Solved

Help with a domain dispute

Posted on 2013-01-02
23
367 Views
Last Modified: 2013-01-04
Can someone tell me how I can regain control of a domain and website that has been hijacked by a rogue employee of the company which rightfully owns the domain?

The domain is registered through Google, and the website is also hosted by Google.  The corporate email is also powered by Google Apps.

This rogue employee set up his own Google account, and used that account to register the corporate domain for his employer.  Since that time, the employee has been terminated and he will not give back control of the domain, email or website to the employer.

I have done extensive searching through Google's support documentation, but all I can find is that Google does not get involved in ownership disputes.

I cannot believe that Google provides no recourse to companies or individuals who end up in this situation.  Can anyone advise as to what action I can take?  Most registrars and hosting companies have a dispute process where a company can regain control of an account that has been hijacked.  I cannot figure out whether Google has a process for this.
0
Comment
Question by:jbaird123
  • 9
  • 4
  • 4
  • +2
23 Comments
 
LVL 21

Expert Comment

by:mcsween
ID: 38737375
According to Google's FAQ they are not a registrar but are partnered with registrars.  You will have to find out which registrar this was registered with and call them.  They will assist you in regaining control over the domain.  Probably have to verify some information and maybe have an officer of the company sign a letter on company letterhead.

To figure out who the registrar is do a search for the domain name in the whois database and look for the sponsoring registrar record.  http://www.betterwhois.com/
0
 

Author Comment

by:jbaird123
ID: 38737407
mcsween,

I actually already tried this.  The "official" registrar is enom.com.  So the domain was registered through enom.com via Google.  I called enom.com and discussed the situation with them.  They told me that they don't get involved in domain disputes for Google accounts.  Here is the exact text from the email I received:

"If your domain is with Google and eNom, eNom can only assist the person with the correct passwords, we do not get involved in ownership disputes.

The Google account login details are not held at eNom and we cannot assist you with that data. You would need to contact Google directly."

So at this point, I am not getting any help from enom or Google.

Advice?

Thanks.
0
 
LVL 21

Assisted Solution

by:mcsween
mcsween earned 250 total points
ID: 38737423
I suggest calling the police then.  This is considered wire fraud and is a Felony.  If this guy gets a call from the police he will be very unlikely to continue to resist.

It's really an HR issue at this point.  They should handle it just like they would if someone stole any other company property.
0
 

Author Comment

by:jbaird123
ID: 38737456
Thanks, mcsween.

I am going to leave this thread open for a little while in case anyone has any other ideas.  I was really hoping to avoid taking legal action if at all possible.  If that is my only option, then I guess I will do that.
0
 
LVL 39

Expert Comment

by:als315
ID: 38737459
Can you show results from:
http://www.enom.com/whois/default.aspx
for your domain? Mask all sensitive fields.
Who paid for registration and google's services?
0
 

Author Comment

by:jbaird123
ID: 38737489
als315,

Below is the information you requested.

I believe that the corporation paid for the registration and services with their own corporate credit card.  I am trying to verify this though as I am not 100% certain.  The employee may have paid with his own card and then requested reimbursement, but this is not likely.

I changed the real domain name to "dummydomainname.com" below.

Registrant:
Whois Privacy Protection Service, Inc.
Whois Agent
PMB 368, 14150 NE 20th St - F1
C/O dummydomainname.com
Bellevue, WA 98007 US
+1.4252740657
Fax +1.4259744730

Administrative:
Whois Privacy Protection Service, Inc.
Whois Agent
PMB 368, 14150 NE 20th St - F1
C/O dummydomainname.com
Bellevue, WA 98007 US
+1.4252740657
Fax +1.4259744730



Technical:
Whois Privacy Protection Service, Inc.
Whois Agent
PMB 368, 14150 NE 20th St - F1
C/O dummydomainname.com
Bellevue, WA 98007 US
+1.4252740657
Fax +1.4259744730


Nameserver:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com

Updated-Date:
Apr 16, 2012 06:54:14 PM

Created-Date:
May 04, 2007 08:18:54 PM

Registration-Expiration-Date:
May 04, 2013 08:18:54 PM

Status:
ok

Domain:
dummydomainname.com

dummydomainname.com is a domain name registered by Whois Agent. The site is based in Bellevue, WA, US. This domain does not appear to have registrar lock enabled. www.dummydomainname.com hosts it's domain on dns1.name-services.com,dns2.name-services.com,dns3.name-services.com,dns4.name-services.com,dns5.name-services.com.

Page rank, back links or indexed pages information is not available for www.dummydomainname.com. Inexpensive business listings setup through eNom can help websites to build backlinks, and to generate organic search engine referrals.

The registrant's whois information is masked from appearing in our whois lookup data. For additional information about www.dummydomainname.com, users are encouraged to email Whois Agent or call +1.4252740657 for items pertaining to the registrant. For administrative issues, please email Whois Agent or call +1.4252740657. Items of a technical nature should be directed to Whois Agent via email or by calling +1.4252740657.
0
 
LVL 82

Expert Comment

by:Dave Baldwin
ID: 38737569
When you say "rightfully owns the domain", you will need to produce proof that that is true.  Something like a bill that the company paid for the rights to use the domain name or a trademark in the company's name.  Domain names are first come, first served, unless you have a legal right that supercedes that principal.

At this point, you have to write to Whois Privacy Protection Service, Inc. to even find out who is the current 'legal' owner of the domain.
0
 
LVL 21

Expert Comment

by:mcsween
ID: 38737590
No registrar lock in place; just go to godaddy.com or networksolutions.com and transfer the domain to them.  Don't forget to enable the registrar lock after transferring it.
0
 

Author Comment

by:jbaird123
ID: 38737608
mcsween,

If I do as you suggest, what will happen to the current website and email that are being hosted by Google?  Won't I lose all of that information?

Thanks.
0
 
LVL 39

Expert Comment

by:als315
ID: 38737626
Registrant details are hidden and can't help us. I hope there is your company, not private person.
Seems you can't follow standard Google's procedures for changing administrator's account, because you have no access to DNS management. Here is some links, but in your case it is not working:
http://support.google.com/a/bin/static.py?hl=en&hlrm=ru&ts=2403965&page=ts.cs#domainverify

If you can find payment details, it may be not so bad.
You can start discussion with Google's support. Describe situation, show payment details.
0
 

Author Comment

by:jbaird123
ID: 38737651
als315,

That is what I have been trying to figure out - how to start a discussion with Google's support.  There is no information anywhere about how to do this.

I already found the link you posted, but as you mentioned, that page does not work for my situation.  I just get this message when I click the option that applies to me: "We're sorry, but the information you've requested cannot be found. Please try searching or browsing the Help Center."

So... can anyone tell me how to contact Google Support?
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 21

Expert Comment

by:mcsween
ID: 38737710
The email and website won't be affected once you fix the DNS.  You will want to use NSLookup to query your www A Record and your MX record for email.  Once you issue the transfer your dns will be transferred to the new registrar as well.  You will then just go in and add your MX record back in and your www record.

at a command prompt type
nslookup
www.yourdomain.com
set type=mx
yourdomain.com

Open in new window

Note the IP address assigned to www.yourdomain.com.
Note the Prefrence and the mail exchanger of the MX record. If the mail exchanger is another subdomain of your domain (it probably isn't) do a set type=A and query that subdomain's ip address and make a note of it so you can re-register its A record.
0
 
LVL 82

Expert Comment

by:Dave Baldwin
ID: 38737722
You don't really need a registrar lock any more.  You do need the current owner and the new owner to cooperate in entering the transfer codes.  You can not do that from only the new owner's account.
0
 
LVL 39

Expert Comment

by:als315
ID: 38737724
Here are phones:
http://contact.googleapps.com/?&rd=1
They will ask for customer's PIN, try to describe situation, I hope they will help you.

PS. You should have some google account.
0
 

Author Comment

by:jbaird123
ID: 38738020
als315,

You can't get any help at all without a PIN.  I called the number, and you need to enter a PIN in order to do anything.
0
 

Author Comment

by:jbaird123
ID: 38738024
mcsween,

DaveBaldwin is correct I believe.  I need a transfer code to be able to transfer the domain.
0
 
LVL 39

Expert Comment

by:als315
ID: 38739151
Seems Google don't like problem cases. Due to this paper:
http://www.google.com/apps/intl/en/terms/premier_terms_prepay.html
you can do nothing. Only ask for help on forums.
You can try to get help from Google's partners:
https://www.google.com/enterprise/marketplace/search?categoryId=15&orderBy=rating
but it could be expensive.
0
 
LVL 27

Expert Comment

by:tliotta
ID: 38739310
This rogue employee set up his own Google account, and used that account to register the corporate domain for his employer.
I don't quite get it. Was the employee acting at the request of the company or was it done on the employee's own initiative and personal time? Does the domain name include the company name or company trademark? Was the domain actually used by the company?

Tom
0
 

Author Comment

by:jbaird123
ID: 38739799
Tom,

The answer to all 3 of your questions is "yes".
0
 
LVL 82

Expert Comment

by:Dave Baldwin
ID: 38740926
Then have you saved copies of the web pages from the site and taken screen shots to show the company names and trademarks?
0
 
LVL 27

Accepted Solution

by:
tliotta earned 250 total points
ID: 38742555
See an attorney. It almost certainly won't take much more than a stern letter to the ex-employee to get it resolved. It doesn't seem that this exactly fits the definition of "cybersquatting", but it actually seems worse involving theft. There are federal laws that cover this sort of thing. Any average attorney should be able to make a solid case out of this on the spelling of the domain name alone.

Do a search for [ cybersquatting ] to find references. As mentioned, it's not a precise fit; but if the domain name matches a corporate name/trademark, that should be the only hook that you need. If you have additional evidence that supports claims that it was done as an agent of the company, then everything (including the Google account that started it all) should become fair property of the company. The employment dates and the domain registration dates should coincide for example.

You can continue poking and prodding registrars, but you should go straight to the source with legal representation.

Tom
0
 

Author Closing Comment

by:jbaird123
ID: 38745333
Thank you.
0
 
LVL 27

Expert Comment

by:tliotta
ID: 38746241
And thank you. I suspect that a lot of members will be interested in any followup that you can add to this question if you get a resolution, satisfactory or not.

Tom
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Surprisingly, there is a lot to Gym battles, and I thought it would be helpful to share knowledge about all the ins and outs of this feature!
Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protec…
Notifications on Experts Exchange help you keep track of your activity and updates in one place. Watch this video to learn how to use them on the site to quickly access the content that matters to you.
Where to go on the main page to find the job listings. How to apply to a job that you are interested in from the list that is featured on our Careers page.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now