By Steve Levy
A recent UDRP decision offers a clear reminder that the unauthorized acquisition and use of a domain name is fundamentally incompatible with any claim of legitimate rights or bona fide activity. In the case at issue, the Respondent had hacked the Complainant and taken control of its domain name but continued to operate the very same website that the Complainant had used to promote its goods and services. This conduct, far from establishing any legitimate interest, only underscored the Respondent’s intent to exploit the Complainant’s established online identity for its own benefit.
The Panel found that the Respondent’s actions could not be characterized as a bona fide offering of goods or services under paragraph 4(c)(i) of the UDRP. A bona fide offering requires transparency, authenticity, and an absence of deception. Here, the Respondent’s use of the domain name was built entirely on a fraudulent acquisition. By maintaining the Complainant’s original website, the Respondent created the false impression that the Complainant continued to operate the domain name and that the goods and services offered were still under the Complainant’s control. This type of impersonation is the opposite of bona fide activity. It is a classic example of bad faith use designed to capture consumer trust that rightfully belongs to the brand owner.
The Panel also addressed an important point regarding the bad faith “registration” requirement under UDRP paragraph 4(a)(iii). Although the Respondent did not register the domain name in the traditional sense, the Panel treated the fraudulent acquisition as “equivalent to an initial registration.” This interpretation recognizes that bad actors should not escape liability simply because they obtained a domain name through theft rather than through a registrar. What matters is the Respondent’s knowledge and intent at the moment control was obtained. Because the Respondent clearly knew of the Complainant and its business when it took over the domain name, the bad faith registration element was satisfied.
This reasoning is significant for brand owners. It confirms that the Policy protects against both conventional cybersquatting and more sophisticated forms of domain name theft. When a Respondent acquires a domain name through fraudulent means and uses it to mimic the Complainant’s online presence, the Respondent cannot claim any legitimate interest. Instead, the conduct demonstrates bad faith in both acquisition and use.
This decision reinforces a simple principle: a domain name stolen from a brand owner and used to maintain the brand’s own website is never a bona fide offering. It is a deceptive practice aimed at exploiting consumer trust, and UDRP panels will treat such conduct as lacking any bona fides and creating a bad faith registration and use under the Policy.