Inside Yemen's Captured .YE Namespace: What the Data Shows

FreeTheDotYE publishes this corpus to document how Yemen’s national Internet identity is administered, commercialized, and used inside a telecom system captured by the Houthi militia.

IANA lists TeleYemen as the .YE manager. Sohobcom publicly sells .YE, .com.ye, .net.ye, and .org.ye registrations, and the Houthi-run SABA outlet identifies Sohobcom as a TeleYemen subsidiary and TeleYemen’s chief executive as its board chair. The data below preserves the historical namespace and exposes the technical relationships that make this captured and monetized system visible.

Executive summary

  • The public corpus preserves 1,489 registrable domains and 4,724 historical hostnames. Historical and inactive names remain included, so absence from current DNS does not erase their documentary value.
  • Clean registration signals cover 1,377 domains. The export is deduplicated and excludes personal contacts, entity cards, provider links, and raw responses; 112 historical domains remain without a clean registration row.
  • The higher-quality August 25, 2026 baseline snapshot checked 5,106 hostnames. Of those, 3,616 had tracked records present, 1,166 returned NXDOMAIN, 293 had no tracked records, and 31 remained unobserved. Two post-query discoveries expanded the catalog to 5,108 and were included in the following automated run.
  • Sohobcom is institutionally and technically part of the captured .YE system. It markets .YE registration and hosting, is publicly identified as a TeleYemen subsidiary, and its authority or mail infrastructure intersects 327 domains in our corpus.

A historical record of a captured national namespace

The base corpus is designed for historical continuity. A listed name may now be active, inactive, undelegated, expired, or reassigned. These figures describe retained records, not an official registry zone.

MeasureCount
Registrable domains1,489
Base-corpus hostnames4,724
Clean registration rows1,377
Domains without a clean registration row112

Public suffix distribution

Shares use all 1,489 registrable domains as the denominator. Percentages are rounded.

Public suffixDomainsShare
com.ye77351.91%
gov.ye23315.65%
ye20013.43%
edu.ye1318.80%
org.ye865.78%
net.ye614.10%
hospital.ye20.13%
law.ye10.07%
school.ye10.07%
uni.ye10.07%

What this shows: com.ye accounts for just over half of the retained domains. Government and direct-under-.ye registrations together account for another 29.08%. The captured registry layer reaches commercial, governmental, educational, civil-society, and direct-under-.ye names alike, regardless of who operates an individual website.

The August 25 DNS baseline separates records from historical inclusion

The public monitoring catalog extends the 4,724-hostname historical corpus with 384 confirmed DNS-derived hostnames, for 5,108 catalog entries. The August 25 baseline checked 5,106 hostnames; its two post-query discoveries expanded the catalog to 5,108 and were included in the following automated run. Public snapshot information is reduced to calendar-day precision.

DNS status on August 25, 2026

Shares use the 5,106 hostnames checked in this baseline snapshot as the denominator and may not total exactly 100% after rounding.

StatusHostnamesShareInterpretation
Records present3,61670.82%At least one tracked DNS value is present.
NXDOMAIN1,16622.84%The queried hostname did not exist in DNS for this state.
No tracked records2935.74%A definitive response contained none of the tracked values.
Unobserved310.61%No confirmed DNS state is available.

August 25 baseline run-quality and change indicators

IndicatorCountMeaning
Hostnames checked5,106Hostnames queried during this baseline snapshot.
Definitive checks5,027Checks that produced a state suitable for comparison.
Inconclusive checks79Checks not treated as definitive state changes.
Hostnames pending confirmation45Candidate changes waiting for repeat confirmation.
Confirmed changes in this baseline0No candidate change met the monitor’s repeat-confirmation rule in the baseline snapshot.
New DNS discoveries2Names found after the baseline query stage; they expanded the catalog to 5,108 and were included in the following automated run.

A later August 26 validated run covered all 5,108 catalog entries with 5,032 definitive results (98.51%) and 76 inconclusive results. It passed the publication gate, produced one confirmed address change, and updated the public day-precision monitor; the tables above remain the August 25 baseline for consistent comparison.

Why this matters: DNS state answers a different question from historical inclusion. NXDOMAIN and no-record states support monitoring and follow-up, but neither should be used alone to declare that a registrable domain is currently unregistered.

Sohobcom: monetizing and extending the captured .YE ecosystem

Sohobcom is not merely an unrelated provider discovered in DNS. Its own website sells .ye, .com.ye, .net.ye, and .org.ye registrations. Houthi-run SABA identifies it as a TeleYemen subsidiary and identifies TeleYemen’s chief executive as its board chair. Against that documented corporate relationship, the 327 authority and mail intersections below show how widely the same infrastructure reaches across our observed corpus.

Sohobcom namespace records

This table presents normalized public state for the apex and retained hostnames below it.

HostnameA recordMail, authority, or role
sohobcom.ye185.112.201.30MX 5 gateway.sohobcom.ye; NS sah1.ye, sah2.ye, and sah3.ye; SOA authority sah1.ye.
www.sohobcom.ye185.112.201.30Namespace hostname sharing the apex address.
gateway.sohobcom.ye195.94.15.12Mail target used by the apex.
cp.sohobcom.ye195.94.23.17MX 10 cp.sohobcom.ye.
host.sohobcom.ye195.94.23.13MX 10 host.sohobcom.ye.

Exact authority and mail target records

TargetRoleAAAAA
gateway.sohobcom.yeApex mail target195.94.15.12
sah1.yeNameserver and SOA authority195.94.0.342a02:e280:8:d000::34
sah2.yeNameserver195.94.0.352a02:e280:8:d000::35
sah3.yeNameserver195.94.8.352a02:e280:8:d100::35

Operational reach across the corpus

IntersectionDomainsEvidence in the public state
Authority or mail target intersection327314 intersect sah1.ye, sah2.ye, and sah3.ye; 6 intersect sah1.ye and sah2.ye; 7 intersect sah1.ye only.
Direct Sohobcom target-host reference2alnasserexchange.com.ye references host.sohobcom.ye; e-moit.gov.ye references cp.sohobcom.ye.
Shared Sohobcom apex address0No corpus-domain apex shared 185.112.201.30 in this public state.

Accountability finding: The DNS relationships do not mean Sohobcom owns every affected domain. They establish a narrower but material fact: hundreds of observed .YE domains depend on authority or mail infrastructure connected to a company that sells .YE registrations and is publicly identified as a TeleYemen subsidiary. Every .YE name, regardless of retail channel, remains under the TeleYemen-managed registry captured by Houthi authorities.

Why this evidence matters

A country-code domain is a public national resource, not a militia’s commercial or political asset. Under the current arrangement, .YE supplies official-looking addresses to Houthi propaganda and military-facing platforms while Yemen’s internationally recognized government and independent institutions are pushed onto substitute domains. Sohobcom adds a commercial registration, hosting, mail, and cloud layer to the same captured telecom system. Monitoring the namespace therefore documents both digital state capture and the infrastructure through which it is normalized and monetized.

Our purpose

FreeTheDotYE preserves this evidence so journalists, researchers, rights groups, and Internet-governance bodies can see changes that would otherwise disappear. The corpus includes inactive and historical names because accountability requires a record, not only a snapshot. We call on ICANN and IANA to review .YE against the trustee obligations of RFC 1591 and move it to a neutral, time-limited operator that serves the whole Yemeni Internet community. Read our correspondence and support the campaign.

Caveats

  • This is not an official registry zone and is not a complete list of every name ever registered under .ye.
  • A domain’s presence in the corpus does not mean its registrant supports the Houthis. The dataset documents a captured administrative system, not a blanket accusation against domain holders.
  • Registration lifecycle values may be stale; personal and contact data are excluded.
  • Detailed dataset identities, acquisition order, and historical collection timestamps are withheld for collector safety. This limits independent reproduction.
  • DNS is time-sensitive. The public view is day-precision, and an NXDOMAIN response is not by itself proof that a registrable domain is unregistered.
  • Post-query discoveries enter the catalog immediately but do not have a queried state until the following run.
  • The monitor is limited to normalized DNS state and does not perform application-security testing.

Evidence basis

This report uses only public corpus, registration-summary, DNS-state, and Sohobcom-infrastructure data from the sanitized FreeTheDotYE .YE domain repository and the separate privacy-minimized RDAP / WHOIS repository, including its v1.1.0 release.

The control and corporate context is sourced separately from DNS: the IANA root-zone record, the campaign’s formal correspondence with IANA, earlier campaign article, Sohobcom investigation on X, Sohobcom’s own Yemeni-domain storefront, and the SABA report identifying Sohobcom as a TeleYemen subsidiary.

The 219 archived homepage responses are available in the WARC v1 release, including a verified release bundle.