Go Daddy files for patent on available domain ads

Go Daddy has applied for a US patent on a system that automatically inserts available domain names into banner ads based on the dynamic content of a web page.
The application “Generating online advertisements based upon available dynamic content relevant domain names” was filed in February 2009 and published today.
The patent would cover a way to analyze the content of a web page, perhaps using image identification technology, then generate keywords and check for available domain names to put in the ad.
Instead of a standard Go Daddy banner, visitors to a web page would be shown a custom ad offering an available or aftermarket domains relevant to the content of the page.
The application also seems to cover an API whereby an advertising network, such as Google, would also be able to offer available domains via Adsense.

Will Go Daddy be the next domain name IPO?

It was four years ago this week, August 8, 2006, when Bob Parsons unexpectedly canceled Go Daddy’s planned IPO at the eleventh hour.
But with its closest competitor, eNom parent Demand Media, ready to go public, eyes inevitably turn to Scottsdale to see if the market leader is ready to follow suit.
I’ve no doubt Go Daddy will be watching Demand’s IPO carefully, but there are some reasons to believe a me-too offering is not a short-term certainty.
Bob Parsons owns Go Daddy
First, and most importantly, Bob Parsons owns Go Daddy. At the time of the 2006 S-1, he was the company’s sole investor, and I believe that’s still the case.
Unlike Demand Media, which raised about $355 million in financing in its early days, Go Daddy doesn’t have a gang of institutional investors clamoring for a return on their investments.
The flip-side of this argument is that it does have is a loyal senior management team holding share options they’re not yet able to cash in on the public markets.
The fact that Parsons is still in charge may cause some investor nerves, given the trust hit he will have taken on Wall Street four years ago, but I don’t think that’s a massive consideration.
The IPO market is still poor
The first attempt at an IPO was canceled mainly due to poor market conditions, according to Parsons’ blog post at the time.
It had only been a few months since Vonage’s catastrophic offering, which saw early-mover investors lose millions, and there was little appetite for tech IPOs.
A lot has changed in the last four years, but the current tech IPO market is still struggling, with many companies recently under-pricing their offerings or losing value since.
According to VentureDeal stats reported at GigaOm, of the 21 tech IPOs in the first half of this year, only five were trading above their IPO price at the end of July. Most had seen double-digit declines.
While some analysts think the upcoming Skype and Demand Media IPOs could breathe life into the market, it’s far from a certainty.
Go Daddy is a cash cow
Go Daddy’s financial statements will look a lot healthier today that back in 2006.
Parsons said he yanked the IPO in part because there was too much focus on Go Daddy’s performance under Generally Accepted Accounting Principles.
Under GAAP, Go Daddy was a loss-making company, due to the way that revenue from domain names has to be recognized over the course of the registration while the associated costs are incurred up-front.
This meant that Go Daddy was a cash machine – with something like $95 million of deferred revenue on its balance sheet at the time of the 2006 filing – but technically unprofitable.
Whether this has changed or not, I don’t know; Go Daddy is still growing. But it’s a lot larger now than it was in 2006, and its cashflow and balance sheets will certainly look impressive even if its income statement does not.
I’m guessing a lot will depend on how Demand performs over the coming months as to whether Go Daddy follows its lead.
But Parsons said four years ago that the firm would revisit the public markets again, and I’m sure we won’t have too long to wait until it does.

eNom called world’s most “abusive” registrar

A small security firm has singled out eNom as the domain name registrar and web host with the most criminal activity on its network.
HostExploit released a report today claiming the concentration of “badware” on the network belonging to eNom and its soon-to-be-public parent Demand Media is “exceptionally high”.
The claim is based on the proportion of dodgy sites on eNom’s network relative to its size, rather than the actual quantity.
The report says the Demand-owned autonomous system AS21740 has the fifth-highest amount of badware and the sixth-highest number of botnet command and control servers.
It goes on to say that the four or five AS’s with larger amounts of malware are themselves between 10 and 7,500 larger than eNom, as measured by address space.
The report, which I’m guessing HostExploit released to coincide with the hype around Demand Media’s upcoming IPO, draws heavily on existing research, such as this recent KnuJon registrar report (pdf).
It also uses stats from Google-backed StopBadware.org to demonstrate that eNom hosts a disproportionately large number of malware-serving URLs.
According to StopBadware, Go Daddy actually hosts more bad URLs than eNom – 10,797 versus 7,429 – but Go Daddy’s market share is of course over three times larger.
According to WebHosting.info, eNom currently has 9.5 million domains under management, compared to Go Daddy’s 35.2 million.
In Demand Media’s IPO registration statement, filed last Friday, the company acknowledges that it sometimes gets bad publicity but says it’s caught between a rock and a hard place.

We do not monitor or review the appropriateness of the domain names we register for our customers or the content of our network of customer websites, and we have no control over the activities in which our customers engage.
While we have policies in place to terminate domain names if presented with a court order or governmental injunction, we have in the past been publicly criticized for not being more proactive in this area by consumer watchdogs and we may encounter similar criticism in the future. This criticism could harm our reputation.
Conversely, were we to terminate a domain name registration in the absence of legal compulsion, we could be criticized for prematurely and improperly terminating a domain name registered by a customer.

Using Go Daddy equals “bad faith” registration

Registered a domain name with Go Daddy recently? Unless you’ve updated your name server settings, you’ve automatically committed a “bad faith” registration.
At least, that’s the conclusion I’m drawing from a couple of recent clueless UDRP decisions.
The most recent example is the case of Churchill Insurance, which just won churchillimports.com, following a proceeding with the National Arbitration Forum.
The registrant claimed he planned to use the domain, which he registered just six months ago, to sell cigars. Seems reasonable. Other sites sell cigars using the name “Churchill”.
But the NAF panelist, Flip Petillion, wasn’t buying it:

Respondent uses the churchillimports.com domain name to resolve to a directory website that displays links to third-party websites, some of which provide insurance products and services that compete with Complainant’s business.
…
it is shown on a balance of probability that Respondent uses the disputed domain name to operate a directory website and, thus, profits from this use through the receipt of “click-through” fees. Accordingly, the Panel finds that this use constitutes bad faith registration and use pursuant to Policy
…
as the disputed domain name was registered after the registration of Complainant’s established trademark rights and given the fact that Respondent’s website employs insurance themed links that resolve to websites of Complainant’s competitors, Respondent could not have registered and used the disputed domain name without actual or constructive knowledge of Complainant and its rights in the CHURCHILL mark.

What Petillion clearly failed to realize – or decided to conveniently ignore – is that everything he ascribes to the registrant was actually caused by default Go Daddy behavior.
Churchill sells car insurance in the UK. The registrant is an American, from Georgia. There’s a very slim chance he’d ever heard of the company before they slapped him with the UDRP.
But Petillion decided that the fact that insurance-themed links were present on the site shows that the registrant must have known about the company. Like he put the links there himself.
He concludes the registrant had “bad faith” because Go Daddy’s parking algorithm (I believe it’s operated by Google) knows to show insurance-related ads when people search for “churchill”.
In addition, churchillimports.com is the default parking page that Go Daddy throws up whenever a domain name is newly registered.
The registrant didn’t need to do anything other than register the name and, according to this bogus ruling, he’s automatically committed a bad faith registration.
Where does NAF find these people?
I’m sure I’m not the first to notice this kind of behavior, and I’m sure Go Daddy’s not the only registrar this affects.

Stalemate reached on new TLD ownership rules

An ICANN working group tasked with deciding whether domain name registrars should be able to apply to run new top-level domains has failed to reach a consensus.
For the last several months, the Vertical Integration working group has been debating, in essence, the competitive ground rules of the new TLD market, addressing questions such as:

• Should existing ICANN registrars be allowed to run new TLD registries?
• Should new TLD registries be allowed to own and control ICANN registrars?
• Should new TLD registries be allowed to sell domains directly to end users?
• What if an approved registry can’t find a decent registrar willing to sell domains in its TLD?
• Should “.brand” TLDs be forced to sell via ICANN accredited registrars?
• Should “registry service providers” be subject to the same restrictions as “registries”?
• Where’s the harm in allowing cross-ownership and vertical integration?

It’s an extraordinarily complex set of questions, so it’s perhaps not surprising that the working group, which comprised a whopping 75 people, has managed to reach agreement on very few answers.
Its initial report, described as a “snapshot” and subject to change, states:

It is impossible to know or completely understand all potential business models that may be represented by new gTLD applicants. That fact has been an obstacle to finding consensus on policy that defines clear, bright line rules for allowing vertical integration and a compliance framework to support it

Having lurked on the WG’s interactions for a few months, I should note that this is possibly the understatement of the year. However, the WG does draw four conclusions.

1. Certain new gTLDs likely to be applied for in the first round will be unnecessarily impacted by restrictions on cross-ownership or control between registrar and registry.

I believe the WG is referring here primarily to, for example, certain “cultural” TLDs that expect to operate in linguistic niches not currently catered for by registrars.
The operators of the .zulu and .kurd TLDs would certainly find themselves without a paddle if the rules obliged them to find an ICANN-accredited registrar that supports either of their languages.
There are other would-be registries, such as .music, that call themselves “community” TLDs and want to be able to sell directly to users, but my feeling is that many in the WG are less sympathetic to those causes.

2. The need for a process that would allow applicants to request exceptions and be considered on a case-by-case basis. The reasons for exceptions, and the conditions under which exceptions would be allowed, vary widely in the group.

There’s not a great deal to add to that: the WG spent much of the last couple of weeks arguing about “exceptions” (that they could not agree on) to a baseline rule (that they could not define).

3. The concept of Single Registrant Single User should be explored further.

An “SRSU” is a subset of what a lot of us have been calling a “.brand”. The proposed .canon TLD, under which Canon alone owns .canon domains, would likely fall into this category.
The WG’s report suggests that SRSU namespaces, should they be permitted, should not be subject to the same restrictions as a more open and generic TLD that sells to the average man on the street.
The alternative would be pretty crazy – imagine Canon owning the registry but being forced to pay Go Daddy or eNom every time it wanted to add a record to its own database.
I do not believe that a hypothetical .facebook, in which Facebook is the registry and its users are the registrants, falls into the SRSU category. Which is also pretty nuts, if you’re Facebook, forced to hand your brand over to the world’s domain name registrars.

4. The need for enhanced compliance efforts and the need for a detailed compliance plan in relation to the new gTLD program in general.

One principle that has come through quite clearly whilst lurking on the WG mailing list is that the degree of distrust between participants in this industry is matched only by the lack of confidence in ICANN’s ability to police bad actors effectively.
Domain name companies are masters of the loophole, and ICANN’s enforcement mechanisms have historically been slow enough that yesterday’s scandal often becomes today’s standard practice.
This sums it up pretty well:

Some members feel that loosening vertical integration/ownership controls may let the proverbial “genie out of the bottle that can’t be put back” should competitive harms result in the marketplace. Others believe that adopting restrictions on vertical integration or cross ownership is the wrong approach altogether, and that the focus should be on protecting against harms, and providing sanctions where harms take place.

The WG currently has six policy proposals on the table, which vary from the “no VI allowed” of the current Draft Applicant Guidebook to “some VI allowed” to “full VI allowed”.
There was a poll of WG members a few weeks back, to see which proposal had most support. It was inconclusive, but it left three proposals clearly in the lead.
The so-called Free Trade proposal, which advocates no limits on cross ownership, was originally authored by Sivasubramanian Muthusamy of ISOC India Chennai.
The proposal as it currently stands puts the focus on ICANN troubleshooting undesirable activities through compliance programs rather than ownership restrictions.
Opposed, a proposal known as RACK+, offered up primarily by Afilias, some of its partners, and Go Daddy, favours a much more restrictive policy that is more aligned with business models established under the last ten years of gTLDs dominated by .com.
RACK+ would impose a 15% ownership limit between registries, registrars and registry service operators, ostensibly in order to prevent registrars abusing privileged registry data.
But under RACK+, all TLDs, including .brands and obscure community TLDs, would be obliged to accept registrations only through ICANN registrars, on a non-discriminatory basis.
This would probably render the .brand TLD market stillborn, if adopted by ICANN, I reckon.
A third proposal, called JN2+, originally authored by representatives of NeuStar and Domain Dimensions, occupies a spot somewhere in the middle ground.
It also proposes 15% ownership caps between registrars, registries and registry service providers, but it contains explicit carve-outs for SRSU-style .brands and “community” TLDs.
Because I’m a wimp, and I have no desire to be drawn into the kinds of arguments I’ve been reading and listening to recently, I’m going to quote Milton Mueller here, saying JN2 “had the highest acceptability ranking of all the proposals” when the WG was polled.
(Sorry.)
I find it rather surprising that the WG seems to be calling for more policy work to be done on ICANN’s compliance programs before the issue of vertical integration can be fully resolved.
If anything, this seems to me to be yet another way to risk adding more delay to the new TLD program.
There’s a public comment period now open, here. And here’s the report itself (pdf)

Cybersquatters already hitting .co

Just over 24 hours after the general availability launch of the .co top-level domain, the secondary market is already beginning to fill up with dodgy domains.
Aftermarkets including Go Daddy and Sedo are currently listing some names that are unarguably typosquats of famous brands, and plenty more that very probably wouldn’t beat a UDRP complaint.
Go Daddy Auctions currently has almost 200 .co domains listed, Sedo over 500. Of those, I managed to find a few dozen dubious registrations, mostly on Go Daddy.
It beggars belief that, with millions of decent greenfield domains available, somebody had the failure of imagination to register wwwgoole.co. But they did. It’s currently listed on Sedo.
Other probable typosquats found on Sedo this evening include yahhoo.co, listed with a £10,000 price tag, as well as yayoo.co, geogle.co and barclys.co.
Go Daddy has listed some more obvious brands: poptarts.co and tostitos.co for the foodies, sanfranciscogiants.co, washingtonnationals.co and seattlemariners.co for the American football baseball fans.
Somebody who pays way too much attention to Rick Schwartz registered bpoilspill.co for the quick flip.
Cartoon characters for sale include mariobros.co and goofy.co. Celebrities duncanbannatyne.co and mikeposner.co both get squatted.
Yahoo, Apple, Facebook and Microsoft all get targeted, with yahoomaps.co, iphonedeals.co, facebookme.co and bingsearch.co all receiving price tags between $5,000 and $50,000.
For the Brits, centerparcs.co, virginuk.co and bbciplayer.co are also all up for auction.
Bear in mind that these are just the domains that have been registered and listed for auction in the first 24 hours. There’ll be plenty more not yet on the market.
I’d estimate about 5% to 10% of Go Daddy’s .co auctions are currently UDRP fodder.
This is why trademark holders hate new TLDs.

More WordPress attacks at Go Daddy

The Kneber gang has continued its attacks on Go Daddy this week, again targeting hosting customers running self-managed WordPress installations.
Go Daddy said that several hundred accounts were compromised in order to inject malicious code into the PHP scripts.
“The attack injects websites with a fake-antivirus pop-up ad, claiming the visitor’s computer is infected,” Go Daddy security manager Scott Gerlach blogged.
According to the alarmists-in-chief over at WPSecurityLock, the attacks place a link to a script hosted on cloudisthebestnow.com, a domain registered by “Hilary Kneber”.
The script attempts to install bot software on visitors’ machines.
As I’ve written before, the Kneber botnet has been running since at least December 2009. It generally hosts its malware on domains registered with ICANN-accredited BizCN.com, a Chinese registrar.
Go Daddy said it has contacted the registrar to get the domain yanked. It may have been successfully killed already, but I’m too much of a little girl to check manually.
I must confess, as somebody with a number of WordPress installations on Go Daddy servers, it makes me a little nervous that these attacks are now well into their second month and I still don’t know whether I should be worried or not.

Go Daddy launches paid YouTube clone

Go Daddy has opened the doors of Video.me, a video-hosting service with a difference.
The difference is you have to pay for it.
The company seems to be banking on the idea that users will be happy to hand over $2 per month, rather than use YouTube for free, because Video.me has simpler password protection.
“People want privacy online, it’s obvious from the all of the recent news,” chief executive Bob Parsons said in a press release. “YouTube has been the place for mass-consumption videos, but for sharing more personal items, it’s way too complicated.”
Most of the recent news about online privacy has been focused on Facebook. I don’t think I’ve seen many people complaining about YouTube.
Still, at the very least the service is a high-profile use of a .me domains, which could help Go Daddy as a partner in Domen, the Montenegro-based .me registry.

ICANN’s Draft Applicant Guidebook v4 – first reactions

As you probably already know, ICANN late yesterday released version 4 of its Draft Applicant Guidebook, the bible for new top-level domain registry wannabes.
Having spent some time today skimming through the novel-length tome, I can’t say I’ve spotted anything especially surprising in there.
IP interests and governments get more of the protections they asked for, a placeholder banning registries and registrars from owning each other makes its first appearance, and ICANN beefs up the text detailing the influence of public comment periods.
There are also clarifications on the kinds of background checks ICANN will run on applicants, and a modified fee structure that gets prospective registries into the system for $5,000.
DNSSEC, security extensions for the DNS protocol, also gets a firmer mandate, with ICANN now making it clearer that new TLDs will be expected to implement DNSSEC from launch.
It’s still early days, but a number of commentators have already given their early reactions.
Perennial first-off-the-block ICANN watcher George Kirikos quickly took issue with the fact that DAG v4 still does not include “hard price caps” for registrations

[The DAG] demonstrates once again that ICANN has no interests in protecting consumers, but is merely in cahoots with registrars and registries, acting against the interests of the public… registry operators would be open to charge $1000/yr per domain or $1 million/yr per domain, for example, to maximize their profits.

Andrew Allemann of Domain Name Wire reckons ICANN should impose a filter on its newly emphasised comment periods in order to reduce the number of form letters, such as those seen during the recent .xxx consultation.
I can’t say I agree. ICANN could save itself a few headaches but it would immediately open itself up to accusations of avoiding its openness and transparency commitments.
The Internet Governance Project’s Milton Mueller noted that the “Draconian” text banning the cross-ownership of registries and registrars is basically a way to force the GNSO to hammer out a consensus policy on the matter.

Everyone knows this is a silly policy. The reason this is being put forward is that the VI Working Group has not succeeded in coming up with a policy toward cross-ownership and vertical integration that most of the parties can agree on.

I basically agree. It’s been clear since Nairobi that this was the case, but I doubt anybody expected the working group to come to any consensus before the new DAG was drafted, so I wouldn’t really count its work as a failure just yet.
That said, the way it’s looking at the moment, with participants still squabbling about basic definitions and terms of reference, I doubt that a fully comprehensive consensus on vertical integration will emerge before Brussels.
Mueller lays the blame squarely with Afilias and Go Daddy for stalling these talks, so I’m guessing he’s basing his views on more information than is available on the public record.
Antony Van Couvering of prospective registry Minds + Machines has the most comprehensive commentary so far, touching on several issues raised by the new DAG.
He’s not happy about the VI issue either, but his review concludes with a generally ambivalent comment:

Overall, this version of the Draft Applicant Guidebook differs from the previous version by adding some incremental changes and extra back doors for fidgety governments and the IP interests who lobby them. None of the changes are unexpected or especially egregious.

DAG v4 is 312 pages long, 367 pages if you’re reading the redlined version. I expect it will take a few days before we see any more substantial critiques.
One thing is certain: Brussels is going to be fun.

Google blocks Go Daddy for ‘hosting malware’

(UPDATED) Google is currently blocking Go Daddy’s web site, calling it dangerous, because one of its image-hosting domains has been flagged for hosting malware.
Chrome users visiting pages on godaddy.com, including its storefront, currently see the standard Google alert page: “Warning: Visiting this site may harm your computer!”
Go Daddy’s main page seems to be affected because it uses images hosted at img5.wsimg.com, a Go Daddy domain.
A bit of a poke around reveals that the whole of wsimg.com is currently considered a malware site by Google’s toolbar on non-Chrome browsers, and also by the Google search engine.
The question is, of course, whether this is a simple false positive or whether bad guys have somehow managed to inject malware onto Go Daddy’s servers.
Go Daddy’s web site takes revenue in the six figures every hour, so if this is a false positive I can only imagine the content of the phone calls between Scottsdale and Mountain View right now.
But Go Daddy has been a target for the bad guys in recent weeks, with attacks against its hosting customers proving an irritant that the company can’t seem to shake off.
The company was also the victim of a phishing attack yesterday. I’d be surprised if the two incidents are connected.
UPDATE: Warren Adelman, Go Daddy’s chief operating officer, just called to say that this was indeed a false positive.
“Google erroneously flagged some of our image servers,” he said. “We need to go into this with Google, but there wasn’t any malware on our end.”
Adelman said Go Daddy has a pretty good idea what happened, but that it proved hard to get hold of the relevant people at Google on a Sunday morning during Memorial Day weekend.
Further details may be forthcoming later this week. For now, Google has apparently unflagged the servers in question, and Adelman expects the situation to be resolved within the hour.