GoDaddy hack exposed a million customer passwords

GoDaddy’s systems got hacked recently, exposing up to 1.2 million customer emails and passwords.

The attack started on September 6 and targeted Managed WordPress users, the company’s chief information security officer Demetrius Comes disclosed in a blog post and regulatory filing this week.

The compromised data included email addresses and customer numbers, the original WordPress admin password, the FTP and database user names and passwords, and some SSL private keys.

In cases where the compromised passwords were still in use, the company said it has reset those passwords and informed its customers. The breached SSL certs are being replaced.

GoDaddy discovered the hack November 17 and disclosed it November 22.

It sounds rather like the attack may have been a result of a phishing attack against a GoDaddy employee. The company said the attacker used a “compromised password” to infiltrate its WordPress provisioning system.

Comes wrote in his blog post:

We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection

You may recall that GoDaddy came under fire last December for punking its employees with a fake email promising an end-of-year bonus, which turned out to be an “insensitive” component of an anti-phishing training program.

About 500 staff reportedly failed the test.

Comment Tagged: godaddy, hack, phishing, security, wordpress

EURid to drop 48,000 Brexit domains in one day

All the .eu domain names formerly belonging to Brits and UK residents will be released for registration on a first-come, first-served basis in one day, EURid announced today.

There are about 48,000 of them, and they’ll be released in batches starting at 0900 UTC on January 3, two days later than the previously announced date, the registry said.

The names all belonged to UK registrants that lost their eligibility when the country left the EU in January last year.

There were almost 300,000 .eu domains registered in the UK at the time of the Brexit referendum in 2016. Most have since dropped or been transferred to EU-based entities or EU citizens that still qualify.

Comment Tagged: .eu, brexit, eurid

Google to release another new gTLD next month

Google Registry is gearing up to unleash another gTLD from its stockpile of unreleased strings next month.

The gTLD is .day, one of over 100 that Google applied for in 2012 after a reported brainstorming session at the company.

According to its application:

The specialization goal of the proposed gTLD is to offer a new Internet environment that allows users to create and organize events that have or will occur on a particular day. The proposed gTLD will provide a single domain name hierarchy for Internet users globally to promote celebrations, such as a holi.day, wedding.day, or birth.day.

With that in mind, it’s difficult to see .day being a high-volume TLD along the lines of Google’s popular .app or .dev gTLDs.

While the company itself doesn’t seem to have addressed the launch publicly, it has given details to registrars and informed ICANN about its start-up dates.

It started a Qualified Launch Program program earlier this week. That’s where it gets to hand out a limited number of domains to hand-picked anchor tenants.

The sunrise period, restricted of course to trademarks, begins December 14 and ends January 24.

General availability starts January 25, according to registrars and ICANN records, with a seven-day Early Access Period during which domains can be purchased at daily-decreasing premium prices.

Full regular-price general availability begins February 1.

Comment Tagged: .day, eap, google, ICANN, new gTLDs, qlp, sunrise, trademarks

XYZ counting standard sales as “premiums” because its fees are so expensive

Portfolio gTLD registry XYZ appears to be counting regular sales of domains in certain TLDs as “premium” wins, because the base reg fee is so high.

The company said in a recent blog post that it sold over 270 “premium” names in October, but it added the following caveat:

Premium XYZ Registry domains refer to premium domains for extensions with standard and premium domains, and XYZ’s premium namespaces such as .Cars, .Storage, .Tickets, .Security, etc.

So if a name in a .com-equivalent priced TLD such as .xyz had been flagged as a premium by the registry and sold for a few thousands bucks, that counts as a premium sale, but any sale at all in .cars, where all domains cost a few thousand bucks regardless of the second-level string, also counts as a premium.

This reporting practice appears to bring in .security, .storage, .protection, .car, .auto, and .theatre, which all retail for four figures as standard. It also includes .tickets, where you won’t get much change out of a grand. It doesn’t include the fourth member of the cars family, .autos, where domains are priced as .com-equivalent.

I’m not sure how I feel about this.

You can’t accuse the registry of being misleading — it’s disclosing what it’s doing pretty prominently mid-post, not even reducing the font size.

And you can’t reasonably argue that a standard $3,000 .cars domain, which renews at $3,000 a year, for example, has less claim to the adjective “premium” than a domain in .hair that has a premium-tier EPP code selling for $3,000 but renewing at $20.

It just feels weird to see the word used in this way for what appears to be the first time.

Comment Tagged: .auto, .autos, .car, .cars, .protection, .storage, .theatre, .tickets, .xyz, premium, security, xyz.com

Nominet names Paul Fletcher new CEO

Nominet has named Paul Fletcher as its new CEO.

He’ll join the company in February, filling the spot vacated by Russell Haworth, who quit earlier this year a few days before he could be fired by members.

Fletcher is currently CEO at BCS, the Chartered Institute for IT, Nominet said. BCS, formerly the British Computer Society, is also a membership organization, with 60,000 members.

Nominet is currently headed by interim CEO Eleanor Bradley, one of the directors removed from the board at the company’s fractious Emergency General Meeting in March.

Fletcher will join the board at the same time as he joins Nominet, the company said.

1 Comment Tagged: .uk, nominet

CentralNic takes over a dead dot-brand

CentralNic has become the latest company to pounce on a dot-brand gTLD that was on its way to the dustbin of history.

The ICANN contract for .case was transferred to a London company called Helium TLDs, a CentralNic subsidiary, last week.

That company was previously called FANS TLD, and was the vehicle CentralNic used to acquire .fans from Asiamix Digital in 2018 before later passing it on to Hong Kong-based ZDNS International.

I believe something similar is happening here.

.case was a dot-brand owned, but never used, by CNH Industrial, which Wikipedia tells me is an American-Dutch-British-Italian company that makes about $28 billion a year making and selling agricultural and construction machinery. Diggers and forklifts and such.

CNH also managed .caseih, .newholland, and .iveco for some of its other brands, but these contracts were terminated earlier in the year.

The company had also asked ICANN to cancel its .case agreement, but that seems to have attracted acquisitive registry operators, and the termination request was withdrawn as I noted in September.

While terminating a dot-brand can often be seen as a lack of confidence in the dot-brand concept, selling off the gTLD to a third party rules out reapplying for the same string in future and can be seen as an even deeper disdain.

Now, .case is in CentralNic’s hands. I believe it’s the first dot-brand the company has taken over.

Rival registries including Donuts, XYZ and ShortDot have also swept up unwanted dot-brand gTLDs, stripped them of their restrictions, and repurposed them as general-purpose or niche spaces.

2 Comments Tagged: .case, acquisition, assignment, centralnic, cnh, dot-brands, helium tlds, ICANN, new gTLDs, trademarks

Delta variant cranks up Aussie domain regs in Q3

Australia’s ccTLD had a growth spurt in the third quarter, driven by pandemic lockdown rules.

Local registry auDA today reported that it took 171,846 new domain creates in Q3, up 22% on Q2. There were over 60,500 new regs in July, making it .au’s second-biggest sales month of all time.

auDA said in its quarterly report (pdf):

This increase took place at a time when COVID-19 restrictions were re-introduced in several states, and followed a levelling out of demand and seasonal dip over Easter in Q2. However, Q3 registrations are only slightly below the same period in 2020, which experienced a historic peak in new domain names created, driven by COVID-19.

Such lockdown bumps were experienced by many registries in 2020, as bricks-and-mortar businesses rushed to get an online presence to continue functioning while stores and venues were closed.

The delta variant of Covid-19 started worrying Australia in June, leading to lockdown rules in major cities that lasted most or all of July. The country has had a relatively low incidence of the virus, but has taken a hard line on restrictions.

At the end of September, .au registrations were up 5% at 3,386,186 names, auDA said. The .com.au level names were up 6% but .net.au was down 1.5%.

Next March, Australia will follow in the footsteps of some other ccTLDs and make second-level .au domains available for the first time.

Comment Tagged: .au, auda, coronavirus, covid-19, lockdown, lockdown bump, pandemic

.music goes live, plots 2022 launch

.music has become the latest new gTLD to join the internet, but it seems unlikely to hit the market before the 10th anniversary of the 2012 ICANN application period.

The TLD was added to the DNS root at the end of October, with the first domain, the obligatory nic.music, going live a few days later.

The registry, Cyprus-based DotMusic, said in a press release that it plans to launch the gTLD next year.

.music was one of the most heavily contested gTLDs from the 2012 application round, with eight total applicants.

It was one of two Community applications, which promised a more controlled, restricted namespace in exchange for a smoother ride through the ICANN approval and contention resolution processes.

But it failed to win its Community Priority Evaluation, leading to years of appeals and ICANN reviews.

The contention set was finally resolved in 2019, apparently via auction, with DotMusic prevailing against heavy-hitters including Amazon and Google.

But the victorious registry was slow out of the blocks after that, taking almost two years to negotiate its registry agreement with ICANN.

It’s still going to be a restricted-community space when it finally launches, which makes its success anything but assured, regardless of the unquestionable strength of its string.

Sadly, while DotMusic CEO Constantine Roussos looked every bit the part of the hip young rocker when the .music application was first filed, showing up everywhere in a sports car, cool haircut, and designer skinny jeans, today he lives in a senior-care home, drives a mobility scooter, and needs to be changed hourly.

1 Comment Tagged: .music, delegation, dotmusic, ICANN, new gTLDs

Three ICANN directors wanted to go to Puerto Rico

The ICANN board of directors’ decision to scrap the in-person component of its next public meeting was not unanimous, it has emerged.

Three directors voted against the November 4 resolution, which said ICANN 73 would be ICANN’s seventh consecutive online-only gathering, according the a preliminary board report.

The plan for months was to have a “hybrid” meeting, with some face-to-face component at the convention center in San Juan, Puerto Rico, as an intermediate step towards post-pandemic normality.

But at the time of the vote travel restrictions in the US were such that getting to Puerto Rico was tough even for fellow Americans, so ICANN’s meetings team had not been able to do on-site preparation.

Nine directors voted to make 73 virtual, with four absent during the vote, the preliminary report states.

Five directors have taken their seats since the coronavirus pandemic began, and have therefore never officially met with their board colleagues in person.

It’s not the first time the board has been split on this matter. Last year, directors Ron Da Silva and Ihab Osman voted to return to face-to-face for the October 2020 Hamburg meeting.

Da Silva is no longer on the board, but there are at least two other directors among the current line-up on the same page.

The voting breakdown will not be revealed until the board approves the November 4 minutes, which could be months if history is any guide.

1 Comment Tagged: .travel, coronavirus, covid-19, ICANN, icann 73, pandemic, puerto rico

Architect of Nominet boardroom bloodbath and Tucows backer win director seats

UK registry Nominet has announced the winners of its non-executive director election, with Simon Blackler securing a runaway victory. Ashley La Bolle of Tucows was also elected, with a strong share of the votes.

Blackler is the architect of the PublicBenefit.uk campaign, which was behind a boardroom bloodbath earlier this year, and La Bolle is director of domains at Tucows, the biggest registrar name to support that campaign.

According to Nominet, Blackler secured 1,285,370 of the 2,558,650 votes in the first-preference round of voting, a smidge over 50%. La Bolle got 750,447 votes, 29.3%, at the same stage, picking up the extra she needed after votes were transferred.

The other four candidates all received 7% or less of the votes in the first-preference ballot.

Voting was based on how many domain names members control, capped at 3% to avoid too much capture by the larger registrars.

Nominet said that turnout was 24.3% — 553 of the 2,276 eligible voters actually cast a ballot.

Blackler and La Bolle will join Nominet’s board at its next Annual General Meeting, which happens this Thursday.

They replace domain investor David Thornton, who had stood for reelection but received less than 6% of the first-round votes, and GoDaddy policy veep James Bladel, who did not stand.

Blackler, who runs the registrar Krystal Hosting, started the PublicBenefit.uk campaign earlier this year in protest at what was seen as Nominet’s unresponsiveness and lack of transparency towards its members.

He rallied a crowd of members upset with what they saw as the company’s diversification into non-core businesses, excessive director and executive compensation, and diminishing devotion to supporting public-benefit causes.

The campaign resulted in the forced resignation of the CEO, the ouster of the chair and almost half the directors, and a renewed focus on the .uk registry and charitable causes under a new chair.

Tucows was the biggest-name registrar to back the campaign, with La Bolle repeatedly blogging about how Nominet needed to be more transparent and engage better with its members.

“Humbled by the amount of support and looking forward to improving Nominet for ALL,” Blackler tweeted following the results announcement.

“I’m truly honoured to be appointed to Nominet’s Board as an NED and am grateful for the support and trust from my peers,” La Bolle said via email. “As well-stated throughout my campaign, I am committed to helping Nominet refocus on its core mandate and re-engage its members to better serve our entire community.”

Comment Tagged: .uk, election, nominet, publicbenefit.uk, tucows