of the defining technology trends of our time. Companies suddenly wanted to identify themselves with those two letters, and demand for .ai domains took off. The marketplace created the demand. ICANN didn’t. And that may be the most revealing part of the entire new-domain-extension experiment.

You Can Create an Extension. You Can’t Create Demand.

Nobody had to convince technology companies that “AI” meant something. Nobody had to spend a decade teaching consumers what it represented. The world changed, the letters became valuable, and an obscure country-code extension suddenly became one of the hottest domain extensions on the Internet. Compare that with hundreds of intentionally created new gTLDs that have been available for more than a decade. You can manufacture an extension. You cannot manufacture the public’s desire to use it. That is why .ai isn’t evidence that the new-gTLD concept worked. It’s evidence of the opposite.

The most notable alternative-domain success story of the current Internet era wasn’t created by the new-gTLD program at all. It was a decades-old geographic country code that got extraordinarily lucky when its two letters became synonymous with the biggest technology boom in years.

And Now More Are Coming

ICANN received 1,930 applications during its original 2012 new-gTLD round. Hundreds of new extensions ultimately entered the Internet’s domain-name system. They expanded the namespace. They created businesses for registry operators. They gave domain registrars more inventory to sell. What they didn’t do was knock .com off its throne or fundamentally change the way consumers think about Internet addresses. Twelve years is enough time to know that.

Perhaps this new round will produce some genuinely useful extensions. Branded domains in particular can serve legitimate purposes. But if we’re about to hear once again that the Internet desperately needs another mountain of generic domain extensions because all the good .com names are gone, we’ve heard that argument before. The irony is difficult to miss.

After more than a decade of deliberately creating hundreds of new domain extensions, one of the biggest alternative-extension success stories is .ai – a 31-year-old (1995) country-code domain belonging to a tiny Caribbean island. Sometimes the market has a way of making the decision for us.

WASHINGTON – Microsoft is updating its Services Agreement governing consumer online products and services, with revised terms taking effect September 30, 2026. Among the changes are updated provisions addressing Microsoft Copilot and other AI-powered services, along with revisions reflecting changes across the company’s consumer products.

Microsoft began notifying customers of the update by email, telling users the changes are intended to make its terms clearer, improve transparency and account for new products, services and features. The Microsoft Services Agreement applies to consumer services covered by the agreement rather than generally governing Microsoft’s enterprise and organizational customers.

Copilot and AI Services Get Additional Attention

One of the more notable areas of the updated agreement involves Microsoft Copilot. Microsoft says it has renamed and revised the Copilot section to clarify which versions of Copilot are governed by the consumer Services Agreement. This distinction has become increasingly important as Microsoft incorporates Copilot across consumer, business and enterprise products that may operate under different agreements.

The agreement also contains specific provisions governing Microsoft’s AI services. Among other restrictions, users may not attempt to reverse engineer AI models or extract underlying components, weights or other model information. Microsoft also restricts certain uses of data from its AI services for creating, training or improving other AI systems. The terms additionally address Microsoft’s processing and storage of information submitted to and generated by AI services, including for monitoring and preventing abusive or harmful uses.

Other Microsoft Services Are Being Updated

The September update extends beyond artificial intelligence. According to Microsoft’s summary of changes, the company has revised language involving automatic software updates, updated Microsoft 365 product terminology, removed outdated references to services including Cortana and Groove, and made changes involving the Microsoft Rewards program.

Microsoft also revised introductory language describing the products, websites and services covered by the agreement. Many of the changes appear to be clarifications or updates reflecting Microsoft’s evolving product lineup rather than major changes to how customers use its services.

Continued Use Constitutes Agreement

Microsoft says customers who continue using covered products and services on or after September 30, 2026 will be agreeing to the updated Services Agreement. Customers who do not agree with the new terms can discontinue using the affected products and services and close their Microsoft account before the changes become effective. The company is giving customers roughly two months between publication of the revised agreement and its effective date.

For most Microsoft users, the update is unlikely to produce an immediate noticeable change. However, the expanded attention given to Copilot and AI services demonstrates how artificial intelligence is increasingly becoming a formal part of the legal agreements governing everyday consumer technology.

WASHINGTON – Amazon has updated the legal terms governing U.S. customers, reinstating mandatory arbitration for most disputes and adding a class-action waiver that generally requires customers to pursue claims individually. The changes took effect August 14, 2026, and apply to Amazon’s general Conditions of Use and Amazon Prime Terms & Conditions. They are aimed primarily at ordinary Amazon customers, not specifically members of the Amazon Associates affiliate program or third-party sellers, which operate under separate agreements.

What Changed

Under the new terms, most customer disputes must first go through a required pre-arbitration process. If the matter is not resolved, it generally proceeds through individual arbitration rather than a lawsuit before a judge or jury. Amazon continues to allow qualifying disputes to be filed in small claims court and says it will pay most arbitration costs. The agreement also includes a class-action waiver, meaning customers generally cannot combine covered claims into a traditional class-action lawsuit.

Amazon also revised its choice-of-law provisions. Washington State law will continue to govern most disputes, while certain personal injury and property damage claims will instead be governed by the law of the state where the injury or damage occurred.

Amazon Previously Abandoned Arbitration

The change is particularly notable because Amazon has been through this before. Amazon previously required individual arbitration but dropped the requirement in 2021 after attorneys representing Echo and Alexa users reportedly filed roughly 75,000 individual arbitration demands. That created a costly problem for Amazon. Instead of defending one class-action lawsuit, the company faced tens of thousands of separate arbitration proceedings and potentially substantial arbitration fees. Amazon responded by removing mandatory arbitration from its consumer terms and directing disputes to state or federal courts in King County, Washington. Now, roughly five years later, Amazon has brought arbitration back.

The New Terms Address Mass Arbitration

The updated agreement appears designed to prevent a repeat of the 2021 situation. According to Reuters, the new terms establish special procedures when 25 or more similar arbitration demands are filed within a six-month period. Those cases may be treated as a “Mass Arbitration” and handled through procedures that include grouping cases into batches. That provision is significant because the earlier arbitration system became expensive for Amazon when large numbers of customers used it simultaneously.

Existing Lawsuits Are Excluded

Amazon says the new arbitration agreement does not apply to litigation already pending before August 14, 2026. For future disputes, however, Amazon is establishing arbitration as the default process for most covered customer claims. The company also told customers that continued use of Amazon services constitutes acceptance of the updated Conditions of Use.

What This Means for Customers

For most Amazon customers, the change will have no effect on everyday shopping or use of Prime services. Its importance becomes apparent when a serious dispute arises. Amazon customers who continue using the service are now being told that most future claims must be handled through individual arbitration rather than conventional court litigation, while class actions are generally prohibited. The broader story is that Amazon has returned to an arbitration system it abandoned five years ago, this time with new provisions aimed directly at handling large numbers of similar claims.