A man was able to successfully buy google.com, the domain name for the world’s most popular website, for $12 (£7.90), minutes before the company contacted him to say the transaction had been cancelled.
Sanmay Ved, a former Google employee, was using the tech firm’s new domain buying service Google Domains at 1.30am on 29 September when he noticed that google.com was available to buy. He added it to his shopping cart and, to his surprise, the transaction went through.
“I used to work at Google so I keep messing around with the product. I type in Google.com and to my surprise it showed it as available,” Ved told Business Insider. “I thought it was some error, but I could actually complete check out.”
Instead of receiving the normal confirmation emails from the company, Ved’s inbox and Google Webmaster Tools (also known as Google Search Console) was updated with sensitive information intended for the original owners of the domain – the webmasters of Google.
Ved’s ownership of google.com lasted a mere minute. The company quickly emailed him to say it had cancelled the order because someone had registered the site before he could. Ved was refunded the $12 that had already been charged.
“So for one minute I had access,” Ved said. “At least I can now say I’m the man who owned google.com for a minute.”
It is unclear what happened to allow Ved to purchase the site. It could have been a bug in Google Domains or the company simply failed to renew its domain name when the time came.
Ved said he has reported the breach to Google’s security team, who are looking into the incident. “The scary part was I had access to the webmaster controls for a minute,” he said.
A Google representative said the firm was looking into the issue, but had not noticed anything unusual.
The incident echoes a mishap by Microsoft in 2003, when it forgot to renew the well-known hotmail.co.uk domain in time. The domain name was bought by a member of the public who immediately contacted Microsoft and arranged to hand it over.
