Case: Litman v. Goldberg, Index No. 524343/2025 (NY Sup. Ct., Kings County) Prepared: 2026-04-05 Purpose: Document the forensic DNS and WHOIS analysis of 4patent.com, Richard Litman's professional domain, demonstrating that Joshua B. Goldberg and Nath, Goldberg & Meyer (NGM) exercise complete administrative control over the domain's registration, web traffic, and email infrastructure.
4patent.com is Richard Litman's professional domain, registered in 1995 — over thirty years ago. Forensic analysis of the domain's public DNS records and WHOIS registration data reveals that Goldberg and NGM control the entire technical infrastructure: domain registration, DNS routing, website hosting, and email delivery.
The domain currently redirects all web traffic to nathlaw.com (NGM's firm website). More critically, the email authentication records (DKIM) prove irrefutably that all @4patent.com email accounts — including litman@4patent.com — are administered through NGM's Microsoft 365 tenant at nathlaw.onmicrosoft.com.
This infrastructure control is the technical mechanism that enabled the July 18, 2025 email account elimination (one day after Litman's litigation threat) and Goldberg's subsequent use of litman@4patent.com for his own purposes.
| Field | Value |
|---|---|
| Domain | 4patent.com |
| Registrar | eNom, LLC (IANA Registrar ID 48) |
| Created | 1995-05-28 (31 years ago) |
| Expires | 2026-05-27 (7 weeks from today) |
| Last Updated | 2025-07-16 |
| Registrant State | Virginia |
| Registrant Name | REDACTED FOR PRIVACY |
| Status | clientTransferProhibited (locked against unauthorized transfer) |
Key observations:
| Record | Value |
|---|---|
| NS | arch.ns.cloudflare.com |
| NS | jean.ns.cloudflare.com |
The domain's DNS is managed through Cloudflare. Whoever holds the Cloudflare account for 4patent.com controls all DNS records — website routing, email delivery, and authentication. Given that all DNS records point to NGM infrastructure (as documented below), the Cloudflare account is held by or on behalf of NGM.
| Record | Value |
|---|---|
| A | 172.67.154.146 |
| A | 104.21.32.201 |
Both IP addresses belong to Cloudflare's proxy network. The actual origin server is hidden behind Cloudflare's infrastructure.
Both HTTP and HTTPS requests to 4patent.com return a 301 Permanent Redirect to:
https://nathlaw.com/
Anyone visiting Richard Litman's professional domain — 4patent.com — is automatically and permanently redirected to the NGM firm website. This is an ongoing commercial appropriation of Litman's domain identity for the benefit of NGM.
| Record | Value | Priority |
|---|---|---|
| MX | 4patent-com.mail.protection.outlook.com | — |
All email sent to any @4patent.com address is delivered to Microsoft 365 / Exchange Online through Microsoft's mail protection gateway. The subdomain format (4patent-com.mail.protection.outlook.com) confirms this domain is enrolled in a Microsoft 365 tenant.
| Selector | CNAME Target |
|---|---|
| selector1._domainkey.4patent.com | selector1-4patent-com._domainkey.nathlaw.onmicrosoft.com |
| selector2._domainkey.4patent.com | selector2-4patent-com._domainkey.nathlaw.onmicrosoft.com |
This is irrefutable proof that NGM's Microsoft 365 tenant administers all @4patent.com email.
DKIM (DomainKeys Identified Mail) is an email authentication protocol. The DKIM CNAME records for 4patent.com point to nathlaw.onmicrosoft.com — which is the Microsoft 365 tenant identifier for Nath, Goldberg & Meyer. This means:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
This record authorizes both Google and Microsoft mail servers to send email on behalf of @4patent.com. The dual authorization suggests a historical migration (likely from Google Workspace to Microsoft 365) with the Google authorization left in place.
v=DMARC1; p=quarantine; ruf=mailto:dmarc@4patent.com
DMARC forensic failure reports are sent to dmarc@4patent.com — an address that, per the MX and DKIM records above, is delivered to and controlled by NGM's Microsoft 365 tenant. NGM receives all reports of unauthorized use of the @4patent.com domain.
MS=ms52076111
This TXT record confirms that 4patent.com has been verified within a Microsoft 365 tenant — specifically, the nathlaw tenant identified by the DKIM records. Domain verification requires administrative access to DNS, confirming that whoever controls the Cloudflare account also enrolled 4patent.com in NGM's Microsoft environment.
| Infrastructure Layer | Controller | Evidence |
|---|---|---|
| Domain registration | Virginia registrant (NGM's state) | WHOIS records |
| DNS routing | Cloudflare account holder (NGM) | NS records |
| Website traffic | Redirects to nathlaw.com | HTTP 301 response |
| Email delivery | nathlaw.onmicrosoft.com (NGM's M365 tenant) | MX record + DKIM CNAMEs |
| Email authentication | NGM | SPF, DKIM, DMARC all configured |
| DMARC reporting | dmarc@4patent.com (delivered to NGM) | DMARC ruf directive |
| Domain verification | NGM's Microsoft 365 tenant | MS= TXT record |
Every layer of the 4patent.com infrastructure is controlled by NGM. Richard Litman has no independent access to his own professional domain's registration, DNS, website, or email systems.
As the administrator (or through an administrator) of the nathlaw Microsoft 365 tenant, Goldberg can: - Send email as litman@4patent.com without Litman's knowledge - Receive and read all incoming email to litman@4patent.com - Disable or delete the litman@4patent.com mailbox entirely - Access password resets and verification emails for any online account registered to litman@4patent.com
This is not inference — it is the inherent capability of any Microsoft 365 tenant administrator over a verified domain.
The WHOIS records show the domain was updated on July 16, 2025 — two days before Litman's email accounts were eliminated on July 18, 2025. The July 16 update is consistent with preparatory changes to the domain's administrative configuration. The email elimination itself required only administrative action within the nathlaw M365 tenant — no external cooperation was needed.
The timeline: | Date | Event | |------|-------| | June 26, 2025 | Litman threatens litigation: "That is the answer that gets you into litigation" | | July 16, 2025 | 4patent.com WHOIS record updated | | July 17, 2025 | (Implied: final preparations) | | July 18, 2025 | Litman's email accounts (litman@4patent.com, NathLaw account) eliminated |
Goldberg acknowledged the elimination but never restored access.
On September 2, 2025, an OpenGov procurement account was registered for "Joshua Goldberg" using the email address litman@4patent.com. The DNS analysis proves Goldberg controls the entire email infrastructure for this address. He could: - Register the account using Litman's email address - Receive the verification email in the nathlaw M365 tenant - Receive all subsequent correspondence, password resets, and notifications
This is not merely using someone else's email address — it is using an email address over which the actor has complete administrative control, for his own purposes, under Litman's professional identity.
The 301 permanent redirect from 4patent.com to nathlaw.com means that anyone searching for Richard Litman's professional domain — clients, colleagues, government agencies, potential business contacts — is directed to NGM's website. This redirect captures the commercial value of Litman's 31-year-old professional domain and diverts it to NGM.
4patent.com expires May 27, 2026 — approximately seven weeks from this analysis. Two scenarios arise: - If NGM renews: Continued appropriation of Litman's professional domain, creating additional evidence of ongoing unauthorized use - If NGM allows it to lapse: The domain becomes available for registration, and Litman should acquire it immediately to recover his professional identity
| Existing Finding | Connection to Domain Analysis |
|---|---|
| Email retaliation (July 18, 2025 — accounts eliminated one day after litigation threat) | WHOIS updated July 16 — two days before elimination. Infrastructure control made the act trivially executable. |
| OpenGov identity misappropriation (Sept. 2, 2025 — Goldberg registered as "Joshua Goldberg" at litman@4patent.com) | DKIM records prove Goldberg's M365 tenant controls all @4patent.com email, enabling him to receive verification emails at Litman's address. |
| 181,570 emails in ND0001 dataset from litman@4patent.com mailbox | All of these emails passed through infrastructure controlled by NGM. The entire email corpus was subject to NGM's administrative access. |
| USPTO trademark notifications still CC'd to rlitman@nathlaw.com (Aug. 26, 2025 — after account elimination) | The nathlaw M365 tenant controls both @4patent.com and @nathlaw.com domains. Notifications to either address are received by NGM. |
| Professional liability insurance (July 6, 2021 — Goldberg listed Litman as "Of Counsel") | 4patent.com infrastructure was under NGM control throughout the period Goldberg was representing Litman as affiliated with the firm. |
| "Taking me off the website" demand (June 10, 2025) | The 4patent.com redirect to nathlaw.com is the mirror image of the website listing — Litman's own domain points to the website he demanded removal from. |
Preserve all DNS records immediately. WHOIS, NS, A, MX, DKIM, SPF, DMARC, and TXT records should be captured and preserved as exhibits before any changes occur.
Demand production of administrative logs. Discovery should seek:
eNom registrar account records (showing who controls the domain registration)
Monitor domain expiration. If 4patent.com lapses on May 27, 2026, Litman should register it immediately to recover his professional identity.
Add to spoliation motion. The WHOIS update on July 16, 2025 — two days before the email elimination — demonstrates premeditation. Any failure to preserve the administrative logs constitutes spoliation of evidence relevant to the email elimination claim.
Subpoena Microsoft for nathlaw tenant records. If NGM does not produce M365 admin logs voluntarily, Microsoft Corporation can be subpoenaed for records showing all administrative actions taken on @4patent.com mailboxes within the nathlaw.onmicrosoft.com tenant.
This memo documents publicly available DNS and WHOIS records as of April 5, 2026. All records cited are verifiable through standard DNS query tools and WHOIS lookup services.