Cybersecurity firm states former employee is holding domain name hostage
San Francisco startup alleges terminated employee won’t give it access to its domain name.
System Two Security, a San Francisco-based cybersecurity firm that raised a $7 million seed round in 2024, is suing (pdf) a former employee who it alleges is holding the firm’s domain name hostage.
The firm used the domain name detections.ai for its website and email addresses.
As stated by the firm’s lawsuit, its former Field Chief Information Security Officer, Andy Mog, registered the domain on the firm’s behalf while employed by the firm.
System Two Security terminated Mog last month and requested that he provide credentials to access the domain.
The lawsuit alleges that Mog refused to hand over the domain and sent a message to its CEO stating: “You ought to have known better, Robert [the firm’s CEO]. You know I like to buy domains.”
As stated by System Two Security, Mog then offered to sell the domain to the firm for escalating prices and sent an email to the firm’s advisors, investors, and potential clients with the subject “End of detections.ai.”
The firm originally asked the court for an injunction ordering the transfer of the domain to System Two Security.
In response, Mog told the court (pdf) that an injunction wasn’t necessary, since System Two has a workaround: detections.ai is now forwarding to SystemTwoSecurity.com.
The website has a notice:
Temporary domain update: detections.ai is right now available at systemtwosecurity.com while we resolve a domain related issue. Your account, data, community access, and product experience remain unchanged.
Mog also argued that the domain isn’t registered to him personally but rather to MillionMonkeys LLC. He attached a screenshot from a GoDaddy account showing the domain is registered to that organization, with him as the contact. He argued that since the domain is registered to MillionMonkeys LLC, that entity ought to be a party to the dispute rather than him personally.
He wrote:
While Defendant disputes Plaintiff’s claims on the merits, Defendant has no intention of destroying or maliciously transferring the domain while this Court determines the proper legal procedure. Still, since Plaintiff is actively operating its business without irreparable harm, and since the asset belongs to an unrepresented non-party, Defendant respectfully requests that the Court deny the Motion for a Temporary Restraining Order and grant a short continuance so that MillionMonkeys, LLC may obtain licensed counsel.
The parties reached a standstill agreement while they pursue arbitration or otherwise attempt to resolve the suit.
It’s another reminder to be mindful of who the registrant is for your firm’s domain names.
