Domain Name News: January 2025

• Domain name industry news
  •  To renew, or not to renew?  CENTR asks the question
  • Don't let your domain names become "Sitting Ducks" 
  • Registries implement new measures for dealing with non-consensually shared intimate images (NCII)
• Domain name recuperation news
  • A bitter pill to swallow
  • Evidence is crucial in UDRP disputes
  • A cautionary tale: UDRP complaint for amexio.com ends in finding of RDNH 

For earlier Anchovy News publications, please visit our Domain Names practice page. Learn more about Anchovy® - Global Domain Name and Internet Governance here.

Domain name industry news 

To renew, or not to renew?   CENTR asks the question

The Council of European National Top-Level Domain Registries (CENTR) recently released the public version of its 2024 Renewal Study, which is aimed at providing insights into the driving factors behind domain name retention across country code Top-Level Domains (ccTLDs).

The Study, originally conducted for CENTR members, sought to examine “the relationship between domain classification, age, and renewal rates across ccTLDs, focusing on how content and longevity influence domain retention.”  The analysis was carried out by categorising domains into “high-content (developed websites), low-content (parked sites), and no-content (no web presence)”.

Perhaps unsurprisingly, the Study found that high-content domains have the highest renewal rates (90.3%), significantly higher than low-content (78.5%) and no-content domains (70.3%) – a registrant is less likely to allow a domain name that is associated with a content-rich, or heavily visited, website to lapse.   

Domain age also has a strong influence on retention, with renewal rates increasing from 54% for one to two-year-old domains, to 95% for domains aged over 18 years.  This is no doubt both because the value of a domain name tends to increase with time and also because the most valuable Internet real estate was snapped up many years ago.  Nevertheless, the Study found that content remained the stronger predictor of renewal.

The report wraps up with a set of recommendations to ccTLD Registries for creating “a positive influence” on renewal rates.  This includes “work[ing] with registrars to educate domain owners on the importance of building and maintaining content for their domains”, offering incentives such as discounted renewal fees for domains with active content and “[p]romoting features like MX records and SSL certificates early in the domain lifecycle” by offering “discounts or bundles for these services in the first year”.  Certainly, a domain name that is associated with a functioning email address is less likely to be lapsed than one that is not.  

The Study covered 21 (mostly European) ccTLDs, but a few of them (.AU (Australia), .NZ (New Zealand) and .CA (Canada)), are located outside of Europe.   

Pursuant to the publication of the Study, CENTR has invited Registries, registrars, and stakeholders to explore the findings and “consider how they can be applied to improve domain retention and support the broader domain name ecosystem.

For more information, please contact contact David Taylor or Jane Seager.

Back to the top

Don't let your domain names become "Sitting Ducks"  

Many domain name registrants assume that by keeping their domain names secure with a reputable registrar they will be safe from cybersecurity attacks.  This is true when it comes to attacks involving credential stealing, whereby hackers use stolen credentials to take over a domain name account at the registrar and then point the domain name to a different fake website or use it to send phishing emails.  However, this is an overly simplistic view that doesn't take into account the complex nature of the Domain Name System (DNS) and the different actors involved.

Researchers at Infoblox and Eclypsium have recently highlighted what they refer to as "sitting duck" domain names.  This involves a startling loophole that potentially enables attackers to take control of domain names without hacking into the domain name account at the registrar.  

This requires a particular combination of three circumstances, namely:

• The registrar and the DNS provider of a domain name are not the same.  The registrar is the entity that manages the domain name, while the DNS service provider provides and configures the nameservers that the domain name is delegated to (configuration of the nameservers of a domain name affects how it resolves or is used for email), and these are often separate entities.  To give a practical example, the domain name example.com may be managed by a registrar, but delegated to nameservers called “ns1.nameserver.com” and “ns2.nameserver.com” that are managed by a different entity, a DNS provider.  As Anchovy News readers may know, domain names (such as nameserver.com) are used for nameservers (such as “ns1.nameserver.com”).
• The nameserver delegation is "lame".  This is when the authoritative nameserver does not have information about the domain name in question, and therefore cannot resolve queries.  This can happen for example if the authoritative DNS service or web hosting service for the domain name with the DNS provider expires.  Another scenario is when the domain name is accidently delegated by the registrant to a nameserver with a typo in it.  So, for example, the domain name example.com is supposed to be delegated onto “ns1.nameserver.com”, but “ns1.nmeserver.com” is accidently entered by mistake.  Or the domain name nameserver.com (which is used for the nameserver called “ns1.nameserver.com”) may have been allowed to lapse.  In these two cases, the attacker could register the domain name nmeserver.com or re-register the domain name nameserver.com and thus gain control of the domain name example.com delegated to nameservers he now manages and use it for malicious activities.  
• The DNS provider is exploitable.  This means that the attacker, even without having access to the valid owner’s account at the registrar, can gain control of the domain name by claiming ownership of it to the DNS provider, simply because the DNS provider does not require any proof of this or does not have a procedure in place to verify ownership of domain names.  Once the attacker has access to the nameserver configuration of the domain name via the DNS provider, he can use the domain name maliciously, send phishing emails, set up a fake website, all without ever gaining access to the domain name at the registrar or changing the nameservers.

These circumstances combined may seem unusual, but it seems that they are not. Furthermore such attacks are easy to perform and difficult to detect.  Domain name registrants should therefore check their domain name portfolio to make sure that: 

• There are no "lame" delegations.  In other words all their domain names are delegated onto the correct nameservers, and all nameservers remain active.
• Their DNS provider has mitigated the threat of a "sitting duck" attack, for example by requiring proof of ownership of domain names that are configured on their servers.

If you would like to discuss any aspects of domain name security, please contact David Taylor or Jane Seager.

Back to the top

Registries implement new measures for dealing with non-consensually shared intimate images (NCII) 

SWGfL (South West Grid for Learning) has recently announced that it has partnered with Public Interest Registry (PIR) and Nominet, the Registries responsible for running the .ORG and .UK Top Level Domains respectively, to work on removing non-consensually shared intimate images (NCII) from the Internet.  According to SWGfL, this new partnership will enable PIR and Nominet to deal with NCII which have been “adjudicated by a court to be non-consensual”.  

SWGfL operates the Revenge Porn Helpline which identifies instances of NCII across the Internet and in turn works with relevant Internet platforms to action and take down the NCII.  According to SWGfL, it currently has a 90% success rate with regard to its take-down efforts. Thus, this new partnership aims to reinforce protection in the .ORG and .UK namespaces operated by PIR and Nominet.  The Revenge Porn Helpline will work closely with PIR and Nominet to identify websites registered under .ORG and .UK that are hosting NCII content which has been “adjudicated by a court to be non-consensual”, and take action towards removal of the content.   According to SWGfL, the take down procedure is similar to the procedure used by the Internet Watch Foundation to remove Child Sexual Abuse material online.  

Sophie Mortimer (Manager of the Revenge Porn Helpline at SWGfL) affirmed that: 

“The path towards making NCII content illegal requires a whole ecosystem of collaboration. Partnerships like this are a key solution towards the obstacles we have faced in getting non-compliant sites to take down NCII content. In working directly with the source of the Domain Name, we can further protections and continue to improve our removal rates. We continue to invite more domain name registries to join the initiative and help us work towards putting a stop towards intimate image abuse for good.”

Paul Fletcher, CEO of Nominet, added: 

“There should be no place for content like this on the internet.  We have supported the Revenge Porn Helpline for several years and we’re pleased to be strengthening this relationship by joining PIR in stopping this content being shared online.  We hope more registries join us.”

For more information, please contact contact David Taylor or Jane Seager.

Back to the top

Domain name recuperation news

A bitter pill to swallow 

In a recent decision under the Uniform Domain Name Dispute Resolution Policy ("UDRP") before the World Intellectual Property Organization ("WIPO"), a single-member Panel denied a complaint to transfer a disputed domain name.  The Panel found that the Complainant had failed to demonstrate that the Respondent's registration and use of the Domain Name were intended to target the Complainant's trade mark and business and thus there was no bad faith.

The Complainant was Redpill Linpro AB, a Swedish IT solutions company founded in 1995 and renamed in 2003. It owned several figurative trade marks for "REDPILL LINPRO," registered in the EU, Norway, and the UK in 2021. It also held various domain names containing the words "redpill" and "linpro," with the earliest registered in 2008. The Complainant operated its business across Sweden, Denmark, and Norway, focusing on IT solutions and services.   

The Respondent was an individual based in Russia.  The Respondent operated a business named Redpill Team and Redpill Agency, offering services such as marketing, blockchain or game development. The Respondent had an active online presence, with social media accounts and a professional website showcasing its services. 

The Domain Name redpilldev.tech was registered in April 2021 by the Respondent. It was actively used by the Respondent for its business operations and resolved to a website displaying the Respondent's branding and services.  The Respondent's website used a colour scheme distinct from that of the Complainant's primary website. 

The Respondent never replied to the Complainant's cease and desist letter sent in March 2024 and chose not to participate in the proceedings. 

To succeed in a UDRP complaint, the Complainant must satisfy the three requirements under paragraph 4(a) of the Policy:

1. The domain name registered by the respondent is identical or confusingly similar to a trade mark or service mark in which the complainant has rights; and
2. The respondent has no rights or legitimate interests in respect of the domain name; and
3. The domain name has been registered and is being used in bad faith.

With regard to the first limb, the Complainant argued that "redpill" formed the dominant part of its REDPILL LINPRO trade mark and the inclusion of this distinctive element in the Domain Name was sufficient to establish confusing similarity. However, the Panel expressed doubts that the mere inclusion of the first part of the Complainant’s mark in the Domain Name was sufficient, on its own, to make the mark as a whole recognisable within this domain name.  In the Panel's view, "redpill"  consisted of two common English words that lacked inherent distinctiveness and, when used on their own, did not necessarily indicate the presence of the Complainant's mark as a whole.  In any event, in light of its determination under the third limb, the Panel did not find it necessary to reach a final conclusion on confusing similarity.

Likewise, considering the Panel’s findings on the third element below, it was unnecessary to address the second limb regarding whether the Respondent had rights or legitimate interests in the Domain Name.

Regarding the third limb, the Complainant argued that the Domain Name was registered by the Respondent with the intent to target its trade mark and was later used to direct to a website offering similar services, clearly to capitalise on the Complainant’s reputation and goodwill. The Complainant further asserted that the Respondent must have been aware of its trade mark applications at the time of registration, as such records were publicly accessible.

The Panel found that while the Complainant’s business dated back to 1995, there was insufficient evidence to establish the distinctiveness or reputation of its marks, particularly prior to the registration of the Domain Name.  Furthermore, the Panel found no evidence suggesting that the Respondent was engaged in activities in Europe where it could reasonably have been expected to identify the Complainant’s pending trade mark applications or register the Domain Name in anticipation of such emerging rights.   The Panel also highlighted that "red pill" was a widely used metaphor in popular culture, implying that the Respondent may have selected this term independently for its own business without targeting the Complainant's REDPILL LINPRO mark. Additionally, the Respondent's branding and website differed significantly from the Complainant's, and there was no evidence to suggest deliberate impersonation or confusion. The Respondent’s business appeared legitimate, with no evidence of targeting of the Complainant and its rights.  As a result, the Panel concluded that the Complainant had failed to prove bad faith under the third limb. The Complaint was therefore denied.   

This decision underscores the challenges brand owners face when relying on partial elements of their trade marks, particularly when the elements concerned may be viewed as dictionary terms with cultural significance (such as "redpill"), which may provide plausible alternative explanations for the selection of a particular domain name.  In the absence of compelling evidence of bad faith targeting, even strong claims of similarity and market overlap may fail to meet the threshold required under the UDRP.

The decision is available here.

Back to the top 

Evidence is crucial in UDRP disputes 

In a recent decision under the Uniform Domain Name Dispute Resolution Policy (UDRP) before the World Intellectual Property Organization (WIPO), a Panel denied a UDRP Complaint for the disputed Domain Name rentalend.com.  The Panel determined that the Complainant had not provided sufficient evidence to establish that the Respondent had registered and was using the Domain Name in bad faith, and therefore the third element of the UDRP was not satisfied.

The Complainant, Talend S.A.S., was a French software company that specialised in business intelligence and data visualisation. The Complainant held various trade mark registrations for TALEND, including a European trade mark registration, registered on 25 September 2015.

The Respondent, Attila Balint Nagy, an individual resident in Hungary, registered the disputed Domain Name on 3 October 2024.

At the time of filing of the Complaint, the disputed Domain Name resolved to a WordPress website with text that welcomed the Internet user to WordPress and stated "This is your first post. Edit or delete it, then start writing!".

To be successful in a complaint under the UDRP, a complainant must satisfy the following three requirements:

(i)         The domain name registered by the Respondent is identical or confusingly similar to a trade mark or service mark in which the complainant has rights; and

(ii)        The Respondent has no rights or legitimate interests in respect of the domain name; and

(iii)       The domain name has been registered and is being used in bad faith.

The Complainant argued that the addition of the prefix "ren" did not alter the visual, phonetic, or conceptual similarities between the disputed Domain Name and the Complainant's trade mark, creating a strong likelihood of confusion among consumers who may have mistakenly associated the disputed Domain Name with the Complainant's trade mark. Moreover, the Complainant highlighted that the Respondent was not commonly known by the disputed Domain Name and had no legitimate trade mark rights in "RentalEnd".  The Complainant argued that the Respondent's use of the disputed Domain Name constituted passive holding, as the website only displayed a basic WordPress template without any legitimate business activity.   The Complainant also argued that the Respondent registered the disputed Domain Name comprising the Complainant's trade mark to capitalise on the goodwill and reputation of the Complainant's trade mark, free riding on the Complainant's reputation, and prompting the general public to believe that the paid services advertised on the Respondent's website were official and authorised by the Complainant, which they were not. The Complainant asserted that it had established all three of the elements required under the UDRP for a transfer of the disputed Domain Name.

The Respondent countered that it had no knowledge of the Complainant or its trade mark at the time of registering the disputed Domain Name.  It argued that the addition of the prefix "ren" created a distinct term linked to rental, "RentalEnd" or "RentALend," which was difficult to associate with the Complainant’s TALEND trade mark given the lack of visual, phonetic, or conceptual similarity.

The Respondent maintained that the disputed Domain Name was intended for legitimate use as part of its plans to develop a customer-to-customer lending and rental platform, and was registered in good faith based on its relevance to the intended business, with the term "RentALend" describing the rental platform.  The Respondent added that the disputed Domain Name was not passively held and noted that it had established a WordPress hosting service associated with the disputed Domain Name shortly after it was registered, and before the Complaint was filed.   The Respondent further asserted that the rental business described by the disputed Domain Name was unrelated to the Complainant’s industry of data integration and business intelligence, making any confusion unlikely.

With respect to the first limb, the Panel noted that the disputed Domain Name incorporated the Complainant's TALEND trade mark in its entirety, with the addition of the prefix "ren".  This addition did not prevent a finding of confusing similarity, as the Complainant's trade mark remained recognisable within the Domain Name.  

The panel determined that it was unnecessary to consider the second limb in light of its analysis of the third element.

Regarding the third limb, the Panel did not find sufficient evidence to support a finding of bad faith in the registration and use of the disputed Domain Name. The Respondent stated that it was unaware of the Complainant's trade mark at the time of registration, and the Panel found no evidence to suggest otherwise.  Similarly, the Panel found no evidence that the Complainant had used the TALEND trade mark in Hungary and noted that there was no apparent reason why a person in the position of the Respondent should or would have searched for "talend" before registering the disputed Domain Name.  The Panel considered that a prominent feature of the disputed Domain Name was in fact “rent” or “rental”, terms not present in the Complainant’s trade mark.

The Panel noted that conclusory statements unsupported by evidence would not enable a party to meet its burden and cited multiple cases where prior panels have dismissed factual allegations not supported by evidence.  The Panel highlighted that there was no indication that the Respondent had registered or was using the disputed Domain Name to take advantage of the Complainant's trade mark.

The Panel also considered the Complainant's passive holding arguments, referencing the well-known Telstra case, and found that the conditions necessary to establish bad faith under Telstra were not present in this case.  The panel observed that the Complainant had failed to provide evidence to support the assertion that it had a strong reputation and was widely known in Hungary or in other countries. Therefore, the Panel noted that without such evidence, the Complainant's arguments did not meet the requirements of the Telstra test, which was designed to be relatively narrow in its application.  Unlike in Telstra, the Panel believed that the disputed Domain Name could potentially be used in good faith, as argued by the Respondent.  Finally, the Panel noted that the Respondent had also presented evidence showing an intention to develop a legitimate business related to the disputed Domain Name, further undermining the Complainant’s claim of bad faith.

This decision underscores an essential principle in domain name disputes, that the mere presence of a trade mark in a domain name does not automatically imply bad faith, especially when the respondent can show legitimate potential use for purposes unrelated to the complainant’s business.  This is particularly important when the trade mark in question is not widely recognised.  In such cases, it is crucial for the complainant to provide clear, substantial evidence to demonstrate registration and use of the disputed domain name in bad faith targeting the complainant's rights.  Without this evidence, as in the case at hand, allegations remain unsubstantiated, and a panel will be unlikely to find in favour of the complainant.

The decision is available here.

Back to the top

A cautionary tale: UDRP complaint for amexio.com ends in finding of RDNH

In a recent decision under the Uniform Domain Name Dispute Resolution Policy (UDRP) before the World Intellectual Property Organization (WIPO), a three-member Panel unanimously denied a Complaint for the disputed domain name amexio.com, finding that the Complainants failed to establish that the disputed domain name was registered in bad faith, and entering a finding of Reverse Domain Name Hijacking.  

The Complainants in this case were Michelios 3, a holding company based in France, and AmeXio, a digital transformation company also located in France.  The First Complainant, Michelios 3, was established on 12 July 2021, and was the holding entity for the Second Complainant, AmeXio, which had been operational since 2006. AmeXio specialized in Enterprise Content Management (ECM) and Customer Communications Management (CCM) services.  The Complainants held several trademark registrations for the AMEXIO mark, including European Union Trade Mark Registration No. 018960523, registered on 23 March 2024, and French Trademark Registration No. 3819420, registered on 14 October 2011, effective from 30 March 2011.

The Respondent was incorporated in 2009 and operated a business of registering domain names and developing associated websites for clients.  The Respondent had registered several domain names similar to the disputed domain name amexio.com, including amexi.com and imexio.com.

The disputed domain name was registered on 24 July 2011.   The disputed domain name resolved to a web page that invited Internet users to contact the Respondent regarding possible ownership, use, partnership, or other development opportunities with respect to the disputed domain name.  

On 22 August 2022, the Second Complainant contacted the Respondent to request a quote for purchase of the disputed domain name, stating that its budget was "lower than $1000".  The Respondent responded the same day, indicating that this budget was too low.  The following day, the Second Complainant requested another price quote, to which the Respondent replied with a quote of USD 25,000.

In order to prevail, a complainant must demonstrate, on the balance of probabilities, that it has satisfied the requirements of paragraph 4(a) of the UDRP:

(i)         the disputed domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;

(ii)        the respondent has no rights or legitimate interests in the disputed domain name; and

(iii)       the disputed domain name was registered and is being used in bad faith.

Identity or confusing similarity

Under paragraph 4(a)(i) of the UDRP, the Panel found that the Complainants had established rights in the trademark AMEXIO, and further found the disputed domain name to be identical to the Complainants' trademark.

Rights or legitimate interests  

Noting that the Complaint would go on to fail under the third element, the Panel did not find it necessary to consider the second element.

Registration and use in bad faith

To establish bad faith registration, it must be shown that the Respondent was aware, or should have been aware, of the Complainants and/or their trademark at the time of registration, with the intention of targeting the Complainants.  In this case, the disputed domain name was registered in July 2011, three months prior to the Complainants obtaining their earliest trademark registration for AMEXIO.  The Panel noted that typically, if a domain name is registered before a complainant's trademark rights are established, bad faith is not usually found.  The Panel considered whether there were exceptional circumstances suggesting that the Respondent intended to exploit the Complainants' emerging trademark rights, especially since the Complainants' French trademark application was pending at the time of registration.  However, there was no evidence of the Complainants' existence, operations, or reputation before July 2011, nor any proof that they had used AMEXIO as a trade name prior to that date.

The Respondent's general manager stated that there was no awareness of the Complainants or their trademarks before the registration, providing a plausible explanation that the disputed domain name was a creatively coined term intended for a customer.   The Panel found this explanation credible, supported by evidence of the Respondent's prior acquisition of similar domain names.  Additionally, the Respondent's offer to sell the disputed domain name was made in response to a price quote request from the Complainants, not as an unsolicited offer.

The Panel concluded that there were no exceptional circumstances indicating that the Respondent registered the disputed domain name with the intent to exploit the Complainants' then nascent trademark rights.  The Complainant also contended that the Respondent should have been aware of the Complainants' trademark at the time of the disputed domain name's renewal.   However, the Panel referenced previous UDRP cases that did not support the concept of "retroactive" bad faith registration, affirming that this particular concept has not been followed in subsequent cases.

Reverse Domain Name Hijacking

The Respondent argued, inter alia, that the Complainants initiated the Complaint without any evidentiary basis to support a claim that they were targeted, that the Complainants materially and intentionally misrepresented their trademark rights, and that the Complainants omitted crucial context regarding a quote received from the Respondent, characterizing the situation as a "Plan B" Complaint.

The Complainants claimed that the Respondent was aware of their rights when acquiring the disputed domain name;  however, the Panel found that the Complaint lacked evidence regarding the Complainants' foundation, operations, or reputation prior to that time, or since.  The Panel further observed that the claims of bad faith included an inaccurate assertion that the disputed domain name was created "while the Complainants had already registered their trademark previously", when in fact the trademark had not yet been registered at that time, as protection was granted later with retroactive effect.  Additionally, the Complaint misleadingly stated that the disputed domain name "was proposed to be sold to the Complainants" without clarifying that the offer was solicited by the Complainants, having cropped the annexed screenshot above text indicating that the offer was prepared in response to the Complainants' quote request, which was made visible in an uncropped version provided by the Respondent.

In the Panel's view, these factors indicated bad faith, suggesting that the Complainants filed the case as a "Plan B" after failing to acquire the disputed domain name at a price within their budget.  Consequently, the Panel concluded that the Complaint was brought in bad faith and constituted an abuse of the administrative proceeding.

Comment:

The outcome of this case underscores the critical importance of establishing prior trademark rights and providing clear evidence of targeting on the part of the Respondent when filing a UDRP Complaint.  The Panel's finding of bad faith on the part of the Complainants highlights that claims of Reverse Domain Name Hijacking can arise when a Complaint is perceived as an attempt to leverage trademark rights without sufficient foundation.  Brand owners should ensure that they have a solid evidentiary basis for their claims, including demonstrating prior use and reputation. 

The decision is available here.

Back to the top 

Authored by the Anchovy News team.

Anchovy News editorial team:

• Laëtitia Arrault
• Sean Kelly         
• Ying Lou
• Cindy Mikul
• Eliza Parr
• Thomas Raudkivi
• Maria Rozylo
• Jane Seager
• David Taylor
• Tony Vitali
• Grace Wilshaw 

Anchovy® - Global Domain Name and Internet Governance

Hogan Lovells offers a unique, comprehensive and centralised Paris-based online brand protection service called Anchovy® for global domain name strategy, portfolio management and global enforcement.  We are the only law firm to be an ICANN-accredited registrar and we are accredited with a number of country-specific Registries worldwide. 

We also specialise in all aspects of ICANN’s new generic Top Level Domain (gTLD) process and we are an agent for the Trademark Clearinghouse.  As the global Domain Name System undergoes an unprecedented expansion, brand owners must revise their online protection strategies and we are ideally placed to guide them.

We are also frequently brought in to advise on cybersecurity, data protection and on a whole range of technology-related issues.

For more information on our services, please contact David Taylor or Jane Seager.