First .xxx domain name prices revealed

New .xxx domain name registrations could retail for as much as $158 a year, a markup of almost $100 over the wholesale registry fee, it has emerged.
Key-Systems, one of the first registrars approved to sell .xxx names, plans to charge €92.44 ($133), or €110.00 ($158) including VAT, per name per year during general availability.
The prices were revealed on the German company’s consumer-facing web site, DomainDiscount24.com.
ICM Registry’s wholesale fee is $60 per year. Excluding VAT, Key-Systems stands to make a whopping $73 margin on .xxx domains.
For comparison, the registrar’s margin on .com domains is less than $10.
Prices for trademark holders that wish to register .xxx names defensively will be even higher.
In the first sunrise period, reserved for porn companies with trademarks, the company will charge a non-refundable application fee of €134.95 ($194), plus €130.90 ($188) per name per year.
In a second sunrise, which “grandfathers” registrants of porn domains in other TLDs, domains will cost €95.20 ($137) in non-refundable application fees, with the same again for the first year’s registration.
If you’re a non-porn trademark holder, and you want to block your brand from the .xxx namespace – say you’re Disney and you want disney.xxx permanently reserved – it will cost €450 ($648).
That’s a “one-time fee”, but it’s not yet clear how many years it covers for 10 years, which works out to €45 per year.
Landrush fees, for non-trademark holders, will be €80 ($115) per application, non-refundable, plus €95 ($137) per domain per year.
Key-Systems is the first registrar to disclose its pricing plans. It’s possible other registrars will offer lower (or, I suppose, higher) prices.

Go Daddy checkout charity raises $20k for Haiti

Go Daddy’s quietly launched “Round Up For Charity” scheme has so far raised over $20,000 for the Hope For Haiti appeal, according to the company.
The month-old initiative gives the domain name registrar’s customers the option to round their bill up to the nearest dollar when they buy a product on its web site. The proceeds go to the charity.
With a new .com costing $12.17, that works out to a $0.83 donation every time somebody checks the box. With that in mind, $20,000 works out to the equivalent of about 24,000 registrations.
I was expecting more, given how much business passes though Go Daddy’s site every day, but I guess not all donations will be as high as $0.83, and not everybody will check the box (there really is no excuse for not checking the box).
It’s a pretty cool idea, a good example of how a company can leverage scale to do some good in the world. Haiti could use all the help it can get at the moment.
Company CEO Bob Parsons has also promised to match his customers’ donations dollar for dollar, according to a press release. He’s also uploaded a video of a recent trip to Haiti here.

ICM adds another .xxx registrar

DomainMonster has become the latest registrar, the first in the UK, to announce support for ICM Registry’s upcoming .xxx porn-only top-level domain.
The company said it has been accredited by ICM, and that it will start taking pre-orders for the domains on its Domainbox reseller platform soon.
Others registrars to have announced that they plan to carry .xxx domains over the last few months include Network Solutions, Blacknight, EnCirca, RRPProxy.net and United Domains.
I’m not sure if any have been officially accredited yet — no .xxx registrars show up on ICANN’s offical list.
DomainMonster CEO Matt Mansell said: “We anticipate the .XXX launch to be the biggest we’ve seen in recent years. The demand our support teams are seeing already far outstrips anything that’s gone before.”
ICM has previously projected somewhere between 300,000 and 500,000 registrations after launch. It took around 600,000 pre-reservations in the few years before it was approved by ICANN.
Getting .xxx accrediation is said to be quite a lengthy process. Registrars have to answer 14 detailed questions, including agreeing to abide by ICM’s policies and detailing how they plan to promote the domains.

Registrar threatened over “stolen” Facebook domain

ICANN has threatened to terminate the domain name registrar EuroDNS for failing to transfer a typo domain lost in a UDRP case to Facebook.
But EuroDNS says it is subject to a court case in its home country, Luxembourg, which has prevented it handing over the name.
The original registrant of facebok.com lost a slam-dunk UDRP case back in September 2010. He didn’t even bother defending the case.
But over half a year later, he’s still in control of the domain, and he’s using it to recruit folk into a shady-looking (but probably legal) subscription text messaging service.
EuroDNS is the registrar of record for the domain, and like all registrars is responsible for transferring domains lost under the UDRP to the winning party, in this case Facebook.
ICANN’s compliance department – my guess is under pressure from Facebook – has therefore threatened EuroDNS with termination unless it hands over the domain in the next three weeks.
This is noteworthy because EuroDNS isn’t the kind of tiny, fringe outfit ICANN usually files compliance notices against. It’s a generally respectable business. It even shows up to ICANN meetings.
EuroDNS deputy general counsel Luc Seufer tells me that the company was fully prepared to transfer the domain – it had even sent the authorization codes to Facebook – but it found itself on the receiving end of a lawsuit claiming that the domain had been “stolen”.
Somebody in Luxembourg, it seems, has sued to reclaim an obvious typo domain that’s probably going to be transferred to Facebook anyway.
“We are therefore in an incredible position where if we transfer the name before the judge’s ruling we will be accountable in our own country and if we don’t transfer the name we are in breach of the [Registrar Accreditation Agreement],” said Seufer.
The Luxembourg case has not yet made it to court, hence EuroDNS’s delay, he said. ICANN is aware of the action, and has seen the court papers, he said.
According to ICANN’s breach notice (pdf), the only way for EuroDNS to avoid its obligation under the UDRP is to show proof that the original registrant has sued Facebook to keep the domain.
But the case in question was filed by a third party claiming to be the rightful owner of the domain, not the original registrant. EuroDNS seems to be trapped between a rock and a hard place.
Seufer said the company is prepared to hand over the domain, adding:

Should we simply ignore a judiciary court case against us in our own country – that could prevent us from operating the transfer since it is was asked of the judge – because of our RAA’s obligations?

The domain in question, facebok.com, currently redirects to a series of sites asking visitors to fill in a survey to win a Mac.
Those who are duped by it are actually signing up to a text service that costs, in the UK, £4.50 ($7.40) per week.

Namecheap poaches 20,000 domains from Go Daddy

A protest promo launched after Go Daddy CEO Bob Parsons came under fire for shooting an elephant appears to have netted Namecheap about 20,000 domain name transfers.
The company tweeted from its official account last night: “Thank you Namecheap customers, new and old! We have raised $20,433 to savetheelephants.org. We appreciate your support!”
Given Namecheap had offered to donate $1 for every domain transferred using a special $4.99 coupon code, it looks like it received 20,433 transfers over the last week.
Parsons won’t lose any sleep over this. Go Daddy’s domains under management ticks up by the same amount every five hours.
It may be a more significant amount for Namecheap, which says it has over a million domains under its belt.
UPDATE: As Adam Strong notes in the comments, the 20,000 domains did not necessarily all come from Go Daddy, as the offer was open to anybody.

NetSol to alert cops over domain hijacking

Network Solutions intends to “notify the proper authorities” after a high-profile customer had his account hijacked over the weekend.
Stephen Toulouse, head of policy and enforcement for Microsoft’s Xbox LIVE, lost access to stepto.com, including his web site and email, for several hours yesterday, after a disgruntled teenaged gamer persuaded a member of NetSol’s support staff to hand over the account.
In a statement published on its blog, the domain name registrar said it was an “isolated incident directed at a specific customer account”, adding:

We maintain a well developed processes to ensure that Social Engineering attempts or any identified security concerns are immediately alerted to a Supervisor, who will expedite the investigation, usually with the help of the Network Solutions Security team. In this case, the procedure was not followed, and we apologize for any trouble caused to our customer.
Our Security team continues to investigate this matter. Additionally, because we take this matter very seriously, we intend to notify the proper authorities with the evidence that we have gathered, so that they may investigate the person(s) responsible for the fraud.

According to a new YouTube video released by the person claiming responsibility for the attack, “Predator”, he’s 15. He blamed Toulouse for his frequent Xbox LIVE bannings.
While he said he perpetrated the attack to highlight insecurities in Xbox LIVE, he also offered to hijack other gamers’ accounts for up to $250.
Comments posted in response to his first post-attack video claim to reveal his true identity, but of course comments on YouTube are not what you’d call reliable evidence.
The video itself does reveal a fair bit of information, however, so I can’t imagine tracking him down will be too difficult, especially if Microsoft has his parents’ credit card number on file.
His YouTube channel also has videos of him operating a botnet. That’s a whole lot more serious.

Xbox security chief gets domain hijacked

The head of Xbox Live policy and enforcement at Microsoft has had his domain name compromised by a disgruntled gamer using a social engineering attack on Network Solutions
Stephen Toulouse, who goes by the screen name “Stepto” and has the domain stepto.com, seems to have also lost his email, hosting and, as a result, his Xbox Live account.
He tweeted earlier today: “Sigh. please be warned. Network solutions has apparently transferred control of Stepto.com to an attacker and will not let me recover it.”
Somebody claiming to be the attacker has uploaded a video to YouTube showing him clicking around Toulouse’s Xbox account, whilst breathlessly describing how he “socialed his hosting company”.
It’s a bit embarrassing for Toulouse. He was head of communications for Microsoft Security Response Center for many years, handling comms during worm outbreaks such as Blaster and Slammer.
Now at Xbox Live, he is, as the attacker put it, “the guy who’s supposed to be keeping us safe”.
But it’s probably going to be much more embarrassing for Network Solutions. When the tech press gets on the story tomorrow, difficult questions about NSI’s security procedures will no doubt be asked.
Toulouse has already made a few pointed remarks about the company on his Twitter feed today.
Social engineering attacks against domain name registrars exploit human, rather than technological, vulnerabilities, involving calling up tech support and trying to convince them you are your victim.
In this case, hijacking the domain seems to have been a means to control Toulouse’s email account, enabling the attacker to reset his Xbox Live password and take over his “gamer tag”.
The same technique was used to compromise the Chinese portal Baidu.com, that time via Register.com, in late 2009. That resulted in a lawsuit, now settled.
The attacker, calling himself Predator, was apparently annoyed that Toulouse had “console banned” him 35 times, whatever that means.
He seems to have left a fair bit of evidence in his wake, and he appears to be North American, so I expect he’ll be quite easy to track down.
Predator’s video, which shows the immediate aftermath of the attack, is embedded below. It may not be entirely safe for work, due to some casually racist language.
UPDATE (April 5): The video has been removed due to a “violation of YouTube’s policy on depiction of harmful activities”. I snagged a copy before it went, so if anybody is desperate to see it, let me know.

Go Daddy CEO catches flak for “elephant snuff film”

Bob Parsons has come in for criticism for a recent video diary in which he headed to Zimbabwe to hunt elephant.
A petition launched yesterday at Change.org, entitled “Tell Go Daddy’s CEO: Real Men Don’t Kill Elephants” has attracted over 400 signatures.
The petition describes Parsons’ video as “basically a gruesome, 4-minute elephant snuff film”.
You can watch it here, if you can stomach the AC/DC soundtrack, photos of Parsons grinning over the corpse, and the scene where dozens of Zimbabweans (many wearing Go Daddy baseball caps) greedily tear up the elephant’s carcass.
The justification presented in the video is that “problem” elephants have been destroying crops, putting farmers’ livelihoods at risk.
The petitioner says there are better, more humane ways of dealing with the problem.
I expect this kind of PR plays well to the NASCAR crowd. To desk-bound, liberal-elite media, city-boy vegetarians such as myself, less so.

Go Daddy employee class action dismissed

A class action lawsuit alleging that Go Daddy committed “wage theft”, filed by a disgruntled former call center worker, has been dismissed by an Arizona court.
While the plaintiffs have been given leave to amend their complaint, they’ve parted ways with their lawyers after a disagreement, which suggests the case may be on shaky ground.
I reported on the filing of the suit for The Register last May, and followed it up with a tangential blog post here.
The lead plaintiff, Toby Harris, claims he was fired after just a couple of months as a Go Daddy sales/support call center guy after he questioned why some of his commissions had been withheld.
His manager had apparently rated his work below a certain performance threshold, meaning he lost out on over $1,300 of bonuses in his first month. Harris said this was arbitrary and unfair.
He was then fired after, according to his termination letter, breaking security protocol by failing to sufficiently validate a customer’s identity. Harris said he was fired because he was a “whistleblower”.
Four other former Go Daddy employees are named plaintiffs in the class action, which alleges that by treating commissions as discretionary bonuses, Go Daddy has avoided paying its call center staff legally owed overtime wages.
But a few weeks ago, the judge in the District Court where the case is being heard dismissed the complaint (pdf) on the grounds that it did not assert enough facts to support its claims.
While the judge gave plaintiffs the opportunity to re-file the complaint, their lawyers evidently decided it was not worth it. They withdrew from the case.
Judging by a court filing the lawyers made last week (pdf), and several claims made by Harris on the gripe site NoDaddy.com, it was not an amicable split. Harris now seems to be looking for replacement attorneys to file an amended complaint before time runs out.
The thread on the NoDaddy forum devoted to the class action is extraordinary. Started in May last year, it’s grown to over 1,600 posts, the majority of which are rants written by Harris, often addressing Go Daddy CEO Bob Parsons directly and in personal terms.

Demand Media says Google change no big deal, yet

Demand Media has said that recent changes to Google’s search engine algorithm does not appear to have had a material impact on its business.
Google said yesterday that it has changed its code to demote “sites which are low-value add for users, copy content from other websites or sites that are just not very useful”.
This was widely interpreted as being designed to hit “content farms”, which make up one of Demand’s major revenue streams. The company also owns number two domain registrar eNom.
In a blog post, published less than four hours after Google announced the change, Demand executive vice president Larry Fitzgibbon wrote:

As might be expected, a content library as diverse as ours saw some content go up and some go down in Google search results… It’s impossible to speculate how these or any changes made by Google impact any online business in the long term – but at this point in time, we haven’t seen a material net impact on our Content & Media business.

It remains to be seen if the changes will have any impact on traffic and revenue at Demand, which recently executed an IPO, but Fitzgibbon played down the company’s focus on search traffic.
Demand also measures success based on metrics such as direct navigation, repeat visits and traffic from social media, he wrote.