Inside Yemen's Captured .YE Namespace: What the Data Shows

Wed, 26 Aug 2026 00:00:00 +0000
FreeTheDotYE publishes this corpus to document how Yemen’s national Internet identity is administered, commercialized, and used inside a telecom system captured by the Houthi militia.</p>
IANA lists TeleYemen as the .YE</code> manager</a>. Sohobcom publicly sells .YE</code>, .com.ye</code>, .net.ye</code>, and .org.ye</code> registrations</a>, and the Houthi-run SABA outlet identifies Sohobcom as a TeleYemen subsidiary and TeleYemen’s chief executive as its board chair</a>. The data below preserves the historical namespace and exposes the technical relationships that make this captured and monetized system visible.</p>

Open the sanitized .YE domain dataset</a></li>
Open the privacy-minimized RDAP / WHOIS dataset</a></li>
Open the WARC v1 release</a></li>
</ul>
Executive summary</h2>

The public corpus preserves 1,489 registrable domains and 4,724 historical hostnames.</strong> Historical and inactive names remain included, so absence from current DNS does not erase their documentary value.</li>
Clean registration signals cover 1,377 domains.</strong> The export is deduplicated and excludes personal contacts, entity cards, provider links, and raw responses; 112 historical domains remain without a clean registration row.</li>
The higher-quality August 25, 2026 baseline snapshot checked 5,106 hostnames.</strong> Of those, 3,616 had tracked records present, 1,166 returned NXDOMAIN, 293 had no tracked records, and 31 remained unobserved. Two post-query discoveries expanded the catalog to 5,108 and were included in the following automated run.</li>
Sohobcom is institutionally and technically part of the captured .YE</code> system.</strong> It markets .YE</code> registration and hosting, is publicly identified as a TeleYemen subsidiary, and its authority or mail infrastructure intersects 327 domains in our corpus.</li>
</ul>
A historical record of a captured national namespace</h2>
The base corpus is designed for historical continuity. A listed name may now be active, inactive, undelegated, expired, or reassigned. These figures describe retained records, not an official registry zone.</p>
Measure</th> Count</th></tr></thead>

Registrable domains</td> 1,489</td></tr>
Base-corpus hostnames</td> 4,724</td></tr>
Clean registration rows</td> 1,377</td></tr>
Domains without a clean registration row</td> 112</td></tr>
</tbody></table>
Public suffix distribution</h3>
Shares use all 1,489 registrable domains as the denominator. Percentages are rounded.</p>
Public suffix</th> Domains</th> Share</th></tr></thead>

com.ye</code></td> 773</td> 51.91%</td></tr>
gov.ye</code></td> 233</td> 15.65%</td></tr>
ye</code></td> 200</td> 13.43%</td></tr>
edu.ye</code></td> 131</td> 8.80%</td></tr>
org.ye</code></td> 86</td> 5.78%</td></tr>
net.ye</code></td> 61</td> 4.10%</td></tr>
hospital.ye</code></td> 2</td> 0.13%</td></tr>
law.ye</code></td> 1</td> 0.07%</td></tr>
school.ye</code></td> 1</td> 0.07%</td></tr>
uni.ye</code></td> 1</td> 0.07%</td></tr>
</tbody></table>
What this shows:</strong> com.ye</code> accounts for just over half of the retained domains. Government and direct-under-.ye</code> registrations together account for another 29.08%. The captured registry layer reaches commercial, governmental, educational, civil-society, and direct-under-.ye</code> names alike, regardless of who operates an individual website.</p>
The August 25 DNS baseline separates records from historical inclusion</h2>
The public monitoring catalog extends the 4,724-hostname historical corpus with 384 confirmed DNS-derived hostnames, for 5,108 catalog entries. The August 25 baseline checked 5,106 hostnames; its two post-query discoveries expanded the catalog to 5,108 and were included in the following automated run. Public snapshot information is reduced to calendar-day precision.</p>
DNS status on August 25, 2026</h3>
Shares use the 5,106 hostnames checked in this baseline snapshot as the denominator and may not total exactly 100% after rounding.</p>
Status</th> Hostnames</th> Share</th> Interpretation</th></tr></thead>

Records present</td> 3,616</td> 70.82%</td> At least one tracked DNS value is present.</td></tr>
NXDOMAIN</td> 1,166</td> 22.84%</td> The queried hostname did not exist in DNS for this state.</td></tr>
No tracked records</td> 293</td> 5.74%</td> A definitive response contained none of the tracked values.</td></tr>
Unobserved</td> 31</td> 0.61%</td> No confirmed DNS state is available.</td></tr>
</tbody></table>
August 25 baseline run-quality and change indicators</h3>
Indicator</th> Count</th> Meaning</th></tr></thead>

Hostnames checked</td> 5,106</td> Hostnames queried during this baseline snapshot.</td></tr>
Definitive checks</td> 5,027</td> Checks that produced a state suitable for comparison.</td></tr>
Inconclusive checks</td> 79</td> Checks not treated as definitive state changes.</td></tr>
Hostnames pending confirmation</td> 45</td> Candidate changes waiting for repeat confirmation.</td></tr>
Confirmed changes in this baseline</td> 0</td> No candidate change met the monitor’s repeat-confirmation rule in the baseline snapshot.</td></tr>
New DNS discoveries</td> 2</td> Names found after the baseline query stage; they expanded the catalog to 5,108 and were included in the following automated run.</td></tr>
</tbody></table>
A later August 26 validated run covered all 5,108 catalog entries with 5,032 definitive results (98.51%) and 76 inconclusive results. It passed the publication gate, produced one confirmed address change, and updated the public day-precision monitor</a>; the tables above remain the August 25 baseline for consistent comparison.</p>
Why this matters:</strong> DNS state answers a different question from historical inclusion. NXDOMAIN and no-record states support monitoring and follow-up, but neither should be used alone to declare that a registrable domain is currently unregistered.</p>
Sohobcom: monetizing and extending the captured .YE ecosystem</h2>
Sohobcom is not merely an unrelated provider discovered in DNS. Its own website sells .ye</code>, .com.ye</code>, .net.ye</code>, and .org.ye</code> registrations. Houthi-run SABA identifies it as a TeleYemen subsidiary and identifies TeleYemen’s chief executive as its board chair. Against that documented corporate relationship, the 327 authority and mail intersections below show how widely the same infrastructure reaches across our observed corpus.</p>
Sohobcom namespace records</h3>
This table presents normalized public state for the apex and retained hostnames below it.</p>
Hostname</th> A record</th> Mail, authority, or role</th></tr></thead>

sohobcom.ye</code></td> 185.112.201.30</code></td> MX 5 gateway.sohobcom.ye</code>; NS sah1.ye</code>, sah2.ye</code>, and sah3.ye</code>; SOA authority sah1.ye</code>.</td></tr>
www.sohobcom.ye</code></td> 185.112.201.30</code></td> Namespace hostname sharing the apex address.</td></tr>
gateway.sohobcom.ye</code></td> 195.94.15.12</code></td> Mail target used by the apex.</td></tr>
cp.sohobcom.ye</code></td> 195.94.23.17</code></td> MX 10 cp.sohobcom.ye</code>.</td></tr>
host.sohobcom.ye</code></td> 195.94.23.13</code></td> MX 10 host.sohobcom.ye</code>.</td></tr>
</tbody></table>
Exact authority and mail target records</h3>
Target</th> Role</th> A</th> AAAA</th></tr></thead>

gateway.sohobcom.ye</code></td> Apex mail target</td> 195.94.15.12</code></td> —</td></tr>
sah1.ye</code></td> Nameserver and SOA authority</td> 195.94.0.34</code></td> 2a02:e280:8:d000::34</code></td></tr>
sah2.ye</code></td> Nameserver</td> 195.94.0.35</code></td> 2a02:e280:8:d000::35</code></td></tr>
sah3.ye</code></td> Nameserver</td> 195.94.8.35</code></td> 2a02:e280:8:d100::35</code></td></tr>
</tbody></table>
Operational reach across the corpus</h3>
Intersection</th> Domains</th> Evidence in the public state</th></tr></thead>

Authority or mail target intersection</td> 327</td> 314 intersect sah1.ye</code>, sah2.ye</code>, and sah3.ye</code>; 6 intersect sah1.ye</code> and sah2.ye</code>; 7 intersect sah1.ye</code> only.</td></tr>
Direct Sohobcom target-host reference</td> 2</td> alnasserexchange.com.ye</code> references host.sohobcom.ye</code>; e-moit.gov.ye</code> references cp.sohobcom.ye</code>.</td></tr>
Shared Sohobcom apex address</td> 0</td> No corpus-domain apex shared 185.112.201.30</code> in this public state.</td></tr>
</tbody></table>

Accountability finding:</strong> The DNS relationships do not mean Sohobcom owns every affected domain. They establish a narrower but material fact: hundreds of observed .YE</code> domains depend on authority or mail infrastructure connected to a company that sells .YE</code> registrations and is publicly identified as a TeleYemen subsidiary. Every .YE</code> name, regardless of retail channel, remains under the TeleYemen-managed registry captured by Houthi authorities.</p>
</blockquote>
Why this evidence matters</h2>
A country-code domain is a public national resource, not a militia’s commercial or political asset. Under the current arrangement, .YE</code> supplies official-looking addresses to Houthi propaganda and military-facing platforms while Yemen’s internationally recognized government and independent institutions are pushed onto substitute domains. Sohobcom adds a commercial registration, hosting, mail, and cloud layer to the same captured telecom system. Monitoring the namespace therefore documents both digital state capture and the infrastructure through which it is normalized and monetized.</p>
Our purpose</h2>
FreeTheDotYE preserves this evidence so journalists, researchers, rights groups, and Internet-governance bodies can see changes that would otherwise disappear. The corpus includes inactive and historical names because accountability requires a record, not only a snapshot. We call on ICANN and IANA to review .YE</code> against the trustee obligations of RFC 1591 and move it to a neutral, time-limited operator that serves the whole Yemeni Internet community. Read our correspondence</a> and support the campaign</a>.</p>
Caveats</h2>

This is not an official registry zone and is not a complete list of every name ever registered under .ye</code>.</li>
A domain’s presence in the corpus does not mean its registrant supports the Houthis. The dataset documents a captured administrative system, not a blanket accusation against domain holders.</li>
Registration lifecycle values may be stale; personal and contact data are excluded.</li>
Detailed dataset identities, acquisition order, and historical collection timestamps are withheld for collector safety. This limits independent reproduction.</li>
DNS is time-sensitive. The public view is day-precision, and an NXDOMAIN response is not by itself proof that a registrable domain is unregistered.</li>
Post-query discoveries enter the catalog immediately but do not have a queried state until the following run.</li>
The monitor is limited to normalized DNS state and does not perform application-security testing.</li>
</ul>
Evidence basis</h2>
This report uses only public corpus, registration-summary, DNS-state, and Sohobcom-infrastructure data from the sanitized FreeTheDotYE .YE domain repository</a> and the separate privacy-minimized RDAP / WHOIS repository</a>, including its v1.1.0 release</a>.</p>
The control and corporate context is sourced separately from DNS: the IANA root-zone record</a>, the campaign’s formal correspondence with IANA</a>, earlier campaign article</a>, Sohobcom investigation on X</a>, Sohobcom’s own Yemeni-domain storefront</a>, and the SABA report identifying Sohobcom as a TeleYemen subsidiary</a>.</p>
The 219 archived homepage responses are available in the WARC v1 release</a>, including a verified release bundle</a>.</p>
 


When a Militia Owns a Country’s Domain: The Strange Case of .YE
Wed, 24 Sep 2025 00:00:00 +0000
 Imagine waking up and finding that your country’s online identity-its .uk</strong> or .fr</strong>-wasn’t run by a trusted national registry anymore, but by an armed militia.
That is our reality in Yemen.</p>
Since the Houthis took Sana’a in 2014, they have held not only the capital, but also the keys to Yemen’s digital space. The state telecom TeleYemen, which runs both the main ISP (YemenNet) and the .YE</strong> domain, fell into their hands. Overnight, the online identity of an entire country was captured.</p>
Today, every .gov.ye</code>, .edu.ye</code>, and .net.ye</code> is effectively under militia control. Ministries of the internationally recognized government are forced to operate on awkward domains like mofa-ye.org</code>, while the Houthis occupy the official state address at mofa.gov.ye</code>.</p>
And the worst part? ICANN and IANA know this.</strong> They have been aware for years, yet nothing has changed.</p>

A Domain Forged into a Weapon</h3>
This is no longer theoretical. The hijacked .YE domain is an active weapon used to build a digital ghost state.</p>
The Houthis established a website at hocc.gov.ye</code>, posing as a “Humanitarian Operations Coordination Center.” From this official-looking government domain, they issue military directives, manage “sanctions lists” for international shipping, and state that vessels violating their “ban” will be subject to “military targeting.”</strong></p>
It’s a digital extortion racket with a .gov.ye</code> address.</p>
The infrastructure is also primed for cyber warfare. We found twitter.com.ye</code> configured with live mail servers pointing to Houthi-controlled infrastructure-a purpose-built phishing machine waiting to impersonate a global platform.</p>
This isn’t just about websites. It’s about the weaponization of trust.</p>

The Human Cost of Digital Capture</h3>
This digital control has lethal consequences on the ground.</p>
The same captured institutions running .gov.ye</code> domains oversee Yemen’s health sector. In 2022, dozens of children with leukemia died in a Sana’a hospital after being given expired drugs. The tragedy was traced directly to a supply chain overseen by these Houthi-run agencies.</p>
In Yemen, we have grown accustomed to crises being managed behind closed doors. Even international organizations stayed silent for years about their own kidnapped staff. This very lack of transparency is what has enabled the militia. To speak, to write, even to celebrate Yemen’s National Day is a risk. Yet ICANN still treats .YE as business as usual.</p>

A Decade of Failure: Why Nothing Changed</h3>
Why has a problem this obvious been ignored for ten years? Because the system meant to fix it is broken.</p>
Yemen’s crisis has been defined by a failed model: a disconnected government-in-exile and an advocacy industry often focused on funding cycles, not tangible results. When leaders left the country and continued to collect salaries abroad, accountability collapsed.</p>
This system of failure is why a straightforward problem like the hijacked .YE domain has been ignored since 2015. Defending Yemen’s digital sovereignty was sidelined in favor of a model focused on securing salaries and grants, not on achieving tangible results.</p>

ICANN’s Choice: Complicity</h3>
If militias can capture a ccTLD and the world shrugs, it tells every armed group: take the city, and you get the domain too.</em></p>
ICANN has acted before: it redelegated Somalia’s .SO</strong> during state collapse. So why is .YE</strong> left untouched?</p>
Their official response to our formal request gives the answer: they see it as a “local issue”</strong> of “equity, justice, [and] honesty.” They are using bureaucratic procedure to avoid moral responsibility. But inaction is a precedent too. It means legitimizing digital state capture.</p>

What We Demand</h3>
#FreeDotYE is a direct rejection of this failed model.</strong> We are volunteers, not a project seeking funding. Our work is for our home, for our generation, and for the future of a free internet in Yemen and beyond.</p>
We are not asking ICANN to pick sides in Yemen’s war. We are asking it to uphold its own rules, based on Jon Postel’s RFC 1591</strong>: a ccTLD manager must be a trustee</strong> for the entire</em> national community.</p>
Our demands are clear:</p>

Review .YE now</strong> under the ccNSO Framework of Interpretation.</li>
Follow the established path for an absent manager: “Revocation followed by Delegation.”</strong></li>
Place .YE under a neutral, time-limited trustee</strong> to serve all Yemenis until a legitimate government can assume control.</li>
</ol>

Join Us</h3>

Read our full correspondence with IANA: freethedotye.org/correspondence/</a></li>
Sign and circulate the petition: change.org/FreeTheDotYE</a></li>
Pressure ICANN, rights groups, and technical communities to acknowledge the hijacking of .YE.</li>
</ul>

Final Word</h3>
For us Yemenis, this is not abstract. Our voices are censored, our colleagues are kidnapped, our flag is banned. Even our country’s domain has been stolen.</p>
The question is not just whether Yemen gets its name back.</em></p>
The question is whether the internet’s rules mean anything when the guns are louder.</em></p>