Tell HN: Never search for domains on Godaddy.com

[wasteme]

searched a few days ago for felons.io, looked for unique names for simple game didn't know if I wanted it or not

guess godaddy decided for me: 1 days old Created on 2020-09-16 by GoDaddy.com, LLC

just a warning if you have a special name do not use godaddy to check if its available

[dang]

There's a detailed response here: https://www.godaddy.com/garage/godaddy-felons-io-unregistere...

currently discussed at https://news.ycombinator.com/item?id=24523901.

[ted0]

Ted from Namecheap here.

I cannot speak to GoDaddy's practices. However, I can say that for Namecheap, this is not something we would ever even consider doing.

In my experience though, lookups are more complex than most think. We are querying so many different sources to give you availability status, some of which are less reliable than others. For example, with smaller TLDs like .ai or .is, lookups may be less reliable than a well-oiled machine like Verisign, which operates the .com and .net TLDs, among others. As a result, sometimes with a less reliable registry, there can be false positives, resulting in the registrar showing a domain as "available" when it is actually registered.

In addition to registry connection reliability, there are also many different aftermarket sources that registrars often pull from. You know when you see a Premium domain (registered and usually higher priced) in search? That could be coming from any number of 3rd party aftermarket platforms, which also can have varying reliability and/or stale listings.

Lastly, you have to consider that some registrars handle the "drop window" differently than others. If a domain deletes and is removed from the zone, ergo, becoming available again, some registrars have a buffer period before they show it as available again.

It does not appear that Felons.io had ever been registered before, which makes this case pretty strange.

[Marc_Bryan]

They are a bigtime scammers. Recently was assisting a friend to get access to a domain name which was registered in godaddy. They scammed him for a couple of hundred dollars for contacting the domain owner to get a deal on the domain and eventually nothing happened. Not even a mail was sent on behalf the scammed money as we found that the domain was owned by another friend and eventually got it transferred. He confirmed that he has not received any mail from godaddy's domain buy service since the contact was under privacy protection. Another scamming method to siphon money from people.

To make it more clear, if you need a domain which is registered in godaddy and has privacy protection enabled, please do not pay money to godaddy to broker a deal on behalf of you with the existing domain owner. They take huge sum of money, do nothing and stop responding. It's like giving your hard earned money for free to these godaddy scammers. One of the worst registrars and I don't want to open another can of worms with their really really bad service (hosting, emailing and all such services!)

[echelon]

Back when I was in college, GoDaddy let my at the time close friend break into my account and steal several of my domains, including https://strategywiki.org. This was while I was on an overseas study and couldn't regularly check in. GoDaddy gave me no recourse to dispute.

He had server access because I trusted him. He wasn't supposed to have access to my domain account, and I didn't share my credentials.

I had another friend on the account because I was paying for his domain and wanted to let him administer DNS. They conspired together and were able to leverage this access and the lack of account ACLs to transfer everything away.

This was well over a decade ago.

They never invested in StrategyWiki, so it never realized the vision I had for the site. I had started to pay contributors and invest in content to bootstrap.

This guy came from the MediaWiki purge of video game guides and felt like he owned and deserved the site, despite the fact that I had created most of the original content. He was ten years older, well paid, and threatened me with a lawsuit. I was a college kid and couldn't do anything.

I learned a hard lesson. It's stuck with me.

[tehwebguy]

They defrauded you & violated your copyright. If the SoL hasn't passed you might want to consider filing a police report. It's possible that you could get the current registrar to give it back.

It seems like they are still violating your copyright, so you might be able to go that avenue if the SoL keeps refreshing as they keep violating it (not sure though).

GoDaddy has terminated accounts on copyright grounds before, and you could also file a civil suit if you think you could withstand the cost / pain of it now.

(That said, sometimes it's better to just walk away)

[jefftk]

That sounds really unpleasant! It's not clear to me, though, what you're saying GoDaddy did wrong?

[smithza]

Sounds as though they weren't great friends. Sorry to hear of this.

[tomhoward]

This sucks and I feel for you. But the sad fact is that domain registrars have been doing this ever since domain names became big business in the 90s.

As a PSA to everyone, you should only ever use whois in a terminal window to see if a domain is available.

It's included with macOS, Windows (?), Linux or any other OS anyone's likely to use. [Edit: a reply says it's not included in Windows. It seems you can download it free here: https://docs.microsoft.com/en-us/sysinternals/downloads/whoi...]

I guess ICANN's lookup tool (https://lookup.icann.org/) is probably more trustworthy than commercially operated ones; it would be a terrible look for them to engage in this practice.

But I always feel much safer using whois in a terminal than any website that can see what I'm searching for.

[xoa]

I also wanted say "consider whois", but with a few more caveats. First, obviously the whois server you use matters. There is nothing magical about whois that stops GoDaddy from doing the same thing if you query whois.godaddy.com, you still need to talk to someone less likely to engage in this like going directly to InterNIC's, whois.internic.net (still I think under the US DOC, which whatever other flaws it has isn't really scrounging for change there).

>But I always feel much safer using whois in a terminal

Also as a minor FWIW, there are plenty of simple GUI's (often built-in) on whois as well so someone can just use one of those if they prefer. macOS for example still has some of the old useful utilities included for free including in this case Network Utility, though for whatever reason Apple moved them out of /Applications/Utilities and into /System/Library/CoreServices/Applications (that's also where a pile of other useful ones went).

[innocenat]

> It's included with macOS, Windows, Linux or any other OS anyone's likely to use.

Is it? I don't think it is included on Windows --- it is available on sysinternal, sure, but not included. (Unless something has changed from when I stopped using Windows)

[andylynch]

I’ve started using rdap first for this kind of thing partly because it works in browser and also because corporate firewalls like to block whois. Having a standardised response format is also really nice.

[christophilus]

Namecheap and Dreamhost are both top notch and would never do this.

[pronoiac]

> As a PSA to everyone, you should only ever use whois in a terminal window to see if a domain is available.

A month or so ago, I discovered .wang was a TLD, and I immediately brought it up with friends, and we spent some time happily and goofily brainstorming. I'm not sure about the exact count, but after dozens of queries, whois started returning errors for too many requests.

[mratzloff]

I've never had this issue with Gandi.net. They are excellent.

[rozularen]

Yes, namecheap is also sketchy had some trouble when I tried to renew a domain I bought with them then I tried to transfer it to Google domains to only have it blocked

[andylynch]

This is a scummy move. In the industry I work in, we call this front-running and it’s a criminal act. If the same laws applied here godaddy would be looking at a nine digit fine and jail time for whoever thought this is a good idea.

[jnwatson]

It is called front running in DNS too, and it is perfectly legal.

[bitxbit]

That gave me a chuckle. I take it you work in finance and a subtle form of front running is literally what bulge bracket trading desks do day in day out.

[bhartzer]

But I don't see any proof that GoDaddy is the registrant of that domain, they're just the registrar. I don't see any evidence of front-running in this case. I see it more as coincidence if anything else.

[mdorazio]

I had this happen as well in the past when researching domain names for a new product.

Pro Tip: Stay the hell away from GoDaddy for everything. I've had the unfortunate task of managing a server hosted with them and it's been consistently awful (ex. I literally cannot upgrade PHP because the VPS doesn't support it and there is no upgrade path without spinning up an entirely new VPS on a different, and of course more expensive, plan). The constant upsells on garbage are basically predatory at this point, too.

[cloudwizard]

Whenever I talk to startups, I check their domain. If they are on GoDaddy, it means that they are technically incompetent.

[wenc]

Godaddy spammed me so much and so often that I transferred my domain to porkbun.com.

It's been so problem-free that I couldn't even remember the provider's name -- I had to WHOIS my domain to figure out who was hosting it.

[tzfld]

Gave up Godaddy recently, after 10 years. Overpriced ssl, old php version and no sign for upgrades and improvements.

[pkphilip]

I have had serious issues with Godaddy as well. Absolutely horrible performance as well.

[mc32]

Then they must hand select the ones they frontrun because I’ve looked up silly names to see if they did this )like a bunch of random stupid queries like bvrankdorfgherbd.com and I don’t think they squat those. Of course I’m still leery and never use them to search for my actual target domains.

[mark-r]

I have no choice, they bought out my hosting provider a year ago.

[aerovistae]

Recommendations for superior alternatives? I'm an indifferent GoDaddy user but would be happy to switch to something else since I've never liked them as a company.

[whyaduck]

The spirit of GoDaddy's founder soldiers on in it's current policies and behaviors. Disappointing but unsurprising.

[rgbrenner]

Called domain front running

https://en.m.wikipedia.org/wiki/Domain_name_front_running

[4cao]

I was always expecting something like this to be going on, so I'd never use any Web-based availability-checking tools but then I also tend to be a bit paranoid at times.

Yet now it turns out not only is this established practice, there is even a Wikipedia entry on it.

"It's only paranoia if they're not really after you!"

[dgellow]

I faced this ~6 years ago. Someone hired me for a project, at some point he told me some domain names he had in mind, and we looked them up together on Gandi, GoDaddy and other registrars to see prices and what was available. The next day he called me in shock, asking me why I bought the domain and if I'm trying to steal his company, etc (nobody else knew the names). Of course I didn't buy anything, we checked the whois and it was registered for GoDaddy... That was a quite bad experience...

[tzs]

The way I check prices at multiple registrars is to check the price on admrgbldflkrjanjscknadsc.<tld> instead of <name_I_want>.<tld>, where admrgbldflkrjanjscknadsc is just a bunch of random keyboard mashing.

I do not enter <name_I_want>.<tld> into any registrar until I am actually attempting to buy it from that registrar.

[snapetom]

This is just part of a long line of scummy practices by GoDaddy in its history. Bad PR for GoDaddy constantly popped up in tech news sites ~15 years ago, but it was never enough to stop their aggressive marketing. Still, I always wondered why anyone in tech would use them. Y'all know what they're capable of and what they do. Don't support that.

[wegs]

As far as I can tell, the general business model in domains is:

* Be the good guy, and establish a customer base. Provide low prices, good customer service, etc. Lose money on the razor-thin margins.

* Once you've got a ton of customers, turn evil, and milk your customer-base for all they've got. Engage in every nasty sleazeball tactic.

I've seen this cycle many times, starting with Network Solutions.

People use GoDaddy because they were the good alternative for a while.

[cnst]

The amount of upselling GoDaddy does is kind of crazy; I don't know why anyone would register domains there.

They've also been implicated with a few stories around blocking DNS services for certain whole countries, voiding domains without any proper court order, etc.

[nerdponx]

I don't think people in the tech world use them. People in the non-tech world trying to do tech (e.g. small business owners) use them because they are the only hosting company and domain registrar with name brand recognition.

[bleepblorp]

Some TLD registries have policies to prevent registrars from front-running their clients by squat-registering their domain searches.

But, if you're working in a TLD where Freedom<tm> is more important than actual free markets, do your domain checks against the root servers yourself with dig +trace.

[fanf2]

Be warned that a domain can be registered without appearing in the DNS.

In recent years IANA has run a whois server that provides referrals to the appropriate registry, so in most cases a whois client can start by querying whois.iana.org and follow whois: or refer: lines to the right whois server without leaking too much information. (whois is still cleartext and a very crappy poorly-defined protocol...)

FreeBSD's whois mostly works by following referrals with heuristics for filling in the ghen that doesn't work; Debian's whois mostly uses a built-in database of whois servers and heuristics for finding them.

[thiht]

For most non-ccTLDs, that's regulated directly by the ICANN. It's pretty easy to file an ICANN complaint, FWIW.

[roosgit]

I never experienced this, but I did wait too long to buy a domain. After I checked if the domain was available(it was), I started building the website. A month later the domain was bought by someone who eventually made the same thing I wanted to make.

My current process for checking if a domain is available is pretty basic. I first check it in the browser. If Firefox can't find it, then I use the `whois` command. If there is no match for "example.com" then I decide if I want to buy it, before starting to build anything. If I do decide to get it, I go to Hover.com do a final check and press "Add to cart".

These days, for me it's better to spend $15 on a domain that might not get used, than to regret not buying it.

[_nickwhite]

I learned this _years_ ago that Godaddy will steal your name for fun and profit. As the HN comments confirm, there are several shady outfits that do the same thing.

For years, I've gone to ICANN directly to check domain name availability: https://lookup.icann.org/

[gmays]

GoDaddy responded to this thread in the article here: https://domaininvesting.com/godaddy-still-not-frontrunning-d...

> “GoDaddy never has and never will register domain names based on customer searches. This is an unethical and predatory practice that runs counter to our mission of helping people bring their ideas to life online with the best possible domain name.”

[symkat]

And it's free for GoDaddy to do this: https://www.icann.org/resources/pages/epp-status-codes-2014-...

[boxed]

Can't be totally free. If we all would run random garbage through their search, at some point this evil mudy collapse somehow?

[Tepix]

And during the free period they can do "domain tasting", see how many ads they can deliver on that domain and consider keeping it.

[henriquez]

Wow, this is a blast from the past. I know Godaddy got busted doing this years ago. I forget whether they were sued or just hounded with bad P.R. but I thought they promised to clean up their act. I wish I could find the article now, but Google only pulls up stuff from the last year or so.

[bluedevil2k]

I have a similar sorry about the scuzziness of GoDaddy. When Apple first announced the Swift programming language at their wWWDC i immediately went to GoDaddy to register every Swift related domain I could think of - learnswift.com, swift-tutorial.com type domains. I added several and in the process of checking out (which used to be like 7 steps as each step along they way they tried to trick you into buying something else), the price of the domains went from $14 each to $2000+ each. They had suddenly realized the value of the domains while they were in my shopping cart and raised the price.

Another GoDaddy sucks story, which happened to me several times before I dropped them. Good luck canceling an SSL certificate - they will still treat it as a valid SSL very that needs to get re-cert’ed every year and they’ll charge you full price, $79, up to 3 months ahead of its expiration! I’m 100% positive I canceled an SSL very and ensured it was removed from my Renewals and of course, they still charged for a renewal.

[jtolmar]

This happened to me too. I was searching the domain on a variety of tools to make sure it wasn't like, secretly a swear word in another language or whatever, then a couple days later it was registered by GoDaddy. I wasn't sure which tool leaked it, or whether that was actually GoDaddy or their domain holder protection. But it was pretty annoying.

And they registered it for two years.

[gazelleeatslion]

I used their broker service to buy a really expensive domain via a client (squatter).

They ranted about how it's done totally anonymous and had to do all the communication.

They transferred the domain to us revealing the seller's WHOIS information (email, phone, name, address).

Ended up being someone literally walking distance from me in Washington, DC. So that's some crazy sketch dangerous behavior... I couldn't imagine what would happen if they sold to a really pissed off client. People are crazy over their company and personal names. Like hello incoming pissed off dude who just forked over multiple $xx,xxx to a squatter and now has their address.

Then I couldn't replace the WHOIS information because you needed the seller to confirm via their WHOIS email (GoDaddy support could not understand this / or I suck at explaining).

I almost just called the seller up, but instead finally found out GoDaddy allows you to bypass the WHOIS process with the email of your GoDaddy account.

Disaster. Don't really buy domains anymore but probably Cloudflare or bust at this point.

[brk]

GoDaddy has been a bad actor for as long as I can remember.

This thread is a good indicator of how/why they keep doing it though. Every time I start to think people have finally caught on an realized how GoDaddy treats customers and potential customers, I see a new case of someone seemingly unaware of their vast history of stuff like this.

We think it is easy to disseminate information on the internet, but in the end it is really hard to really get anything into true general awareness.