Was Godaddy Caught Registering Domains Names After Availability Lookup?

If a 3rd party is involved, shouldn't we move to stop Godaddy from providing this information to them? If it is a case of rogue employees domain squatting, shouldn't Godaddy act to put a halt to this practice?

I was taken aback when a domain I owned expired and Godaddy "held it for me" to the tune of $80. I just waited a few months and re-registered after they dropped it.

This is scary for many reasons.

Although it barely made a bleep on HN, GoDaddy recently acquired Outright.com

Once upon a time, Outright had a great vision. To be like Mint, but for small businesses. For "the little guy". People sign up, plug in their bank account info, credit cards, eBay + PayPal, etc and voila! Here's your P&L. Makes doing taxes easy. Customers? Generally of the unsuspecting "lifestyle business", sole prop, a person / family business kind that just didn't know any better. Over time, Outright's servers became chock full of data (yes, even from deleted accounts), such that it could paint a live stream of a person's or a business's financial health.

This would be fine and dandy but for the fact that Outright was taken over by an incredibly unethical and morally incomprehensible CEO who, apparently, decided to sell out all of his users' privacy and security to one of his kind. So GoDaddy is now in the business of "accounting" and has access to the live stream of financial health of a whole lotta small businesses - to exploit and do who knows what with.

Also, for every registration don't registrars have to pay the ICANN fees for each domain? At almost $10/domain it would seem unwise to automatically register any domain people are searching for as it could end up costing a lot of money in fees.

Disclosure: I work at GoDaddy, but I do not work on domains, so I have no knowledge about that area of the business.

That said a few points:

1) As others have pointed out the sheer volume of domain lookups that are done at godaddy make it unlikely this would be profitable for GD to do not to mention the PR problem for that matter. Registrars do pay for domain names. Currently the cost (including ICANN fees) are $8.03 per domain (plus some other minor type costs as well). All registrars pay the same price .com .net, volume doesn't matter. Very often registrars sell below cost btw.

2) "but their employees certainly could be, or they could sell domain query data to a 3rd party to keep their hands clean. Some Godaddy employees certainly have access to the data of who is looking for what."

Is possible of course. So far no proof of that. Important point of course is that even the info (as I pointed out in another comment) when you do a command line whois to the Verisign whois server can be sniffed and/or it's possible someone at Verisign is getting at the data (or that Verisign is selling it for that matter). Since GD is the largest registrar it is quite possible the info is sniffed elsewhere and registered at GD.

3) "algorithm that looks that those domains for dictionary words and possibly look at Google keyword search volume on each one and only buy the ones that pass some minimum criteria" Exactly the way back in the 90's that I registered domain names. Except it was by excite or yahoo I don't remember. I can vouch for that personally although most good names as we know are taken long ago.

4) "or there isn't some low level tech or manager who isn't doing this on their own." Then the culprit isn't GD but someone who works for them (in all fairness). So this could easily happen at any registrar. It is possible to setup a system where a rogue employee can't get at the data of course. But that doesn't prevent what can happen as detailed in #2 above.

I'm trying to believe this is just rotten luck, but every single account of this happening seems to link back to GoDaddy.

What makes this a massive effort? I assume that GoDaddy has existing software to register a domain name given the name, and some fixed configuration like who should be listed as owner, contact, etc. So we need to call that logic, passing as input each domain that has been searched for.

Upon every search for a domain name, enqueue the search term to a queue. (This can happen e.g. after the page load completes.) The search results already indicate whether the name is registered, so only write unregistered domains to the queue.

Set up a fleet of workers to pull items from that queue and call the functionality that registers a domain.

It seems feasible to have a basic prototype of this functionality operational within a day or two of effort (e.g., a dumb implementation that simply registers every search term that's a valid domain). I'm sure the production version will need to be smarter, like not registering every single search, or estimating the value of a prospect and only registering high-value prospects - but wouldn't a basic flagrant implementation be fairly simple?

But even without that I'm hugely skeptical of your "massive effort" claim.

This isn't true, at least as of Dec. 2008: http://domainnamewire.com/2008/12/03/standard-tactics-llc-ho... .

But if GoDaddy is front-running, and they outright lie and deny front-running, then it adds to their liability. Fraud is far less defensible than front-running itself (which could be defended as a good capitalistic use of asymmetrical information, after all).

Given the increase in liability the denial presents for GoDaddy, my sense is that it lends credibility to the assertion that they are not, after all, front-running.

This, plus the rather weak evidence that they're doing so (the lone assertion of a single blogger) makes me believe that there is reasonable doubt about whether they are doing it. Hey, if there are more people stepping forward, then lets see a class-action and get the proof in the light.

Please understand this is a sincere question. I'm asking because I think it's legal. If it's illegal, I want to know about that, and especially how the law might view a register's squatting and an individual's squatting differently.

Edit: Just so it's clear, by "register" I mean truly register the domain for a year -- not "taste" it for a few days and then cancel the registration, if that is even still allowed.

OTOH, dns and whois are unencrypted protocols. Eavesdroppers could see your lookups. Depending on which DNS or WHOIS servers you are consulting, their administrators may be untrustworthy. For example, many whois installations default to asking NetworkSolutions, who at one point (2008) was definitely front-running by their own admission.

Also, given that GoDaddy is being accused of this right now, they'd be smart to stop any front-running for a few weeks.

Make a LOIC-like program that queries, say, 100 domains per minute. Brute-force up to 20 char dns names. Let godaddy purchase a few million before they find out what's going on.

One could lower the queries per minute to make it not look so brute-force-y.

http://en.wikipedia.org/wiki/Domain_name_front_running