Domain registrar eNom has acquired rival registrar BulkRegister, LLC, which manages more than 1.5 million domains for its 35,000 customers. eNom said the acquisition gives it more than 6.8 million domain names under management, allowing it to pass Network Solutions to become the second-largest registrar after Go Daddy.

BulkRegister, which provides domain registration and management tools for the corporate market, is based in Baltimore and was owned by reseller hosting specialist Alabanza. Terms of the deal were not announced.

"We are excited about this significant and synergistic addition to our domain platform," said Paul Stahura, founder and chief executive officer of eNom. "Both eNom and BulkRegister have built up strong, loyal and successful customer bases, by providing great tools, high quality service, and a solid technology platform. The combination of the two companies is a natural fit."

Mergers and acqusitions in the web hosting industry accelerated in the first half of 2006, as investment capital flowed into the sector, which just a few years ago was scorned by Wall Street. While most of the deals have featured private investors, the public may get the chance to get in on the action in coming months, as Go Daddy and Hostopia are planning initial public offerings.

The improved environment for hosting M&A was the focus of several panel discussions at last week's HostingCon 2006. "The acquisition market is heating up," said Hillary Stiff of Cheval Capital, an Alexandria, Va. investment banking firm that specializes in the hosting sector. "We're getting more buyers into the market. It's harder to get organic growth, so people are looking to buy companies. There are also a lot more companies looking to sell."

"We're seeing increased M&A activity," agreed Paul Stapleton of DH Capital LLC, a New York investment firm active in the ISP and hosting markets. "More people will be buying hosters. Debt is returning to the market, more private equity is returning to the market, and there are more and more exit strategies for capital in this sector. The capital markets are open for hosters."

The power outage that knocked MySpace offline was the second major failure in the past year at the telecom building in Los Angeles where MySpace houses much of its operations. The downtime at the Garland Building (1200 W. 7th) left MySpace users wondering how one of the web's busiest sites could go dark so easily. Adding to the headscratching was the fact that MySpace is a customer of Limelight Networks, a content delivery network that should (in theory) provide distributed caching and storage.

Other tenants at the Garland Building that were affected included DreamHost, which reported on the weekend power outages on its company blogs. The building lost grid power during a series of rolling blackouts that affected the Los Angeles area as California coped with stifling heat and record demand for electricity. The loss of power at Garland was blamed on the failure of a UPS system (uninterruptible power supply), which normally maintains power to equipment while generators start up.

Equinix said that reports that the outage may have occurred in one of its data centers were incorrect. "Equinix’s data centers were operating as normal over the weekend and this morning, providing consistent power to all customers," Margie Backaus, chief business officer of Equinix, reported in the comments section at GigaOm. "MySpace operates in Equinix data centers, but it also hosts operations in other data centers where we understand the incident occurred." MySpace recently announced that it would lease space in the new Equinix center in El Segundo.

EURid has suspended 74,000 .eu domain names and sued 400 registrars for breach of contract, citing "abusive behavior from a syndicate of registrars who have systematically acquired domain names with the obvious intent of selling them."

“In this case we are convinced that the domain name holders of the 74 000 .eu names (Ovidio Ltd, Fausto Ltd and Gabino Ltd) are acting as a front for a number of registrars," said Herman Sobrie, Legal Manager of EURid. "The domain name holders and the registrars can be regarded as one and the same. Since registrars should only register domain names for existing customers and not 'warehouse' the names in order to resell them at a higher price, this is clearly in breach of the registrar contract."

Social networking site MySpace.com is offline currently, attributing the downtime to a power outage in its data center. It was inaccessible for more than 90 minutes, and then displayed a brief message alerting users to the problems: "Hey everyone! There's been a power outage in our data center. we're in the process of fixing it right now, so sit tight. - Tom" (presumably MySpace co-founder Tom Anderson).

With MySpace unavailable, many of the service's users began posting blog items at LiveJournal, another free blogging service popular with U.S. teenagers.

A dynamically updating chart of the web site performance of myspace.com is available. Netcraft offers a web site performance monitoring service that provides detailed uptime charts, along with e-mail alerts when an outage occurs.

Do you need 100 gigabytes of disk space to house your web site? How about 150 gigs? Even if you'll never need that much space, hosting providers are offering it in the hope that super-sized specs will win new customers.

Hostway's "Superpowered Web Hosting" promotion is offering plans featuring 150 gigs of disk space, 1,500 gigs of data transfer and 3,000 email accounts for $9.95 per month. 1&1 Internet now offers 100 gigs of disk space and 1,000 gigs of transfer with its $9.95 a month business plan, while Go Daddy offers identical specs for $14.99 a month.

"There's obviously this arms race going on, with people offering absurd amounts of disk space and bandwidth," said Derek Vaughan. chief marketing officer of TechPad Agency.

The U.S. crackdown on online gambling company BetOnSports appears unlikely to spark dramatic shifts in the geography of the online gambling industry in the short term. American DNS service providers and DDoS mitigation companies are continuing to provide services to UK betting sites, while initial fears about the British government's extradition policy have eased somewhat. But some international betting services are barring U.S. residents, and up-and-coming offshore "data havens" are likely to be of growing interest to UK-based gambling operations.

It will take time for the broader implications of the U.S. charges against BetonSports.com to become clear. BetonSports.com CEO David Carruthers was arrested Sunday in Dallas/Fort Worth airport as he changed flights on his way from London to Costa Rica (where BetOnSports is based) and charged with conspiracy, fraud and racketeering. Also named in the indictment were Florida companies that provided marketing services to BetonSports. While those charges dealt specifically with the transport of gambling equipment to offshore sites, the inclusion of the companies has raised concern among U.S. companies providing services to international gambling sites.

Neustar Ultra Services (formerly UltraDNS) is continuing to provide DNS management services to BetonSports.com and several other UK gambling sites. Prolexic, a Florida provider specializing in mitigation of DDoS attacks, also counts offshore gambling web sites as customers. Gambling sites are frequent targets of attacks from DDoS blackmail schemes.

Web hosting providers are paying more to attract new customers, as affiliate referral fees and Google AdWords campaigns become more expensive, according to panelists at this week's HostingCon 2006 conference. Click fraud is also a growing problem for search marketing campaigns using google, they said.

"The cost of acquiring a customer is skyrocketing," said Lou Honick, CEO of HostMySite.com. "If you're going through traditional channels, it's getting more and more expensive to acquire a customer."

Affiliate programs, which pay a fee for customer referrals from third-party web sites, are a key sales channel for many shared hosting providers. In recent months a growing number of hosting companies have begun paying $100 or more per referral for customers who typically pay $5 to $15 per month. There are at least six hosts offering between $100 and $120 per referral at Commission Junction, which manages a network of affiliate programs. That rate represents a significant increase, according to Matt Heaton, CEO of BlueHost, who said his company generates most of its leads through affiliate programs.

The cross-site scripting (XSS) vulnerability, which was harnessed by fraudsters to execute a convincing phishing attack against PayPal users, may have been exploitable for two years previously.

Despite the prompt action taken by PayPal to address the security flaw after it was reported by Netcraft last month, it became apparent that the very same flaw had been discovered and documented two years earlier. The page - cached by the Wayback Machine - describes a cross site scripting attack that affected donation pages for suspended users, and is the exact method exploited by the phishing attack in June 2006.

Chris Marlow tried to warn PayPal about the flaw in June 2004, but claims the PayPal representative he spoke to did not understand what cross-site scripting was, and - due to company policy - was unable to provide an email address to allow a proof-of-concept exploit to be demonstrated. Frustrated at being unable to convey the seriousness of the issue, Mr Marlow then posted details about the exploit to his web site but did not receive any response from PayPal.

PayPal fixed the flaw after reports of the phishing attack were published by Netcraft. A PayPal company spokesman initially said that they did not know how many people had fallen victim to the scam, although as the fraud was committed using PayPal's own web site, analysis of log files, if available, would have allowed PayPal to identify users at risk and take appropriate action.

Netcraft offers a Web Application Security Testing service, which can discover a number of security flaws, including cross-site scripting vulnerabilities like these.

An ongoing phishing attack against Citibank is using man-in-the-middle tactics against two-factor authentication to gain access to online banking accounts.

The second authentication factor used by Citibank is provided by a security token – a physical item possessed by an account holder – which generates a one-time password that remains valid for approximately one minute. One-time passwords are useless to an attacker if they are captured via keylogging trojans, as they will not work immediately after the victim has used them, nor will the attacker be able to gain access to the victim's account at a later date.

However, by tricking a victim into entering these items of data into a form, the attacker's site can automatically relay the authentication credentials to the real Citibank site instantly. Effectively, this allows the attacker to successfully log in on behalf of the victim.

Guidance issued by the Federal Financial Institutions Examination Council (FFIEC) has called for banks to provide additional protection for high-risk transactions, such as those that involve moving funds or accessing sensitive customer information, but it is now clear that fraudsters are already making efforts to bypass the protection features being added by banks.

The Netcraft Toolbar community has to date reported 35 sites that have used this method to attack Citibank customers. All of the reported sites have used Russian country-code top level domains (.ru), although the hosting location varies from site to site.

Netcraft offers a comprehensive range of phishing protection services, including Phishing, Identity Theft and Bank Fraud Detection, and a Phishing Site Feed, which offers realtime protection against new phishing attacks as soon as they are reported. Netcraft's Phishing Site Countermeasures service can be used to 'take down' fraudulent sites that are actively engaged in phishing attacks.

Doug Erwin has a big job ahead of him. As the new CEO of The Planet and EV1Servers, Erwin must blend the operations of the world's two largest dedicated server providers and position the new entity to compete in a rapidly-evolving sector of the hosting industry. But Erwin, an IT industry veteran, is used to large challenges. And GI Partners, the new owner of The Planet and EV1Servers, has plenty of ambition and a track record of building big.

The two Texas-based companies, which were acquired by GI Partners in early May, are plenty big already. The Planet and EV1Servers have more than 2.7 million hostnames between them, and between Dallas and Houston operate seven data centers and 370,000 square feet of web hosting space.

Customers of both companies are eager to hear what changes lie ahead. As he settled into his new position last week, Erwin said they'll need to wait a little longer. "In the next 30 days I'm going to put together the new management team, and I've committed to everyone that in the 30 days they'll know where their job is," said Erwin. "Within 90 days from today I intend to have our strategy completed. We don't even have a name for the company yet," he added, saying that all options remained on the table, including choosing between the two brands or adopting an entirely new name.

iPowerWeb is the most reliable hostinig company site in June, followed closely by Hostway, as budget hosts continue to demonstrate that their networks can compete with those of high-end managed hosting providers.

iPowerWeb's shared hosting accounts start at $7.95 a month for packages that include a free domain and 10 gigs of disk space. Hostway, which ties for second with Above.net this month, offers "SuperPower" shared hosting accounts that include 150 gigs of disk space and 1,500 gigs of data transfer (no, those aren't typos) starting at $9.95 a month.

Leading managed hosting providers continue to turn in strong performance, with Datapipe, Navisite, Rackspace and New York Internet all among the top 10, which included four sites on FreeBSD, three on Linux and two using Windows Server 2003. Of the 50 major hosts we monitor, 34 had no measurable outages in June.