Tucows revenue rockets after Enom buy

Tucows saw its revenue from domain names more than double in the second quarter, following the acquisition of rival Enom.
The company this week reported domain services revenue for the three months ending June 30 of $62.8 million, compared to $28.4 million a year ago.
That was part of overall growth of 78%, with revenue rising from $47.2 million in 2016 to $84.2 million this year.
Net income for the quarter was up 29% at $5.2 million.
Enom, which Tucows bought from Rightside for $76.7 million earlier this year, now accounts for a little under half of Tucows’ wholesale domains business, the larger portion going through its OpenSRS channel.
Sales from Tucows’ premium portfolio rose to $968,000 from $885,000 a year ago.
Its retail business, Hover, did $7.6 million of revenue, up from $3.6 million.

GoDaddy domains business grows 15% in Q2

GoDaddy saw its revenue from domain name sales increase by almost 15% in the second quarter, the company announced this week.
Its domains revenue was $263.3 million, up 14.6% on the same quarter last year.
That was part of an overall growth trend at the company, which saw revenue for the quarter up 22.3% at $557.8 million.
Revenue growth would have been a point higher but for currency fluctuations. GoDaddy now does about a third of its business outside its native US, helped a deal by its acquisition of Host Europe Group, which closed at the start of the quarter.
Net income for the period was $18.1 million, reversing a loss of $11.1 million a year ago.
Domains account for about 47% of overall revenue at the company.
GoDaddy said it had 17 million customers at the end of the quarter, June 30, adding about a million organically compared to a year earlier and 1.6 million from the HEG acquisition.
At the end of the quarter, the company had $591.2 million in cash and equivalents and debt of $3 billion.

GoDaddy flips hosting business for $456 million

GoDaddy has sold off its recently acquired PlusServer business for €397 million ($456 million).
The buyer is a private equity firm, BC Partners.
The registrar had taken control of the business when it spent $1.79 billion on Host Europe Group earlier this year, but had said from the start that the asset was for sale.
PlusServer sells hosting to larger companies, which have more demanding support needs that small-business-focused GoDaddy is accustomed to dealing with.
The unit was bringing in annual revenue approaching $100 million per year.
GoDaddy said it planned to put the proceeds of the flip towards paying off some loans.

Over 750 domains hijacked in attack on Gandi

Gandi saw 751 domains belonging to its customers hijacked and redirected to malware delivery sites, the French registrar reported earlier this month.
The attack saw the perpetrators obtain Gandi’s password for a gateway provider, which it did not name, that acts as an intermediary to 34 ccTLD registries including .ch, .se and .es.
The registrar suspects that the password was obtained by the attacker exploiting the fact that the gateway provider does not enforce HTTPS on its login pages.
During the incident, the name servers for up up to 751 domains were altered such that they directed visitors to sites designed to compromise unpatched computers.
The redirects started at 0804 UTC July 7, and while Gandi’s geeks had reversed the changes by 1615 it was several more hours before the changes propagated throughout the DNS for all affected domains.
About the theft of its password, Gandi wrote:

These credentials were likewise not obtained by a breach of our systems and we strongly suspect they were obtained from an insecure connection to our technical partner’s web portal (the web platform in question allows access via http).

It’s not clear why a phishing attack, which would seem the more obvious way to obtain a password, was ruled out.
Gandi posted a detailed timeline here, while Swiss registry Switch also posted an incident report from its perspective here. An effected customer, which just happened to be a security researcher, posted his account here.
Gandi says it manages over 2.1 million domains across 730 TLDs.

ICANN expects to lose 750 registrars in the next year

ICANN is predicting that about 750 accredited registrars will close over the next 12 months due to the over-saturation of the drop-catching market.
ICANN VP Cyrus Namazi made the estimate while explaining ICANN’s fiscal 2018 budget, which is where the projection originated, at the organization’s public meeting in South Africa last week.
He said that ICANN ended its fiscal 2017 last week with 2,989 accredited registrars, but that ICANN expects to lose about 250 per quarter starting from October until this time next year.
These almost 3,000 registrars belong to about 400 registrar families, he said.
By my estimate, roughly two thirds of the registrars are shell accreditations under the ownership of just three companies — Web.com (Namejet and SnapNames), Pheenix, and TurnCommerce (DropCatch.com).
These companies lay out millions of dollars on accreditation fees in order to game ICANN rules and get more connections to registries — mainly Verisign’s .com.
More connections gives them a greater chance of quickly registering potentially valuable domains milliseconds after they are deleted. Drop-catching, in other words.
But Namazi indicated that ICANN’s cautious “best estimate” is that there’s not enough good stuff dropping to justify the number of accreditations these three companies own.
“With the model we have, I believe at the moment the total available market for these sought-after domains that these multifamily registrars are after is not able to withstand the thousands of accreditations that are there,” he said. “Each accreditation costs quite a bit of money.”
Having a registrar accreditation costs $4,000 a year, not including ICANN’s variable and transaction fees.
“We think the market has probably gone beyond what the available market is,” he said.
He cautioned that the situation was “fluid” and that ICANN was keeping an eye on it because these accreditations fees have become material to its budget in the last few years.
If the three drop-catchers do start dumping registrars, it would reveal an extremely short shelf life for their accreditations.
Pheenix upped its registrar count by 300 and DropCatch added 500 to its already huge stable as recently as December 2016.

GoDaddy launches security service after Sucuri acquisition

GoDaddy has revealed the first fruits of its March acquisition of web security service provider Sucuri.
It’s GoDaddy Website Security, what appears to be a budget version of the services Sucuri already offers on a standalone basis.
For $6.99 per month ($83.88/year), the service monitors your web site for malware and removes it upon request. It also keeps tabs on major blacklists to make sure you’re not being blocked by Google, Norton or McAfee.
This low-end offering gets you a 12-hour response time for the cleanup component. You can up that to 30 minutes by taking out the $299.99 per year plan.
The more expensive plan also includes DDoS protection, a malware firewall and integration with a content delivery network for performance.
There’s also an intermediate, $19.99-per-month ($239.88/year) plan that includes the extra features but keeps the response time at 12 hours.
An SSL certificate is included in the two more-expensive packages.
The pricing and feature set looks to compare reasonably well with Sucuri’s standalone products, which start at $16.66 a month and offer response times as fast as four hours.
As somebody who has suffered from three major security problems on GoDaddy over the last decade or so, and found GoDaddy’s response abysmal on all three occasions (despite my generally positive views of its customer service), the new service is a somewhat tempting proposition.

Zero registrars pass ICANN audit

Some of the biggest names in the registrar game were among a bewildering 100% that failed an ICANN first-pass audit in the latest round of random compliance checks.
Of the 55 registrars picked to participate in the audit, a resounding 0 passed the initial audit, according to data released today.
Among them were recognizable names including Tucows, Register.com, 1&1, Google and Xin Net.
ICANN found 86% of the registrars had three or more “deficiencies” in their compliance with the 2013 Registrar Accreditation Agreement.
By far the most problematic area was compliance with sections 3.7.7.1 to 3.7.7.12 of the RAA, which specifies what terms registrars must put in their registration agreements and how they verify the contact details of their customers.
A full three quarters of audited registrars failed on that count, according to ICANN’s report (pdf).
More than half of tested registrars failed to live up to their commitments to respond to reports of abuse, where they’re obliged among other things to have a 24/7 contact number available.
There was one breach notice to a registrar as a result of the audit, but none of the failures were serious enough for ICANN to terminate the deficient registrar’s contract. Two registrars self-terminated during the process.
ICANN’s audit program is ongoing and operates in rounds.
In the current round, registrars were selected from those which either hadn’t had an audit in a couple of years, were found lacking in previous rounds, or had veered dangerously close to formal breach notices.
The round kicked off last September with requests for documents. The initial audit, which all registrars failed, was followed by a remediation phase from January to May.
Over the remediation phase, only one third of the registrars successfully resolved all the issues highlight by the audit. The remainder issued remediation plans and will be followed up on in future rounds.
The 0% pass rate is not unprecedented. It’s the same as the immediately prior audit (pdf), which ran from May to October 2016.

Web.com in takeover talks – report

Web.com is in talks to be acquired by private equity firms, according to a report.
Reuters reported last night that the registrar said the talks were “early stage” and that there was no guarantee of a deal.
Web.com is of course home to Network Solutions, Register.com and is involved in secondary market plays SnapNames and NameJet.
The company had 2016 revenue of $710 million and a market capitalization prior to the report of $1.1 billion. Its shares surged on the news.

After price hike, now Tucows drops support for Uniregistry TLDs

Tucows is to drop OpenSRS support for nine Uniregistry gTLDs after the registry announced severe price increases.
The registrar told OpenSRS resellers that it will no longer support .audio, .juegos, .diet, .hiphop, .flowers, .guitars, .hosting, .property and .blackfriday from September 8, the date the increases kick in.
It’s the second major registrar, after GoDaddy, to drop support for Uniregistry TLDs in the wake of the pricing news.
“The decision to discontinue support for these select TLDs was made to protect you and your customers from unknowingly overpaying in a price range well beyond $100 per year,” OpenSRS told its resellers.
It will continue to support seven other Uniregistry gTLDs, including .click and .link, which are seeing more modest price increases and will remain at $50 and under.
While Tucows is a top 10 registrar in most affected TLDs, its domains under management across the nine appears to be under 3,000.
These domains will expire at their scheduled expiry date and OpenSRS will not allow their renewal after the September 8 cut-off. Customers will be able to renew at current prices for one to 10 years, however.
Tucows encouraged its roughly 40,000 resellers to offer to migrate their customers to other TLDs.
Uniregistry revealed its price increases in March, saying moving to a premium-pricing model was necessary to make the gTLDs profitable given the lack of volume.
Pricing for .juegos and .hosting is to go up from under $20 retail to $300. The other seven affected gTLDs will increase from the $10 to $25 range to $100 per year.
After GoDaddy pulled support for Uniregistry TLDs, the registry modified its plan to enable all existing registrations to renew at current prices.
That clearly was not enough for Tucows, which has sent a pretty clear message that it’s not prepared to be the public face of such significant price hikes.

MarkMonitor tells .feedback to take a hike after “breach” claim

MarkMonitor is to voluntarily terminate its registrar relationship with Top Level Spectrum after the .feedback registry hit it with a breach of contract notice.
Troy Fuhriman, director of domain management at the registrar, told DI today that the company has just sent TLS a letter stating that it no longer wishes to sell .feedback names.
TLS earlier this month accused MarkMonitor of breaking the terms of its Registry-Registrar Agreements by leaking details of that agreement to media outlets including yours truly.
While TLS CEO Jay Westerdal told DI that an apology from MarkMonitor would be enough to make the termination threat go away, MarkMonitor has clearly decided against that route.
“We’re going to terminate all accreditation agreements for .feedback,” he said. “In part it’s a response to ICANN’s finding that Top Level Spectrum violated its Pubic Interest Commitments, and what we believe is a retaliatory breach notification from them.”
MarkMonitor and a small posse of high-profile clients including Facebook recently won a Public Interest Commitment Dispute Resolution Policy complaint against .feedback, related to the transparency of its launch policies and pricing.
It was in that complaint that MarkMonitor released details contained in the RRA that TLS deemed to be confidential.
Terminating the agreement means that MarkMonitor will no longer be able to sell .feedback names as a registrar and will have to transfer its existing registrations to a different registrar.
Not many clients are affected. MarkMonitor had only 45 .feedback domains under management at the last count (which was still enough to make it the fourth-largest independent .feedback registrar).
Most of these domains will be moved to 101domain, which with fewer than 200 domains is still the leading .feedback registrar.
UPDATE: Westerdal says that MarkMonitor was in fact terminated on Monday. Neither party claims that MarkMonitor made any effort to comply with the breach notice by apologizing.