GoDaddy Holds Domains Hostage

saikou writes "There were previous reports of GoDaddy, one of the biggest domain name registrars, attacking Bittorrent sites with frivolous interpretation of their own Terms of Service (that story was resolved), and now similar events unfold with clients of one of Russian domain registrars Majordomo.ru -- GoDaddy has informed them that all 1399 client domains are now blocked (story in Russian) due to 'many of your domain names were listed in the Spamhaus.org blacklist or were resolving to a name server or IP address listed in the Spamhaus.org blacklist' with a demand of a neat '$199 non-refundable administration fee to the credit card on file for your account for each domain name you wish to reactivate' or $50 for each domain to be transferred out into another registrar. I am all for fighting spam, but given how unreliable spam black-lists are such actions simply damage the internet. Instead of affecting people that use spam lists to control the inflow of mail to some degree, all users are effectively forced to be black-list clients. Now all one needs to shut down a site is a few reports of spamming, and the domain (or even better, all domains of a given small registrar) will be suspended."

Comments

a company selling $2 domain names is shady!!!

[a_greer2005]

Whats next, are you going to tell me that used car dealers can be less than fully honest? SAY IT AINT SO!

Re:a company selling $2 domain names is shady!!!

[ergo98]

a company selling $2 domain names is shady!!!

Whats next, are you going to tell me that used car dealers can be less than fully honest? SAY IT AINT SO!

Why? How complex do you think hosting a name <-> IP table is, especially when the basic, long-proven infrastructure costs are spread across tens of millions of domains.

Network Solutions, the other end of the cost scale, has hardly been a model of good registrar behaviour. In fact most people consider them the scummiest, shadiest of the group.

Re:a company selling $2 domain names is shady!!!

[rs79]

"Something like $6 or $7 per domain?"

$6 last time I checked.

Re:a company selling $2 domain names is shady!!!

[sp3d2orbit]

I varies for each type of top level domain. A .COM/.NET/.ORG is around $6.25 per year per domain + a .25 ICANN Fee. For other domains like .tv it can be as high as $50. Different bodies control different TLD's and they control the pricing for each.

Re:a company selling $2 domain names is shady!!!

[tarpy]

"(And just because your TOS has a clause allowing you to do so doesn't make you not-evil..)"

Um, why? Seems to me they're telling you what they'll do, and then they go and do it. One assumes you agreed to the TOS and service contract, so, how, exactly is it evil? Bad business practice, yes, evil, no.

this is ....

[scenestar]

Just a big of a threat to net neutrality as that QoS crap

Re:this is ....

[AuMatar]

THe problem comes when you have multiple customers. Its fine for you to say your VOIP is more important than your torrent. Its not ok for your VOIP to be given priority over my gaming- we're paying the same amount, you have no right to higher priority. Not to mention that it would be pointless to try- people would just start wrapping other traffic over whatever the highest protocol is.

Shows what you know

[AlphaSys]

SpamHaus is one of the most conscientious, well-organized, ethical and reliable lists around. Their SBL-XBL list is nothing short of essential in weighting ham and spam. I don't rely upon RBL information alone when weighting ham and spam, but if I did, I'd use spamhaus and nothing else. I'd agree with poster that RBLs are not all that great a single measure and YMMV, but don't spread FUD about spamhaus. They're great.

Re:Shows what you know

[sauge]

I hate all these idiot blackhole lists.

One list complained my machine was using the wrong version of sendmail for their taste. Not one bit of spam came from the machine - but they listed it simply because I had an old version of sendmail.

Since then I have considered all these lists to be unregulated vigilantes.

Speaking with other people - they also found themselves listed on various BHLs over trite and stupid shit.

With all the zombie computers out these days, BHLs are weapons of the last war anyhow.

Re:Shows what you know

[UnrepentantHarlequin]

Will GoDaddy reimburse the fee that you shouldn't have had to pay, should it be shown that your domain was not being used nefariously? I somehow doubt it.

I wouldn't doubt it in the least.

As it happens, I'm a GoDaddy customer. I've also dealt with Network Solutions and MelbourneIT. GoDaddy stands head and shoulders above both of those big-name, big-rep registrars in terms of service, value for the money, and especially ethics. It wasn't GoDaddy who refused to give Panix their domain name back when it got jacked due to Melbourne's own sloppiness. GoDaddy doesn't send out fake "rewnewal" notices for domains owned by other registrars. And it certainly wasn't GoDaddy who tried to convince us SiteFinder was for our benefit. I'm not saying GoDaddy is a bunch of saints -- they're not, they're a bunch of businessmen -- but they're head and shoulders above the competition, ethics-wise.

They're also the only registrar I know of, and one of the damn few businesses of any type, where you can go yell at the big cheese personally. Bob Parsons and I have exchanged words a time or two via his blog. I suspect if I called up GoDaddy and wanted to talk to him, they'd put me through.

Oh, as to how they can sell domain names below cost: The actual offer is a domain for $1.99 when you buy a non-domain product, such as a hosting contract. They make money on that in exactly the way the Friendly's down the street from me is making money off a free ice cream sundae when you buy a chicken platter. Nothing shady about that, just a "buy a big thing, get a little thing cheap/free" deal like millions of other businesses offer every day. They make their money off of regular priced domain names (not much each, but their volume is incredible) and all of their other products and services, from software to hosting.

No, I don't work for GoDaddy, I'm just one of their customers. All the money flows from me to them, not the other way around. But I just got sick of all the speculation, insinuations, baseless assumptions, and general-purpose bashing from uninformed people who know nothing more about GoDaddy and its business practices than what they read in Slashdot comments.

I don't read Slashdot much anymore, and this kind of thing is one of the reasons why. Come on, guys, we're better than this. Or at least we used to be.

Re:Shows what you know

[Achromatic1978]

Okay, I /personally/ own 12 domains through GoDaddy. I own two through Melbourne IT. I know technical staff at Melbourne IT, too, and know more about the Panix calamity than most people here do.

But what amuses me about this is that you have the idea to berate people for attacking GoDaddy for this, on the grounds that "they're not as bad as other registrars", and that you defend the ethics of a company arbitrarily deciding that your domain is being used for nefarious purposes, /on the basis of/ one of their resellers having sold other domains which were used for nefarious purposes, and charging a $200 fee to allow you use of your own domain, regardless of whether or not you actually did something wrong. That's not even remotely ethical, and is not any more defendable because you could personally yell at Bob Parsons, or because it wasn't GoDaddy who decided to push unresolving domains to their service.

Very dangerous precedent

[Anon E. Muss]

Once we allow domain registrars to become the Spam Police, very soon there will be political pressure for them to become the Content Police. It starts with spam and kiddie pron -- content that 99.999% of the world agrees is wrong. I guarantee it won't stop there.

Re:Very dangerous precedent

[Halo1]

Actually, you need some level of self-policing to curb the problem if you want to demonstrate that laws are not necessary. Why should a domain name registrar be less responsible for spammers than hosting ISPs? Especially, since spammers nowadays often host their sites on hacked Windows boxes, with the DNS switching from one machine to another all the time (thus making the domain name their most important asset).

Re:Very dangerous precedent

[eneville]

If GoDaddy wants to make a stand they should alter their TOS to that effect BEFORE blocking domains. If they block the domains there should not be an extortionate fee to release it. The domain is neutral in this, the abuser should, although they are wrong, not have to pay GoDaddy in this way.

Re:Very dangerous precedent

[Toe, The]

Registrars are private entities... InterNIC is from last millennium.

If you want to enforce that registrars cannot impose restrictions on their clients, then what kind of slippery slope are you encouraging?

Are you saying that the worst murderous mobsters can operate massive criminal enterprises on a website hosted in an anarchistic country and their registrar should be prevented from denying them service?

Re:Very dangerous precedent

[PRC Banker]

My answer would be that you don't know the domains spam originates from.

Spam comes from an email server. A server can fake domain/origination names/addresses in emails, an email server is not a domain server, just a machine which may or may not be from that 'domain'. Simple. Domains that are linked in the spam could be traced, but are often taken down quickly and I could easily see some increase in deliberate noise/signal in spams using legitimate domains in amongst illigetimate ones in order to 'sell' products/services (i.e. using legitimate domains in URLs pertaining to spams, which are useless to sell the spammer's products, but may increase pressure in crackdowns against domains linked to by spammers).

Re:Very dangerous precedent

[Halo1]

Spamhaus collects domains used by major league spammers to host their sites, not domains appearing in the from-field of sent spam messages.

Re:Very dangerous precedent

[X0563511]

Yes. The registrar has no business doing anything but the following:
OK, your bills are payed. Now when people type A, A is resolved to IP B instead of C (a parking page)

It's the responsibility of law enforcement to enforce law. But, in your own argument, the site is hosted in an anarchistic country. We (and whatever country the registrar is based in) have NO BUSINESS imposing law or right/wrong on another sovergn country OR IT'S CITIZENS OR BUSINESSES. We can yell/scream/make noise/threaten as much as we want, but we cannot enforce our views on them.

Re:Very dangerous precedent

[Vancorps]

Yes it will, that's why we invented reverse-DNS and more importantly SPF. This issue was resolved years ago.

Re:Very dangerous precedent

[Anon E. Muss]

You seem to have forgotten to indicate any reason why you would see this as acceptable.

I didn't forget -- I just thought it was obvious. For the benefit of the slow learners in the class, I'll repeat myself: Domain name registrars should not get into the content policing business. Today it's spam, which everybody agrees is terrible and should be stopped. Tomorrow it will be with some other type of disfavored content.

Why would you force registrars to act according to your will?

I see it the other way around -- the registrar is trying to force their will on me. GoDaddy is making a value judgement based on the content associated with the domain name. By disabling the name, they are removing my ability to access that content (yeah, sure, I could do it by IP address, but we have DNS for a reason).

Re:Very dangerous precedent

[NickFortune]

If you want to enforce that registrars cannot impose restrictions on their clients...

I rather read that as GoDaddy imposing restrictions on the clients of another registrar. That hardly seems like behaviour we would wish to encourage.

...then what kind of slippery slope are you encouraging?

Speaking of slipperly slopes, GoDaddy stand to make almost 300k from this stick up. I mean, it isn't as if this is going to solve anything, and it isn't as if GoDaddy are blocking them unconditionally. They're just saying "we want a slice of you're ill gotten gains or we drop all your packets.

The thing is, if we let this pass, that gives lots of registrars an incentive to start eforcing the law as they see it, and for material gain. That's going to encourage them to define ill-doing on the net loosely, since they get tp shake down more nets

Are you saying that the worst murderous mobsters can operate massive criminal enterprises on a website hosted in an anarchistic country and their registrar should be prevented from denying them service?

You're either trolling, or else you're taking way too much for granted here.

For example it's far from clear that murderous mobsters are involved, let along the worst sort (unless you define unsoilicited junk email as being identical to the unlawful taking of human life, that is). The criminality is open to question too since spamming is not (sadly) universally illegal.

And that's just the domains registered to MajorDomo.ru. GoDaddy are demanding money with manaces from all those domains. Unless Majordomo have some weird negative vetting process for thier clients, then the chances are that not all of them are crooks.

I can't see how GoDaddy have any ethical justification for their actions here, and I can't think of a single pargmatic reason why we should condone their behaviour

Re:Very dangerous precedent

[asuffield]

Actually, you need some level of self-policing to curb the problem if you want to demonstrate that laws are not necessary.

That's a disingenuous myth. It's far, far better to have laws than self-policing.

Why?

Because laws come with other laws guaranteeing you due process. 'Self-policing' means a corporate does whatever they feel like to you. This GoDaddy nonsense is a classic example: $200, pay-or-be-damned, no evidence, no appeals, no way to argue your case.

The best thing of all is neither laws nor self-policing, but rather a common carrier. That's an entity which moves data for everybody and every purpose without limits, and in exchance is not responsible for any of the data they move. Sure the terrorists can use it, but that's better than government or corporate intervention. Whenever this is reasonably practical, it's better than all the alternatives. It may not be practical for the sale of firearms, but it's definitely practical for the sale of DNS names.

Re:Very dangerous precedent

[Anonymous Coward]

Hopefully I can provide a little insight into how GoDaddy "thinks" since I worked there for a couple of years. The entire company is micromanaged by the CEO Bob Parsons. You could replace "GoDaddy" in the article with "Bob Parsons" and be entirely correct. If GoDaddy does something, it's because Bob made it so.

If you've seen Bob on TV he comes off as likable and personable character. In person, he's a lot different. He's a pretty angry guy who rules by fear. I left GoDaddy for a better opportunity, but I did see a ton of people get let go for arbitrary reasons. We had something like a 300% turnover while I was there (not including the call center). I know that he has pissed enough people off that they take physical security very-very seriously for a relatively small outfit. I'm not talking about securing the servers, I mean a dozen guards (for two entrances), metal detectors, random bag and car inspections and a card entry system that makes it a challenge to just get to a bathroom.

Bob's a hard-core ultra-conservative Republican. Pro-Bush all the way. Do you remember the NBC(?) footage of the unarmed, incapcitated enemy combatants being shot at that mosque in Iraq a while back? Bob came right out and publicly praised the marines in his blog. He later toned down his language, but it is something to keep in mind when thinking about how GoDaddy justifies charging $199 to get back a $6.99 domain.

This all being said, I still purchase all my domains from GoDaddy. They are cheap and customer service is good -- but there is no way in hell that I would post this non A/C.

Re:Very dangerous precedent

[honkycat]

I don't dispute that they can do this, nor that their TOS permit it and perhaps give sufficient warning that it may happen. However, I still don't believe that "permitted under the TOS" is sufficient to make a behavior reasonable or responsible.

It's great to try to reduce spam on the internet, I'm not against that. Based on anecdotes elsewhere in the thread, though, it sounds like GoDaddy is quite happy to cast a wide net and refuse to provide reasonable review of their decisions. Financially, it's obvious why, and that undermines the legitimacy of their efforts, IMO.

Not surprised...

[__aaclcg7560]

Seriously, an outfit named "GoDaddy" was bound to say, "Who's your daddy?!"

Extortion

[aussie_a]

How is this little more then extortion? They have a thinly veiled reason, but let's say the spammers pay up. Their domain is re-activated. What then? How does that stop them from being spammers? This is just GoDaddy grabbing people willy nilly and forcing them to pay for fees they've already paid for.

Re:Extortion

[neoform]

Exactly, I had one of my domain names held hostage by them about 5 months ago. They told me they had received a complaint about spam for my domain and so I was required to pay $199USD. I told them to fuck off and wanted to transfer the domain to netsol, but godaddy REFUSED to allow me to transfer without first paying them the $200. I took me more than a month of yelling at their 'managers' on the phone who didn't give a shit about ICANN regulations before they allowed the transfer.

Godaddy's policies are terrible, they will do anything to make extra money.

Damn it!

[Anonymous Coward]

When is someone going to start running summaries through a spelling and grammar checker or even rewriting them because reading things without commas and necessary punctuation along with incredibly long sentences is extremely hard you know and this particular summary is even more confusing now because we can't tell what the submitter even meant but hey CowboyNeal just always does some copy&paste stuff without caring about the audience right and it isn't important at all if TFA is in Russian and the letter unreadably formatted.

Re:Damn it!

[Zantetsuken]

because if they souped up the form for people to submit stuff to have a spell and grammar checker, people would complain it takes anywhere from a half second on their dsl or cable modem to 2 seconds longer on dialup - and if it wasnt that, they'd complain about whatever script for it not working in Safari, Opera, etc, for that matter, it'd probably be an IE only compatible script, and not at all standards compliant...

So Sad

[PingXao]

I just renewed a domain for 2 yrs with them and I sort of regret it. GoDaddy used to be a top-notch outfit. Low prices and no nonsense. These days it's low prices and lots of nonsense. Between the GoDaddy spam, other spammers they support via special arrangements, and their incredibly convoluted ordering and pricing schemes it's no wonder they're starting to plumb the depths of sleaze.

The thing is their prices are so great it's really hard to justify going someplace else. You can pay up to $35 a year at some of the boutique registrars.

Re:So Sad

[jez9999]

namecheap.com. I have all but 1 of my domains with them, and that 1 is a .tv domain (when are they gonna become transferrable?!)

As their name suggests, they are cheap. No-nonsense management interface and they're not Godaddy, which is always a plus. Only problem is their support could be a little more responsive.

Re:So Sad

[jsmethers]

That's why I always use http://www.gandi.net/. They're both high quality and low cost. You can't beat 12 euro a year (about $15 USD) for the service they offer.

Odd.

[beavis88]

GoDaddy is usually pretty good about pointing out BS like this (eg bogus .eu "registrars", companies taking advantage of domain registration cancellation grace period, etc). I don't much like their style of advertising, but otherwise, they have been a great company to deal with on my personal domains. I'm looking for a place to migrate my business domains as well; this story has given me some second thoughts...

Re:Odd.

[bigman2003]

Sorry you don't like their advertising.

Personally, I use GoDaddy for a domain registrar, and a host in some cases.

The only reason I started was because of their commercials. A tech company willing to have totally gratuitous shots of a chick bouncing her big boobs...well, that's a company for me.

Really- I did move a lot of business there because of the chick with big boobs. I guess that makes me shallow. Or a guy who likes boobs.

You Go Daddy!

"Hostage" is just the right word

[jiggerdot]

The most fucked-up thing about this story is not the blocking of 1399(!) domains, but the fact that fact they CAN be reactivated, if only you pay 199$(!!) for "administration fees". This is not about policing the internet, it's about squeezing more money out of their customers. If this guy pays up, what prevents them from doing the same shit all over again 2 years from now? Hell, I'd like to know what their legal justification is now. Correct me if I'm wrong, but unless they are are hosting the stuff, they have no liabliity here, do they? Huh. I wonder if this can be used as an admissin on their end of being liable for content and actions of domains registered under them? Talk about watching an avalanche begin....

Re:"Hostage" is just the right word

[tomhudson]

... well, seeing as its "reactivation fees charged to the credit card on account" ... and that the REAL spammers probably used stolen cc info, they'll be going "no problem, comradeski, here's our NEW credit card info, charge away ... heck, charge it twice, you know, one for "next time", dah?".

Of course, the non-spammers end up with a kick in the head.

This isn't going to stop real spammers - they've got millions of windows slaves.

GoDaddy did this to us, too!

[Anonymous Coward]

About six months ago, GoDaddy held 78 (yes, seventy-eight) of our domains hostage. They had all of our sites down (we receive approximately 2 million web server hits per day, about 160,000 unique sessions) for nearly 48 hours while we wrangled control of our domains back.

What was their excuse?

Someone outside of our organization had (for whatever unknown reason, as this is not our business) spammed using ONE of our domains as a the spoofed header-from domain. And yes, we publish SPF records. That wont stop idiots from trying.

Anyway, I personally spent close to one hour on the phone with their "abuse" people (ironic that they consider what we were doing abusive). I explained the situation over and over to no avail. We escalated to their lead "abuse" person. Same story. "Your domain was in a spam and we do not allow this"... When I would try to explain that it was not from us or on our behalf in any way, shape, or form -- we were curtly told "that's not what we've been told."

Now, I had also received the spam complaint. Their "abuse" ("abusive") people were going solely off what was written in this complaint itself. In ALL CAPS, the user cried bloody murder about "I DID NOT SIGN UP AND DO NOT WANT SPAMS FROM THESE PEOPLE"... GoDaddy did not lift one finger to actually investigate the situation and instead took the end users' word for it.

We had to get our lawyers involved. We had to fax them threatening letters. Finally, they so gracefully allowed us to tranfer our domains away from GoDaddy to another registrar for the very low highjacking fee of $50 per domain we were going to transfer.

Again -- this was not a spam from us, for us, or by us. It was a completely third party individual just randomly choosing our domain to spoof.

GoDaddy is a goddamn scam and I hope their company gets burnt someday. It would not surprise me if the spam was created by them for the specific purpose of looting their more deep-pocketed customers through these $50 "re-activation" fees. Month getting slow? Craft up another fake spam. Fuckers.

Re:GoDaddy did this to us, too!

[Britz]

So if someone fakes my email address in their spam I get burnt for it? I have some 3-letter email addresses that I registered way back then with what has now become one of the largest free internet mail providers in Germany. Nowdays I get a lot of returns on those, because spammers tried to spam an email address that does not exist any more faking my email address as theirs and the server is requiered to send an error message.

Glad I am not with godaddy. Otherwise I should delete those accounts.

Even worse if I had a popular domain name.

Would they block hotmail.com too, because they send so much spam?

Re:GoDaddy did this to us, too!

[coop0030]

This happened to me with 10 domains. They held me hostage unless I paid some ridiculous amount.

They claimed we were spamming AOL domains, and we were not! It was a third party. They wouldn't even send me a copy of the spam emails. They would not listen to reason, or anything. It was the worst feeling being held hostage like that.

I didn't have lawyers to help me (couldn't afford them). You were lucky.

Godaddy is a scam, and an extortionist. I hope this story spreads all over the internet.

Re:GoDaddy did this to us, too!

[VGPowerlord]

Here, try this neat ICANN Registrar Complaint form. I can't say whether it's useful or not, but it couldn't hurt to fill it out.

WTF?

[Some guy named Chris]

Sometimes you read the article description, and actually know less than when you started.

This is one of those times.

OK, I've had it with GoDaddy...

[Howard Beale]

First the Microsoft migration, now this. Anyone recommend a good, inexpensive registar that supports spf?

unreliable?

[Gary W. Longsine]

" I am all for fighting spam, but given how unreliable spam black-lists are such actions simply damage the internet. "

Assuming the problem referred to in the article summary is that of false positives, I think "unreliable" is really a misleading term to apply to the blacklists. Some of them are relatively reliable at their intended purpose--helping people reduce spam by blocking sources of spam.

The problems with false positives are really an externalized cost, which accrues largely to innocent and not-so-innocent third parties, since sometimes spam originates from IP addresses or domains where other legitimate traffic exits (innocently) but sometimes the owners of those domains are supporting the spam activity directly (not so innocently). Of course, some of the costs of blocked legitimate traffic accrue to the user of the spam list, but those folks are making a trade-off and pretty clearly feel the benefits to be worth the annoyances.

Regarding the central thesis that taking actions like these "damage the internet," may I suggest that in fact the odds of "damage" to anyone are probabaly quite low, assuming that the Registrar does proper due diligence before taking such actions. They should not take the mere presense on a blacklist as gospel, but should check the domains directly themselves.

I'm also amused at the likely effect of the "fee for restoration of service". Ticked-off innocent users will be unfairly charged, and are likely to complain very loudly. Such users will probably receive an apology from a help desk worker, and free restoration of service. Guilty users are financing their operation with stolen identity and credit cards and will probably just pay the fee using ill gotten booty. (Aaaarh, Matey! Make 'em swab the poop deck instead!)

Too drastic measures

[skoval]

Working at hosting provider's support in Russia I often had to inform clients by sending e-mail's to often not valid addresses about abuse reports. Basically I get no resonse until their site has been blocked. But sometimes we even couldn't do that if abuse was for domain resolving to our customer's server.
Blocking ip's at registrar's layer for me is more preferable, but procedure of unlocking a domain is a bit frightening although. Mainly because of the response time.
And blocking so many domain names is unacceptable at all.

Re:Uh... what?

[Cyberax]

The summary is really unclear (I'm a native Russian speaker, BTW).

Majordomo uses GoDaddy for international domain registrations for some of their clients. GoDaddy has blocked 1399 accounts of Majordomo clients because of spam suspicions.

Majordomo has nothing to do with this extortion scam.

It takes more than a "few reports"

[Toe, The]

"Now all one needs to shut down a site is a few reports of spamming, and the domain (or even better, all domains of a given small registrar) will be suspended."

This demonstrates a poor understanding of how blacklisting works and how anti-spam actions are taken. Spammers who have actions taken against them usually have thousands of reports against them, from hundreds or thousands of disparate sources, over an extended period of time.

Re:It takes more than a "few reports"

[NormalVisual]

I would say that you've never had the pleasure of having to deal with being blacklisted by an unreasonable asshole.

I host my own mail and that of a friend. My friend was getting messages back from a couple of servers indicating that delivery of his mail was being denied because his (i.e. my) server was on the Abusive Hosts Blocking List (AHBL). Now, given that I have a very locked-down and tested qmail install and I'm providing valid SPF records from my DNS, I was a little perplexed. I got in touch with AHBL and was told that my entire IP range was on their blacklist simply because they had a beef with a particular spammer that operated from Time-Warner's network. I pointed out that this was a problem that concerned a completely different geographical area in TW's IP range, and that my IP was a static address within TW's business-class ranges. They basically said they didn't care, as my IP address belonged to TW, not to me, and because of that they absolutely were not going to unblock my IP address. It seems to me they consider their little infantile vigilante crusade against TW to be more important than anything else, even when it's pointed out to them that they are recommending the blocking of legitimate servers.

Spam is certainly an annoyance to me (close to 1K every day), but I can't afford the possibility of losing valid e-mail because some idiot spam list admin has some kind of ideological problem with an ISP, so I don't use blacklists. I can't say that Spamhaus is any better or worse, but as far as I'm concerned, the staff at the AHBL (and Andrew Kirch in particular) can go fuck themselves with a large, jagged, rough-surfaced object.

Re:Uh... what?

[Anonymous Coward]

The fact that they're saying "Just give us a little money and these complaints will disappear" makes the whole thing even shadier.

Re:Wrong.

[therblig]

We were bitten by Spamhaus not for our actions, but for the action of an individual with an open relay occupying an adjacent IP address range. Spamhaus blocked the entire thing. I emailed them our domain whois and the snobby little bastards at Spamhaus brazenly told me that we were indeed the spammer and that we need to "clean up [our] act" before they would do anything. They went on to talk about "spam payloads"... WTF?!

I don't know about the yacht in international waters, but I agree that Spamhaus wreaks havoc on organizations that have done nothing wrong. Our organization has been black listed before too, and it was in error. It finally got cleared up, but it is still damaging.
We stopped using RBL's a long time ago, and have swtiched to something called Securence http://www.securence.com/. It has been much more reliable than RBL's, and keeps the junk from ever getting to our server in the first place. I haven't had a complaint about a false positive since we switched, and it blocks over 100,000 spam/viruses/phishing attempts a day.

More profitable for you to leave than stay...

[mgkimsal2]

That's a shame. I've got a lot of domains with godaddy.com but am testing out other registrars and will be migrating more away. It's not just these sorts of reports, but also their switch to Microsoft IIS for parked domains that bothers me some.

The sad thing is that this sort of thing on their part really won't hurt all that much. How much money would they have made on each of your domains for the next *10* years? $30? I'm basing this on $3 profit ($9 - $6 wholesale cost - maybe it's different for them?) By forcing you to leave they've almost doubled that, and they don't have any work to do to service you for the next 10 years either!

If they could simply extract $50 from every single domain-name-only customer to transfer away they would be *far* more profitable than they are now because there'd be less overhead and work to do.

I abhor the IRS, but would still say yes

[Mostly a lurker]

Are you saying that the worst murderous mobsters can operate massive criminal enterprises on a website hosted in an anarchistic country and their registrar should be prevented from denying them service?

Some people may have valid reasons to access government sites.

Simple solution

[Joe U]

Pay the $50, move your domains, chargeback the $50 and/or file a suit in small claims court.

They'll dispute the filing and keep pulling out parts of their license agreement to counter it. Dispute the agreement as being invalid. When all is said and done, you'll be out a few days of work, GoDaddy will have wasted a ton on lawyers.

(Disclaimer: I am not a lawyer, this is Slashdot, use common sense, this is not advice, you are feeling sleepy...sleepy...SLEEPY...you want to buy me a 50" HDTV.)

Re:Simple solution

[Ossifer]

Unfortunately you can't do a chargeback on this, unless you lie to your CC company. When you pay the $50, you have agreed to the charge, and (probably) do receive the service you pay for. I like the other route though. File cheaply in a local small claims court, file for the maximum small claims amount, and wait for godaddy to react. If the don't, profit! Or, if you want to be serious about it, file a charge of extortion with the FBI, and file a civil suit for extortion too...

Anecdote: Godaddy Has Impressed Me

[Apple Acolyte]

I'm going to have to go a bit farther in researching this matter than reading the headline, but my tendency is to give Godaddy the benefit of the doubt. That choice has been influenced by unfortunate events that gripped my father's organization. A year ago some former members of my father's organization decided to end their affiliation with us, except that they chose to attempt a hostile, unlawful takeover instead of forming a separate entity. This minor faction concealed considerable resentment for us prior to the break-away, and they believed that they would be able to easily compel us to acquiesce and hand the corporation over to them. Settlement would not come easily. Long story short, after a year long legal battle and a year's worth of high-priced lawyer fees, the other side got crushed in a pre-trail ruling and had to begrudgingly accept our (relatively) generous terms.

Now here's the Internet angle: A few months into the conflict, they started targeting our web hosts and domain registrars with unlawful DMCA notices and other underhanded legal tactics. We had been advised by one of our attorneys to go with Network Solutions instead of the smaller registrar we had been with since our domain's original creation; we chose to take the legal advice despite my grave misgivings. Predictably enough (given the myriad of horror stories about the company), Network Solutions locked down our domain on the basis of the opposition's lawsuit and refused to unlock it until the termination of legal proceedings. Plus, our domain was locked down while its DNS record pointed to a hosting company that also denied us service. It was terrifically devastating to effectively lose our domain and site for that period, as it had been our official domain since 1996. As for Godaddy, once our site got taken down indefinitely we transferred over to one of our secondary domains that was registered with Godaddy. Godaddy never took action against that domain - we never even got notice from them about the mater despite the fact the opposition obviously attempted the same maneuver against Godaddy that it used on NetSol. The only troubling thing about Godaddy's service was an automated message sent to us concerning an illegitimate challenge to our DNS contact information. Notably, the message claimed to give us only a few days to respond to the challenge before Godaddy would take action, which could have included registration deletion. We were able to take care of that issue with one phone call, and we were even given an unusually candid apology for the previous notice. Nonetheless, that experience was disconcerting. Despite that occurrence, Godaddy did not falter for us even in those adverse conditions, so I'll be staying with it unless and until it no longer merits my appreciation. (And for less important domains, I use the slightly cheaper 1and1.)

Spamhaus blacklisted Google GMail. :-(

[JohnWasser]

Mail Delivery Subsystem to me Jun 15 (2 days ago)

This is an automatically generated Delivery Status Notification

Delivery to the following recipient failed permanently:

        xxxxxxx@frontiernet.net

Technical details of permanent failure:
PERM_FAILURE: SMTP Error (state 9): 554 Sorry, your mail server (py-out-1112.google.com[64.233.166.178]) is rejected using sbl-xbl.spamhaus.org. See http://postmaster.frontiernet.net/error.html#sbl-x bl

    ----- Original message -----

Received: by 10.35.115.18 with SMTP id s18mr2328477pym;
              Wed, 14 Jun 2006 21:52:32 -0700 (PDT)
Received: by 10.35.97.6 with HTTP; Wed, 14 Jun 2006 21:52:32 -0700 (PDT)
Message-ID:
Date: Thu, 15 Jun 2006 00:52:32 -0400
From: "John Wasser"
To: "xxxxxxx"
Subject: Re: printer setup repair
In-Reply-To:
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References:

Re:Spamhaus blacklisted Google GMail. :-(

[SD_92104]

As it should -- Gmail isn't passing on the X-Orig mailer field, which is why they got spamlisted.

Cool - now non-standard headers (the X- prefixed ones) are all of a sudden required? Interesting interpretation of standards...

Re:Spamhaus blacklisted Google GMail. :-(

[McDutchie]

PERM_FAILURE: SMTP Error (state 9): 554 Sorry, your mail server (py-out-1112.google.com[64.233.166.178]) is rejected using sbl-xbl.spamhaus.org. See http://postmaster.frontiernet.net/error.html#sbl-x bl [frontiernet.net]

This "evidence" appears to be fabricated. The IP address 64.233.166.178 is in fact not listed on Spamhaus at all:

$ host 178.166.233.64.sbl-xbl.spamhaus.org
Host 178.166.233.64.sbl-xbl.spamhaus.org not found: 3(NXDOMAIN)
$

or see the web lookup query at spamhaus.org.

Could be interesting

[bobamu]

after all, they claim they are targeting "russian spammers".

and now they are trying to extort money from them.

I find potential scenario amusing.

Re:Very dangerous precedent, or is it?

[Anonymous Coward]

I remember doing whois lookups and digs, and with the domains resolving back to GoDaddy as the register from time to time, I would complain to them for allowing registration of what were obviously domain names for spamming or mlm purposes which always turn out to be spam related as well. So I'd be putting pressure on GoDaddy for allowing the registrations, for not having software to look for obvious spam names within the domain names they currently register, and for other actions that enable or provide refuge to spammers.

That being said, I'm also on the other end currently. One of the domains I'm hosting has the word "ebay" within the domain name. I never even realized this. The domain name is also a legal, currently registered and operating corporation within the US. It's been in business more than two years. Its line of business has nothing to do with spam, it deals with supplying certain metal goods to large distributors and large end users within the US and elsewhere. It's the type of business where you confirm the customer is a large end user or distributor, and upon doing this, you don't have a problem sending them several thousand dollars in samples, hoping they'll place blanket orders for years into the future. Without having the knowledge on running a mail server, and currently without the resources for a secondary dns on another ip block, it was decided that GoDaddy would be the host for the mail server for the domain.

A few test emails from the business domain, with an email address that is obviously business related (sales@legitdomain, a few others), everything went through without a problem, great. Add email address to invoices, statements, shipping documents, product packaging, start using to communicate with new customers, suddenly a problem. Turns out if the email contains a couple of email addresses within the body, or if the email contains a couple of urls with certain keywords (keywords normally related to some of the customers' business lines), more than two urls, a combination of an email address and a url, and the emails would be rejected. GoDaddy's smtp server wouldn't accept the email for sending. Not that it would bounce, it would outright reject the email.

Trying to get GoDaddy's tech department just to understand what was going on was difficult. Forward the bounce message. There is no bounce message, the smtp server is outright refusing to accept the email as it is being sent. Send the error message of your email client. Email client is KMail. Here's the instructions for Outlook. Email client is KMail. Here's the instructions for Mozilla mail. Email client is KMail. Here's a screenshot of the popup error message you requested. You're using a non-standard email client. Here's the instructions for outlook. Please send me responses in plain text instead of html. Sorry, our email is sent in html. Please don't send me instructions in .doc format, send in .txt or .pdf. Sorry, .doc format is all we have, here's a link to our internal documentation. Great, how do I get passed your firewall to view a GoDaddy internal documentation link?

That's just the first few attempts to get the email working. Next, we received every excuse known to man for why mail was being blocked. Your domain is blacklisted by the RBLs. No its not. Your domain is blacklisted by Spamhaus. No, its not. Your ip is listed in Spamhaus. No its not. Your ip block is listed in Spamhaus. No, its not. The email domain you are sending your email to is listed in Spamhaus. Are you serious?

Actual email trouble ticket response:

Thank you for contacting customer support. The error message received is related to our anti-phishing software, which blocks known spammer links from being sent through our system. It primarily blocks links from sites listed on http://www.spamhaus.org/ (also blocks our own "spammer" database).

I will back this up.

[SlashChick]

Since the parent comment was written by an anonymous poster, I would like to add that one of our customers was put in the same situation by GoDaddy. His domain was used in a "joe job" (that is, someone sent out a spam with nonexistent addresses from his domain as the From: header in their spam emails.) He called us (his web hosting provider), furious, wanting to know why his domain name was down. We had received spam complaints as well, but since the spams were not from him and were not advertising his product (he runs a legitimate business that does not use email marketing), we did not shut him down. However, when running a quick WHOIS check on his domain, I noticed that GoDaddy had set his name servers to NS1/NS2.SUSPENDED-FOR-SPAM-AND-ABUSE.COM. This was well over a year ago and since then, I have urged all of our customers to switch away from GoDaddy. Some of our customers have responded, "But I don't spam anything!" Of course you don't. It doesn't matter. If any spammer sends out spam with your domain as the From address, even if you had nothing to do with that spam, and it gets reported to GoDaddy, your domain is toast.

For what it's worth, we use eNom and have never had any problems with them. If you host more than a few domain names, get an eNom reseller account (many providers offer them for free) and pay the same price as GoDaddy. I recommend them highly; we have several hundred domains with them right now.

Re:Spamhaus blacklisted Google GMail. :-(

[Wavicle]

This "evidence" appears to be fabricated. The IP address 64.233.166.178 is in fact not listed on Spamhaus at all:

The fact that it isn't listed NOW does not mean it wasn't listed THEN.

I have had spamhaus block email from yahoo too. It has been for me quite a conundrum deciding if the the false positives spamhaus gives outweigh the true spam it blocks. They do generally fix these within a couple hours, but it is really frustrating that during those couple hours, all email going to my mail server from yahoo is getting bounced because someone or something at spamhaus caught someone sending spam.

GoDaddy Has a History of These Things...

[I*Love*Green*Olives]

This isn't the first time GoDaddy has arbitarily done things like this....

Lindsay Ashford, a promient memeber of the Paedophile community was once registered with GoDaddy until they started to yank his chain and play games with him using Section Seven of their Domain Registration Agreement--specifically the bit about morally objectionable activities. Lindsay was given 24 hours in which to move the site (which he began to do) only to be informed via email the change over was blocked from GoDaddy's end without explaination. The strange thing is while there was never any child porn or illegal content on puellula.comand GoDaddy never explained their actions, the site was also home to many racists and extremists hate sites that were apparently never a problem. It finally took a complaint from Lindsay to ICAAN before the domains were finally restored to him!

GoDaddy is run by people who see no evil in groups such as: Skinheads, Hammerskins, Aryan Nations, White Camelia Knights of the Ku Klux Klan, Ku Klux Klan all whom were still registered with GoDaddy as of roughly this time last year. Given the legal wrangling it took to get the company to turn over the domain names to their proper owners, why would anyone be surprised when they decide to dip into the extortion racket?

Do yourself a favor and find a domain register who is willing to take care of their customers and isn't run by a bunch of racists who think we haven't done enough torture on the Guantanamo Bay prisioners!

--I*Love*Green*Olives

Re:This story is pure bull-crap.

[saikou]

Funny but your comment seems to be a typical response from anti-SPAM vigilante that prefers to blacklist everything, no matter what the real situation is.
I included in the article link to black list of Google mail relays. Would you like your Google mail be blocked because someone claims that Google is a safe haven for spammers as it "either sent mail to our spam traps or we received reports from our members of spam"?
Oh, I forgot. You work for an ISP so you don't care. But it would be interesting to see your reaction if your whole subnet gets blocked because ISP on the adjacent net got flagged as "does not react to SPAM reports" and block list would escalate original listing to a bigger subnet. I am sure you have enough time and money to quickly move to another upstream provider in a blink of an eye. Or somehow magically clean up your particular subnet over typical "Oh, but you're too close to spammers, you must be spammer yourself!" battle cry.

This particular article was about GoDaddy relying on Spamhouse for deciding what accounts to block until $50/$199 fee is paid. There are tons of discussions about black list reliability and false positives. Primary difference with spam flagging/blocking is users chose to do it. But here someone else made the decision and demanded payment.

Would you like Google.com to suddenly disappear from the DNS because Spamhaus flagged some of their IPs as "sending spam"? I am sure you would.

Bob Parsons contributes to online vigilantes.

[Chatmag]

Bob Parsons, owner of GoDaddy, contributed $10,000.00 US to Perverted-Justice.com, an online vigilante group. Perverted-Justice is the group involved with Dateline NBC. Media groups and journalism scholars have taken Dateline NBC to task for journalism ethics violations regarding their involvement with Perverted-Justice.

GoDaddy tried to scam me last month also

[dookie01]

I have a domain with them, and suddenly stopped receiving any email for a few days. So I contacted them to findout what was going on, they said it appeared I was using the domaing for sending SPAM and they have launched an investigation to evaluate the content of the emails sent. I was confused so I looked into it and saw that the SMTP mail forwarding was open on my server and a spammer started using the account. GODADDY by default sets this as PUBLIC. So I contacted them to tell them what was going on and they told me my account might be suspended if I violated TOS. I explained I send around 3 emails a month on my account, and what had happened, but they just kept responding that it is being investigated. At the time I didn't know what was going on, but now I get it. I will be forwarding all my domains registered with back to Network Solutions, I am not a fan of sleezeball operations and extortion.

Re:Spam is legal

[SillyNickName4me]

Honestly, I'm all for the use of online marketing that allows you to, and respects your right to, opt-out.

I have no problem with online marketing, but I have a problem whenever it is not opt-in (with a decent check on if you indeed tried to opt-in)

There is no reason why people should fill my mailbox and use the bandwidth I pay for to tell me something I don't want to hear to begin with. Now, if they were paying for it themselves exclusively this might change, but for now I pay for the bandwidth usage of my mail server.

Digg

[wbren]

Well, here's a story you won't see on Diggnation.

"This week's episode of Diggnation is brought to you by GoDaddy -- The people who are probably holding your domain hostage right now."

Actual Hard Info

[Spazmania]

Since the article is heavy on claims and light on the basis for those claims, I thought I'd dig in to it a bit. Turned out to be a difficult. I couldn't find the registration agreement via Godaddy's web page. I had to search Google for it.

http://www.godaddy.com/gdshop/legal_agreements/sho w_doc.asp?se=+&pageid=REG_SA

Section 7 is the one that deals with spam. Here's what it says:

7. restriction of services; right of refusal

You agree not to use the services provided by Go Daddy, or to allow or enable others, to use the services provided by Go Daddy for the purposes of:

        * The transmission of unsolicited email (Spam).
        * Repetitive, high volume inquires into any of the services provided by Go Daddy (i.e. domain name availability, etc.).

If You are hosting Your domain's domain name servers ("DNS") on Go Daddy's servers, or are using our systems to forward a domain, URL, or otherwise to a system or site hosted elsewhere, or if You have your domain name registered with Go Daddy, You are responsible for ensuring that there is no excessive overloading on Go Daddy's DNS systems. You may not use Go Daddy's servers and Your domain as a source, intermediary, reply to address, or destination address for mail bombs, Internet packet flooding, packet corruption, or other abusive attack. Server hacking or other perpetration of security breaches is prohibited. You agree that Go Daddy reserves the right to deactivate Your domain name from its DNS system if Go Daddy deems it is the recipient of activities caused by your site that threaten the stability of its network.

You agree that Go Daddy, in its sole discretion and without liability to You, may refuse to accept the registration of any domain name. Go Daddy also may in its sole discretion and without liability to You delete the registration of any domain name during the first thirty (30) days after registration has taken place. Go Daddy may also cancel the registration of a domain name, after thirty (30) days, if that name is being used in association with spam or morally objectionable activities. Morally objectionable activities will include, but not be limited to: activities designed to defame, embarrass, harm, abuse, threaten, slander or harass third parties; activities prohibited by the laws of the United States and/or foreign territories in which You conduct business; activities designed to encourage unlawful behavior by others, such as hate crimes, terrorism and child pornography; activities that are tortious, vulgar, obscene, invasive of the privacy of a third party, racially, ethnically, or otherwise objectionable; activities designed to impersonate the identity of a third party; and activities designed to harm minors in any way. In the event Go Daddy refuses a registration or deletes an existing registration during the first thirty (30) days after registration, You will receive a refund of any fees paid to Go Daddy in connection with the registration either being canceled or refused. In the event Go Daddy deletes the registration of a domain name being used in association with spam or morally objectionable activities, no refund will be issued.

Okay, so there are some pretty nasty things in there. One thing I don't see is where they say they'll hold on to the name, refuse to let you transfer it or charge you an extra fee. In fact, they're quite specific: If you spam, they cancel the registration. Period.

I also read the supposed letter from godaddy at http://majordomo.ru/about/letter.htm . Maybe its just me, but the letter smells false. That's not the careful legal language I would expect from a company Godaddy's size faced with this sort of situation. I'm not discounting the possibility that its real, but it smells false. If I saw that letter in my inbox, I'd suspect phishing.

good alternatives to GoDaddy?

[alizard]

While I despise spammers, the idea of using a domain registrar who is likely to unplug me because some third-party spambot owner decided to use one of my domains without my permission as a spam address makes me even more unhappy... and at least one of my domains comes up for renewal in the next few weeks.

So who's a good, low-cost registrar with no relationship to GoDaddy?

Since I'm serious, please don't respond with "Network Solutions".

Re:good alternatives to GoDaddy?

[Electrum]

So who's a good, low-cost registrar with no relationship to GoDaddy?

http://www.domaincontender.com/

They are a rebranded directNIC (one of the top ten domain registrars).

the problem isn't spamhaus

[alizard]

It's godaddy using spamhaus for purposes no sane person would believe is a good idea. AFAIK, there's no way a domain service provider can check in advance whether or not any given domain name applicant is or is not a spammer, anyone on the ROKSO list can use a fake business name in order to get a domain.

Gaming what godaddy's doing to unjustly shut down a domain (or in this case, 1399 domains) is just too easy.

Imagine having a legitimate website and having it shut down because godaddy has shut down your domain service provider. There are probably several hundred Russians in that position right now.

Best registrar...

[SonicSpike]

...by far is DirectNIC.
$15 and no bullshit.

To me they are like the Google of registrars - "do no evil".

They even are based out of NOLA and had very little if any downtime during Katrina. You can read about it and see damage to their building here:
http://interdictor.livejournal.com/

in other words

[alizard]

You support Godaddy shutting down domains that are inadvertently associated with spam due to actions unconnected to people who bought domains in good faith from them or a downstream provider unless they're yours.

This isn't the equivalent of a property owner evicting a tenant for drug violations, this is the equivalent of a property owner evicting every tenant in one of his buildings because one tenant is dealing drugs.

AUP Enforcement is the RIGHT way to eliminate spam

[Kisofdth]

AUP Enforcement is the RIGHT way to eliminate spammers. I have also worked at a large ISP, and this is one of the best ways to fight spammers. Keep making it costly and more trouble for them than it is worth. Spamhaus is far and above the most reliable RBL in the world today and does more to help in the fight against spam than any other organization I know of. They are VERY reliable in only listing sites and domains with proper justification, and even more important deal with proper cleanup and removal of listings that have been remediated in a timely fashion. The reason you hear all the complaints about RBL's is because they are so effective. Yes, there is the occasional person that gets burnt because of their space being adjacent to spammers, but this also helps ISP's keep pressure on their clients to stay clean to prevent such over blockage. I'm personally familiar with one client of a large ISP that had a hard time kicking a known spammer off of their network due to a long pre-existing contractual obligation, that was able to finally disco them due to Go-Daddy's listing and blocking of dozens of their domains last year. Great job Go-Daddy! Keep it up, us regular users love to see you support your AUP!

Re:Spamhaus blacklisted Google GMail. :-(

[Dolda2000]

It's not interesting at all, only perfectly as it should be. RFC 2821 explicitly says to leave all headers be, exactly as they are. From section 3.7:

As discussed in section 2.4.1, a relay SMTP has no need to inspect or
act upon the headers or body of the message data and MUST NOT do so
except to add its own "Received:" header (section 4.4) and,
optionally, to attempt to detect looping in the mail system (see
section 6.2).

In other words, an SMTP server shouldn't even look at the headers, even less modify then, be they X-* or not. (The funny thing is that section 2.4.1 doesn't seem to exist, though...)

Dreamhost

[robla]

Dreamhost is only a dollar more per year, and includes privacy guard as a base-level feature (which costs $1/year on GoDaddy), so they're arguably the same price.

Rob

bluehost

[Travoltus]

And they respect the privacy of your information, too.

1 of 1399

[romantikc p. m.]

I'm the owner of one of those 1399 blocked domains. I assure you all the details in the original article are correct. I, my domain, e-mail, website and anything else owned by me has absolutely nothing to do with those 2 spam activities GoDaddy refers to. And I'm pretty sure the other 1398 domains has nothing to do with spam either.

For those who don't get it, I repeat: Majordomo is not "an underground spam network in the anarchist country". If you think this way, take your nose out of computer and travel the world, it's much different from what you think. Majordomo is a legal and respectable company (yes, it's reselling GoDaddy's services). On my part I'm an independent Mac shareware developer. Thanks Majordomo, now these domains are unblocked.

GoDaddy's actions look like, feel like, smell like, and in fact ARE real extortion. It's absolutely clear, this is one of their ways to earn money. This time they went too far, probably thinking that if Russia is far abroad, such actions won't be noticed. I would recommend to everyone never have any business with GoDaddy, and those who already use it as a registrar, switch immediately.

Did I get any response to my e-mail to GoDaddy? No. Did I get any excuses for their actions? No. Will I get a reimbursement for the loss of profits? No. Anyone who had the same problems with them, send a report at internic and FBI websites, and I hope that scum will be shutdown.

Re:Spamhaus blacklisted Google GMail. :-(

[Cramer]

This is exactly why I explicitly ignore the SORBS SpamTrap RBL. All it takes is ONE "spam" message EVER to be listed FOREVER. It doesn't even have to be spam; any message to one of their fly traps is all it takes. (they are such asses about it, too.) And they LIE about the process to get delisted -- "oh, nobody pays that 'donation' anymore..."

Basically, SORBS is pissed at gmail because they don't do any outbound anti-spam inspection. (distributed sender database thing. I'd have to dig through my email to find exactly what they insist everyone run.)