Breaking: Go Daddy was not attacked

Go Daddy’s outage last night was caused by an internal cock-up and not an attack.
The official line is that the downtime, which many reports had attributed to an Anonymous attack, was actually caused by “a series of internal network events that corrupted router data tables”.
The company, whose customers suffered from four to six hours of downtime yesterday, just issued the following statement:

Go Daddy Site Outage Investigation Completed
Yesterday, GoDaddy.com and many of our customers experienced intermittent service outages starting shortly after 10 a.m. PDT. Service was fully restored by 4 p.m. PDT.
The service outage was not caused by external influences. It was not a “hack” and it was not a denial of service attack (DDoS). We have determined the service outage was due to a series of internal network events that corrupted router data tables. Once the issues were identified, we took corrective actions to restore services for our customers and GoDaddy.com. We have implemented measures to prevent this from occurring again.
At no time was any customer data at risk or were any of our systems compromised.
Throughout our history, we have provided 99.999% uptime in our DNS infrastructure. This is the level our customers expect from us and the level we expect of ourselves. We have let our customers down and we know it.
We take our business and our customers’ businesses very seriously. We apologize to our customers for these events and thank them for their patience.
– Scott Wagner
Go Daddy Interim CEO

I reported earlier today that the incident bore many of the hallmarks of a DDoS attack, but that’s clearly now proven to be incorrect.

What the hell happened to Go Daddy last night?

Thousands — possibly millions — of Go Daddy customers suffered a four-hour outage last night, during a suspected distributed denial of service attack.
The company has not yet revealed the cause of the downtime, which started at 1725 UTC last night, but it bears many of the signs of DDoS against the company’s DNS servers.
During the incident, godaddy.com was inaccessible. DI hosts with Go Daddy; domainincite.com and secureserver.net, the domain Go Daddy uses to provide its email services, were both down.
The company issued the following statement:

At 10:25 am PT, GoDaddy.com and associated customer services experienced intermittent outages. Services began to be restored for the bulk of affected customers at 2:43 pm PT. At no time was any sensitive customer information, such as credit card data, passwords or names and addresses, compromised. We will provide an additional update within the next 24 hours. We want to thank our customers for their patience and support.

Several Go Daddy sites I checked remained accessible from some parts of the world initially, only to disappear later.
Others reported that they were able to load their Go Daddy webmail, but that no new emails were getting through.
This all points to a problem with Go Daddy’s DNS, rather than with its hosting infrastructure. People able to view affected sites were likely using cached copies of DNS records.
Close to 34 million domains use domaincontrol.com, Go Daddy’s primary name server, for their DNS. The company says it has over 10 million customers.
Reportedly, Go Daddy started using Verisign’s DNS for its home page during the event, which would also point to a DNS-based attack.
The outage was so widespread that the words “GoDaddy” and “DNS” quickly became trending topics on Twitter.
The web site downforeveryoneorjustme.com, which does not use Go Daddy, also went down as thousands of people rushed to check whether their web sites were affected.
Some outlets reported that Anonymous, the hacker group, had claimed credit for the attack via an anonymous (small a) Twitter account.
Companies the size of Go Daddy experience DDoS attacks on a daily basis, and they build their infrastructure with sufficient safeguards and redundancies to handle the extra traffic.
This leads me to believe that either yesterday’s attack was either especially enormous, or that somebody screwed up.
The fact that the company has not yet confirmed that external malicious forces were at work is worrying.
Either way it’s embarrassing for Go Daddy, which is applying for three new gTLDs which it plans to self-host.
Several reports have already speculated that the attack could be revenge for one or more of Go Daddy’s recent PR screw-ups.
The company has promised an update later today.

Key-Systems adds parking API to RRPproxy

Top-ten registrar KeyDrive has delivered on a major piece of integration work following the merger of Key-Systems and NameDrive last year.
Key-Systems today announced that its RRPproxy reseller platform now has API commands that enable its resellers — and in turn their registrants — to easily park domains with NameDrive.
The new commands allow entire domain portfolios to be parked in bulk, according to the company.
Key-Systems and NameDrive formed KeyDrive in July 2011. The company also acquired Moniker and SnapNames earlier this year.

Delinquent top 20 registrar not delinquent after all

China’s largest domain name registrar isn’t shirking its ICANN fees, despite previous allegations to the contrary.
Xin Net, which has over 1.6 million gTLD domains under management, received a breach notice from ICANN last month which stated that the company was $2,000 in arrears with its payments.
The company was given until August 22 to correct the problem or risk losing its accreditation.
But in a subsequent compliance notice ICANN admitted that “due to an error the registrar’s account reflected a delinquent balance”.
The admission was buried deep in the notice and not immediately obvious to anyone browsing ICANN’s compliance pages.
The original notice also alleged a breach of the Inter-Registrar Transfer Policy with respect to the domain names rongzhu.net, qsns.net and zuixincn.com, which was not an error.
ICANN posts breach notices to its web site fairly regularly — 84 of them since mid-2008 — and more often than not they allege failure to pay fees in addition to other problems.

Go Daddy: 6% chance somebody else wants that available reg-fee domain too

If you’ve found an available, unregistered domain name, there’s at least a 6% chance that somebody else has also found it that very same day, according to Go Daddy.
More than 6% customer searches for available domain names are performed by more than one person each day, head of product development Richard Merdinger said in a blog post.
According to Merdinger, due to the sheer volume of searches, “more than six percent of customer searches for available domain names are performed by more than one person each day.”
The post, which was written in response to a single highly questionable allegation of “front-running”, added:

This overlap in domain name requests happens every day. As unique as customers believe their domain name ideas are, there’s more “innovation collision” than many people realize. With so many domain name registrations happening every day, there is a good probability a domain name you searched for is also being searched by someone else.

He also publishes some anonymized log data to prove his point.
There are tens of millions of domain searches on Go Daddy every day, apparently.

Go Daddy opens Indian call center — a portent?

Let’s hope this isn’t the beginning of the end for Go Daddy.
When newly installed CEO Warren Adelman abruptly quit and took a back-seat advisory role at the company last week, my gut reaction was that all is not well at Go Daddy.
CEOs of companies with new owners don’t just up and quit eight months into the job unless there are performance problems or substantial disagreements about management style, in my view.
Adelman was replaced on an interim basis by Scott Wagner of Go Daddy’s main investor, the private equity firm Kohlberg Kravis Roberts & Co.
The news a couple of days later that KKR had appointed a new exec to oversee Go Daddy in India also caught my attention.
I was half tempted to write a post there and then speculating that Go Daddy was about to shift its flagship customer service operations — currently based in the US — to India.
While that news hasn’t arrived yet, the company has today confirmed that it has opened a call center in Hyderabad.
Today, the new facility appears to be limited to supporting Indian customers, according to a press release:

A team of local agents, who speak local languages, are now providing Go Daddy’s brand of award-winning customer service to Indian customers. Since opening a little more than one month ago, agents have taken more than 10,000 calls, mostly from entrepreneurs and business owners. To date, Go Daddy India now supports more than 120,000 customers.

But for how long will this be true?
Private equity firms exist to buy companies, make them more profitable, and flip them for a return on their investment. That usually means cutting costs in unpopular ways.
With the new owners in charge, I have to wonder if Go Daddy’s excellent US-based call centers — a constant source of bragging rights in the Bob Parsons era — are at risk.
It’s a lot more expensive to hire wage-slaves in Arizona than India.
I expect that decision will come down to whether Go Daddy starts to view its American call centers as a cost center, rather than a profit center, and whether it thinks it can ship the function overseas without sacrificing quality and alienating its US and other English-speaking customers.
Shipping jobs to cheaper climes might look like a no-brainer on paper, but there’s ample opportunity for #fail in this case.
If, of course, it ever happens. This article is pure speculation.

Tiny Russian registrar gets canned

ICANN is to terminate a Russian registrar’s accreditation.
Name For Name Inc, which was given a breach notice last month, is being shut down for basically failing to act as a registrar.
Verisign had already cut off its .com/.net registrar contract and the company was not managing names, providing Whois, or doing any of the other things registrars are supposed to.
Under normal circumstances, a termination sees a mass transfer of all the domains under management to a nominated registrar, but in Name For Name’s case I can’t see that happening.
The company only had five gTLD domain names under management, according to the latest count.
Its accreditation will be terminated September 6.
ICANN also this week issued a breach notice to Visesh Infotecnics (Signdomains.com), apparently as the result of a badly handled domain name hijacking.

Verisign demands 24/7 domain hijacking support

Verisign is causing a bit of a commotion among its registrar channel by demanding 24/7 support for customers whose .com domains have been hijacked.
The changes, we understand, are among a few being introduced into Verisign’s new registry-registrar agreement for .com, which coincides with the renewal of its registry agreement with ICANN.
New text in the RRA states that: “Registrar shall, consistent with ICANN policy, provide to Registered Name Holders emergency contact or 24/7 support information for critical situations such as domain name hijacking.”
From the perspective of registrants, this sounds like a pretty welcome move: who wouldn’t want 24/7 support?
While providing around the clock support might not be a problem for the Go Daddies of the world, some smaller registrars are annoyed.
For a registrar with a small headcount, perhaps servicing a single time zone, 24/7 support would probably mean needing to hire more staff.
Their annoyance has been magnified by the fact that Verisign seems to be asking for these new support commitments without a firm basis in ICANN policy, we hear.
The recently updated transfers policy calls for a 24/7 Transfer Emergency Action Contact — in many cases just a staff member who doesn’t mind being hassled about work at 2am — but that’s meant to be reserved for use by registrars, registries and ICANN.

Thomson Reuters buys MarkMonitor

Thomson Reuters has acquired the corporate brand-protection registrar MarkMonitor for an undisclosed sum.
MarkMonitor will be absorbed into its new owner’s Intellectual Property & Science business unit, giving it a ready-made and pretty strong domain name management capability.
San Francisco-based MarkMonitor has almost 700,000 domain names in gTLDs under management and says it has over half of the Fortune 100 as clients and over 400 employees.
Thomson Reuters is one of the world’s leading providers of business information with annual revenue approaching $14 billion.
As an aside, I predicted back in October 2011 that MarkMonitor was about ready to be acquired, based on the consolidation trend in the industry. It took a little longer than I expected.

Go Daddy tones down the sex for Olympics ads

Go Daddy CEO Warren Adelman recently promised a less salacious image for the company, and its new commercial, set to air in the US during the London 2012 Olympics, delivers.
Kinda.
The attractive female spokemodel is still in attendance, but she’s matched up with a data center geek stereotype. The idea is to show that the company is not just a pretty face. Or something.
It’s all very self-conscious.

Unless it’s nothing more sophisticated than a “beaver” joke, the otter reference went completely over my head.
UPDATE: A reader speculates that the otter may be a high-brow reference to the Leonardo painting Lady With An Ermine.
According to Wikipedia, the ermine (a stoat) may be intended to symbolize purity, despite the fact that the subject of the painting is believed to be the 16-year-old mistress of Leonardo’s employer.