One of the costs of doing business as a domain registrar is the inevitable lawsuits. Most of these are trademark suits where the plaintiff includes the registrar of a domain name as an defendant. But some of them are more interesting, such as a suit against eNom for allegedly failing to implement appropriate domain transfer safeguards.

Plaintiff William Georgevich claims he bought the domain name Detox.org from Janet Bridgers. After acquiring the domain, a person identified only as “Godfrey” in the lawsuit contacted the whois contacts for Detox.org and offered to buy it for $1,500. (As it turns out, Godfrey is Justin Godfrey, who owns EscrowDNS). One of those solicitation emails was sent to the whois technical contact, who forwarded the request to Bridgers, thinking she still owned the domain. Bridgers agreed to sell the domain to Godfrey for $1,500 and transferred the domain name.

Clearly, Bridgers still had access to the account in order to transfer the domain name. And, if the description in Georgevich’s lawsuit is valid, Bridgers agreed to sell the domain name to Godfrey that she already sold to Georgevich. But Georgevich isn’t suing Bridgers. Instead, he’s suing eNom claiming that Bulk Register, which it owns, failed to take adequate safe guards to prevent this sort of transfer.

(He also filed a separate suit against Godfrey, which was voluntarily dismissed on July 10. In a statement to Domain Name Wire, Godfrey wrote “Our company does not comment on frivolous lawsuits. Our justice system allows for anyone to file a lawsuit against anyone without justification. If the Plaintiff thought the suit was worth pursuing we would’ve file a response.”)

Here are some of Georgevich’s allegations in his case against eNom, and my take:

CLAIM: Bulk register did not send an email to either Bridgers or Georgevich confirming the transfer, “as is the industry standard”.

ANALYSIS: It is industry standard to send an alert to the domain owner informing them of a transfer. However, historical whois records indicate the domain was never put in Georgevich’s name, so there’s no way Bulk Register could have contacted him. The only e-mail addresses in the whois were Bridgers’ and the technical contact’s.

CLAIM: Godfrey (the buyer) used a weakness in Bulk Register’s account interface to bypass the formal process of transferring domain names from one account to another, which typically take 24-48 hours and require email confirmations from the owner prior to occurring.

ANALYSIS: I’ve never heard of a registrar taking 24-48 hours for a transfer between accounts. It’s usually instantaneous. As far as requiring email confirmation, that depends on the registrar. Presumably the person who accesses the account has authority to transfer the domain. If not, then the domain owner shouldn’t have provided access to them.

CLAIM: Because Bulk Register hadn’t implemented safeguards, the domain was instantly transferred without Georgevich being able to approve/decline the transfer.

ANALYSIS: I’m not convinced the domain was ever in Georgevich’s account to begin with. His name never shows up in whois, and Bridgers had access to the account.

CLAIM: An administrative freeze to block the domain from transfer to another registrar failed to prevent Godfrey from moving the domain to another registrar, change whois, and change nameservers.

ANALYSIS: I don’t quite get this. It appears to be at eNom right now, which owns Bulk Register. But the whois and nameservers could be changed.

CLAIM: Georgevich secured a valuation of the domain name at $250,000.

ANALYSIS: Cough. Cough.

Georgevich is suing to get the name back and damages of over $75,000.

Lawsuit file (pdf)