News

Domain Name News: June 2025

Fish
Fish

This is the June 2025 edition of Anchovy News. Here you will find articles concerning ICANN, the domain name industry and the recuperation of domain names across the globe. In this issue we cover:

For earlier Anchovy News publications, please visit our Domain Names practice page. Learn more about Anchovy® - Global Domain Name and Internet Governance here

Domain name industry news

INFERMAL report points finger at bargain basement domains

The report on the two-year research project INFERMAL (Inferential Analysis of Maliciously Registered Domains) commissioned by the Internet Corporation for Assigned Names and Numbers (ICANN) has identified a number of factors that influence malicious actors to cluster around particular registrars and TLDs for their abusive domain names.  The report found that cut-price registrations were top of the list.

The project, led by the Security, Stability, and Resiliency (SSR) Research team within ICANN’s Office of the Chief Technology Officer (OCTO) built upon previous work that had revealed “an abnormally high concentration of malicious registrations in a handful of domain name registrars and top-level domains (TLDs)”.  The project analysed more than 29,000 domain names, half of which were malicious and half of which were benign, over a two-year period, in order to identify which registrar and Registry attributes were most closely associated with domain name abuse, such as phishing.

The research carried out by the project analysed a set of 73 features related to registrar services and policies categorised into the following three groups:

1. Registration Attributes – Pricing, API access, payment methods, bundled services.

2. Proactive Verification – Identity checks, delays in activation, Know Your Business Customer (KYBC) procedures.

3. Reactive Security Practices – Measures taken after abuse, such as domain suspension speed.

There were several key findings of the report, but foremost among them was that price was a big determining factor for abusive domain names.  The report notes that “malicious actors are highly price-sensitive” and that domain names used for phishing were generally registered for around USD 4.71, compared to benign domain names, which averaged USD 8.62.

As malicious domain names are often taken down quite rapidly, the report pointed out that “attackers have to fulfill a constant need for numerous single-use domain names to evade detection and maintain their malicious activities effectively” and the report cited analysis showing that “each dollar reduction in registration fees corresponds to a 49% increase in malicious domains.

The report highlighted the fact that registrars that offered free DNS services and bundled web hosting were associated with higher rates of malicious registrations. Moreover, registrars with APIs that enable bulk, automated registration and configuration are particularly vulnerable to malicious registrations. The report suggested that API access should be restricted to “known, vetted users” in order to mitigate this problem (for example: certain registrars already limit use of their bulk registration APIs to customers who already have 50 domain names in their account).

As to measures that were found to have reduced the risk of abusive registrations, the report stated that “proactive restrictions at the point of registration”, such as identity verification, registration delays, or KYBC practices, resulted in a 63% reduction in abuse rates.  Nevertheless, the report acknowledges that measures such as digital identity verification are not infallible in that they can be thwarted by practices such as identity theft, and that even some Registries that used identity verification, such as China’s .CN, had high abuse rates.

With regard to actions that were found to be less effective at preventing domain name abuse, the report identified reactive measures, such as rapid takedowns.  This is because phishing campaigns can often be carried out more rapidly than such measures can be implemented.

In its comments on the INFERMAL Study, ICANN highlighted “the role of registrar and TLD policy decisions in shaping the threat landscape” and concluded that “well-targeted mitigation strategies, such as restricted API access, identity verification, and pricing transparency, can reduce abuse while preserving access for legitimate users.”

ICANN has invited input on the report’s findings and has also stated that future research could explore topics such as:

  • Abuse patterns beyond phishing, such as malware and spam.
  • Comparative studies across country-code TLDs.
  • Longitudinal studies of domain lifecycle and abuse evolution.

In the meantime, it will be interesting to see whether more registrars and Registries introduce the kind of proactive measures called for in the report.

Back to the top

.You .Talk .Fast!

Further to the recent launch of the new generic Top Level Domains (gTLDs) .FREE, .HOT and .SPOT in April, Amazon Registry continues the momentum and has announced the upcoming launch of three additional new gTLDs: .YOU, .TALK and .FAST.

Amazon Registry runs other new gTLDs, such as .BOT, .MOI (‘me’ in French), .NOW and .DEAL.  It holds a number of additional new gTLDs in its portfolio which were delegated by ICANN some ten years ago but were never launched.  Amazon Registry appears to be releasing them gradually and has now turned to .YOU, .TALK and .FAST.

As these three new gTLDs are likely to raise some interest, trade mark owners may wish to secure their trade marks under these new extensions before third parties can snap them up, especially as none of them have registration restrictions.

The launch schedule is as follows:

  • Sunrise Period: from 26 August 2025 to 25 September 2025

    During this period, trade mark holders who have registered their trade marks with the TradeMark Clearinghouse (TMCH) will be able to apply for the corresponding domain names under any of these three new gTLDs.  It is a “Start Date” Sunrise for all three, meaning that domain names will be allocated on a first-come, first-served basis.

  • Early Access Period (EAP): from 25 September 2025 to 6 October 2025

    During this period, available domain names may be registered by anyone on a first-come, first-served basis at a higher price, which will decrease day by day leading up to General Availability.

  • General Availability: from 6 October 2025 onwards

As from this date, anyone will be able to register available YOU, .TALK and .FAST domain names on a first-come, first-served basis, at standard prices.

For more information on the launch of these new gTLDs or to register domain names, please contact David Taylor or Jane Seager.

Back to the top

WHOIS privacy implemented on Nigerian domain names

Nigeria Internet Registration Association (NiRA), the Registry responsible for running the .NG country code Top Level Domain (ccTLD), has recently implemented WHOIS Privacy on all .NG domain names.  This initiative is aimed at “enhancing digital trust and privacy within Nigeria’s internet ecosystem” and the decision to implement WHOIS Privacy was taken following the recent election of new directors to NiRA’s Executive Board.

Previously, WHOIS records for .NG domain names listed the details for registrants, including names, addresses, telephone numbers and email addresses.  The new WHOIS Privacy service, which went live on 16 June 2025, will enable registrants to mask their personal information with the label “Data Redacted”.  NiRA believes that this change will enhance user privacy, limit unsolicited communications, mitigate spam, and ensure alignment with international best practices in data protection and internet governance.

Although personal contact details will be redacted, essential technical information, such as nameservers, domain status and registration or expiration dates, will remain publicly accessible in order to “ensure the stability and transparency of internet operations”.  To accommodate legitimate access requirements, NiRA has established a “structured mechanism to support lawful inquiries”, including those from law enforcement agencies, through registrar-mediated communication that will safeguard the registrant’s identity.

The redaction will be handled at the Registry level, using existing systems that already support data protection standards for EU citizens.  NiRA believes that this will ensure compliance with Nigeria’s Data Protection Act (NDPA) and will reinforce NiRA’s ongoing collaboration with the Nigeria Data Protection Commission (NDPC).

NiRA has stated that the launch of the WHOIS service also demonstrates its commitment to making the .NG domain name space safer and more trustworthy for Nigerians, and for .NG domain name registrants in general.  By putting privacy first, NiRA has stated that it is working towards keeping the .NG domain name extension a “reliable, secure, and globally respected namespace.

With its newly elected Executive Board, NiRA is aiming to build stronger partnerships and push forward important reforms.  NiRA views initiatives like the WHOIS Privacy Redaction as a reflection of its “forward-thinking approach to internet governance and domain name management in Nigeria and across Africa.

Mr. Adesola Akinsanya, President of NiRA asserted that:

The introduction of WHOIS Privacy Redaction is a pivotal development for the .ng domain ecosystem.  At NiRA we are committed to safeguarding the privacy of our registrants and fostering a secure online environment.  This free service reflects our dedication to data protection, public trust, and the continued growth of the .ng country code Top-Level Domain (ccTLD).

To visit NiRA, please click here.

For more information on .NG or to register domain names under any extension, please contact David Taylor or Jane Seager.

Back to the top

Domain name recuperation news

Debugging the code: UDRP claim backfires as reverse domain name hijacking

In a recent decision under the Uniform Domain Name Dispute Resolution Policy (the UDRP or the Policy) before the World Intellectual Property Organization (WIPO), the Panel denied the transfer of the domain name <decodeage.com>, finding that the Complainant had failed to demonstrate a lack of rights or legitimate interests on the part of the Respondent. The Panel also made a finding of Reverse Domain Name Hijacking (RDNH).

The Complainant was a company based in the United States specialising in nutritional supplements. It registered the domain <codeage.com> in 2012 and had been using the CODEAGE mark since at least 2017, supported by trade mark registrations in the United States and other jurisdictions, including India. In 2024, the Complainant filed court proceedings in the United States against the Respondent for trade mark infringement.

The Respondent, Centenarians Life Sciences Pvt Ltd, was an Indian company offering longevity-focused products and diagnostics under the brand DECODE AGE.  It registered the domain name <decodeage.com> in 2022 and operated an active website at the domain. The Respondent owned three Indian trade mark registrations for DECODE AGE across classes 1, 5, and 42, all obtained prior to the filing of the Complaint, and claimed commercial use of the mark since 2021.  The Respondent agreed to cease marketing its products in the United States under the trade mark DECODE AGE in June 2024 but declined to terminate global use or transfer the disputed domain.

Before examining the merits of the case, the Panel addressed the admissibility of supplemental filings submitted by both parties.  Although neither the Policy nor the Rules expressly provide for such filings, the Panel may accept them at its discretion, provided the parties are treated equally and given a fair opportunity to present their case.  In this instance, the Complainant submitted additional material, seeking to demonstrate use of its trade mark in India.  The Respondent opposed the submission, arguing that it could and should have been included in an amended Complaint following the Registrar's Verification Response, particularly as the Complainant was already engaged in litigation with the Respondent at that time. The Panel decided to admit both the Complainant's and the Respondent's supplemental filings.

To be successful in a complaint under the UDRP, a complainant must satisfy the following three requirements under paragraph 4(a) of the Policy: 

(i)         the domain name is identical or confusingly similar to a trade mark or service mark  in which the complainant has rights; and

(ii)        the respondent has no rights or legitimate interest in respect of the domain name; and

(iii)       the domain name has been registered and is being used in bad faith.

On the first limb, the Panel found that the domain name was confusingly similar to the Complainant's CODEAGE mark.  Disregarding the ".com" gTLD, the domain <decodeage.com> incorporated the CODEAGE mark in its entirety, and the prefix "de" did not prevent a finding of similarity. The Respondent contested this conclusion, arguing that the Complainant had no presence or reputation in India and that its Indian trade mark rights were later in time than the Respondent's own. The Respondent also submitted that its website did not seek to trade off the Complainant's brand. However, the Panel clarified that such considerations fell outside the scope of the first element. At this stage of the analysis, the test is limited to a visual and aural comparison between the disputed domain name and the Complainant's proven trade mark rights.  Broader issues such as geographic market overlap, seniority of rights, or alleged intent to capitalise on a reputation are not relevant under this limb and are more appropriately addressed under the second and third elements of the UDRP. The Panel thus concluded that the Complainant had met the first requirement.

On the second limb, the Panel found that the Complainant had not established a prima facie case that the Respondent lacked rights or legitimate interests in the domain name. It was undisputed between the parties that the Respondent registered the domain name after the Complainant began using the CODEAGE mark in 2017 and after securing registrations outside India, that the parties were unaffiliated, and that the Complainant had not authorised the use of the name. It was also uncontested that the domain name <decodeage.com> was not derived from the Respondent's corporate name.  However, the Respondent asserted that it held priority rights in India through both use and registration of the DECODE AGE mark before the Complainant had established any presence or registered rights in that jurisdiction.  In response, the Complainant submitted a supplemental filing in an attempt to demonstrate use of its mark in India since 2019.  The Panel admitted the filing, but noted the Respondent's substantive objections to the cogency of that evidence. 

The Panel gave weight to the Respondent's Indian trade mark registrations for DECODE AGE, obtained prior to the filing of the Complaint, and noted that the products and services offered on the Respondent's website fell squarely within the specifications covered by those registrations.  The Panel also considered that the semantic meaning of the Respondent's trade mark conveyed a different impression to that of the Complainant's trade mark. The Panel could not determine the reach of the sales or whether the Complainant had built a notable reputation in India based on the evidence provided.  Importantly, the Respondent had also confirmed that it had withdrawn its products from the United States following the commencement of legal proceedings and continued to operate only in the Indian market. While the Panel acknowledged that questions of validity or infringement of the Respondent's registrations fell within the jurisdiction of national courts, it held that the Respondent’s registered national trade marks gave rise to a legitimate interest under the Policy. Accordingly, the Complainant failed to satisfy the second requirement.

In light of its findings on the second element, the Panel did not consider it necessary to address the issue of bad faith under the third element.

The Panel found that the Complaint constituted RDNH under paragraph 15(e) of the UDRP Rules.  The Complainant had already initiated court proceedings in the United States before filing the UDRP Complaint.  It was fully aware of the Respondent's identity and business operations in India, yet made no effort to amend the Complaint after receiving the Registrar Verification Response or the Center's invitation to do so.  The Panel considered it likely that the Complainant knew the Respondent had obtained registered trade marks for DECODE AGE in India, particularly since its own Indian application was filed later. Nonetheless, this information was not disclosed.  Furthermore, while the Complainant alleged that the Respondent had failed to respond to cease and desist letters, the Panel noted that the Respondent's Indian attorney had, in fact, replied and confirmed the cessation of sales in the United States.  Taken together, these circumstances supported a finding of RDNH.

This decision reinforces the importance of carefully evaluating a respondent's established rights and disclosing all material facts when initiating UDRP proceedings. Failure to do so may not only lead to the dismissal of a complaint, but also to a finding of RDNH.

The decision is available here.

Back to the top

Time to face the music under the UDRP: Artist fails to recuperate lapsed domain name

In a recent decision under the Uniform Domain Name Dispute Resolution Policy (UDRP) before the World Intellectual Property Organization (WIPO), a Panel denied a UDRP Complaint for the disputed domain name <bellefoliemusic.com> (the disputed Domain Name).  The Panel found that the Respondent had used a name corresponding to the disputed Domain Name in connection with a bona fide offering of services and likely registered it without knowledge of the Complainant.

The Complainant, who operated under the stage name "Belle Folie", was a freelance artist and music composer with a registered address in Australia.  The Complainant had used the stage name "Belle Folie" since 2016, having been announced as a finalist in the 2016 Australian Independent Music Awards and having released its first track on Soundcloud in October 2016.  Since that date, the evidence suggested that the Complainant was featured in the October 2016 issue of the magazine "Surreal Beauty" and released a second track in February 2017.  The Complainant claimed that its stage name was well known and that it had cultivated a unique following within the cabaret, film and media spaces.  The Complainant maintained a modest social media following, indeed acknowledging its modest nature in the Complaint.

The Complainant did not hold registered trade mark rights in its stage name "Belle Folie" and claimed unregistered rights based on its use of the name since 2016.  The Complainant registered the disputed Domain Name in 2019 and was apparently unable to renew it for personal reasons in March 2024.

The disputed Domain Name was registered by or on behalf of the Respondent, a Norwegian artist, composer and music producer, on 1 August 2024.  The Respondent launched a band project called "Bellefolie" in late 2023 and established a presence in the Norwegian and European music markets, having performed in concerts in Norway, Paris and London.  The Respondent had released tracks via various streaming platforms, including Spotify. 

To be successful in a complaint under the UDRP, a complainant must satisfy the following three requirements:

(i)         The domain name registered by the respondent is identical or confusingly similar to a trade mark or service mark in which the complainant has rights; and

(ii)        The respondent has no rights or legitimate interests in respect of the domain name; and

(iii)       The domain name has been registered and is being used in bad faith.

The Complainant argued that it had satisfied each of the elements under the UDRP, noting that it possessed unregistered trade mark rights in its stage name "Belle Folie" based on its use of the name as an artist and musician since 2016.  The Complainant also argued that the Respondent could not claim rights or legitimate interests in the disputed Domain Name because it had intentionally traded on the goodwill and reputation of the Complainant, which did not constitute a bona fide offering of goods or services.  Finally, the Complainant argued that the timing of the registration of the disputed Domain Name by the Respondent, occurring shortly after the Complainant's registration lapsed, strongly suggested that the Respondent was fully aware of the Complainant's prior use of the disputed Domain Name and that the Respondent's actions were deliberate and opportunistic with the intent to capitalise on the Complainant's reputation and to mislead the public.

In its Response, the Respondent asserted that before registering the disputed Domain Name it had checked the most widely used streaming platforms, including Spotify, Tidal, Apple Music and iTunes, to ensure that there were no rights in the name "Bellefolie".  The Respondent also noted that the Complainant could not be said to enjoy unregistered rights in "Belle Folie" as it had not made any music available on any major streaming platforms.  Furthermore, the Respondent noted that the Complainant had a minimal social media presence using its stage name "Belle Folie" and even if it did enjoy unregistered rights, such rights would have lapsed as a result of inactivity, with the Complainant's song releases being eight years old.

In relation to the second element, the Respondent submitted that it was making a bona fide offering of goods or services via its use of the disputed Domain Name, having chosen the name "Bellefolie" in 2023 as part of a process between the Respondent and its manager, with no knowledge of the Complainant even after conducting investigations.  The Respondent also argued that it had a legitimate interest in the disputed Domain Name as its concert activities and music sales/streaming revenues made up a significant portion of its income.

In relation to the third element, the Respondent argued that it was unaware of any active Australian artist using a similar name when it registered the disputed Domain Name and denied that it registered the disputed Domain Name for the purposes of selling or otherwise transferring it to the Complainant or a competitor, adding that it had a legitimate interest to promote its band.

The Panel noted that the Complainant had provided some limited evidence that it was prepared to accept as establishing a secondary meaning in the Complainant's stage name "Belle Folie" for the limited purpose of establishing standing under the first element.  The Panel noted that the fact that such secondary meaning may only exist in a particular geographical area (here, Australia) did not preclude a complainant from establishing trade mark rights for the limited purposes of standing under the UDRP.  As a result, the Panel found that the Complainant satisfied the first element of the UDRP because it had established unregistered rights in the BELLE FOLIE trade mark.  The Panel was satisfied that the addition of the term "music" to the Complainant's trade mark did not prevent a finding of confusing similarity between the disputed Domain Name and the Complainant's trade mark.

In relation to the second element, the Panel found that before notice to the Respondent of the dispute, the Respondent had used a name that corresponded to the disputed Domain Name in connection with a bona fide offering of services.  In reaching this finding, the Panel was persuaded by the Respondent's evidence that it came upon the name "Belle Folie" independently of the Complainant's stage name and that it was a mere coincidence that the name was identical to the name previously used by the Complainant.

In relation to the third element, the Panel found that the Complainant's claim of bad faith registration and use was not made out, noting that there was no evidence to suggest that the Respondent registered the disputed Domain Name to benefit in any way from any rights previously established by the Complainant.  In the Panel’s opinion, the Respondent likely came up with its name entirely independently of, and without any awareness of, the Complainant or any rights that the Complainant had previously established in such a name.  The Panel noted that there was no evidence that the Complainant was famous, either nationally or internationally.  Based on the evidence available to the Panel, the Complainant did not appear to have maintained an active social media presence,

This decision underlines the importance of maintaining and renewing domain name registrations where they still have a value to the domain name registrant.  Often, the cost of renewing a domain name is far less in the long run than the cost and time involved when seeking to recuperate a domain name that has lapsed and been re-registered by a third party via the UDRP, and indeed there is no guarantee that any UDRP Complaint will be successful, particularly where the complainant in question does not have a strong social media presence or has not been recently active in the relevant sector.

The decision is available here.

Back to the top

Parking company fails to prove bad faith in UDRP Complaint for parked domain name

In a recent decision under the Uniform Domain Name Dispute Resolution Policy ("UDRP") before the World Intellectual Property Organization ("WIPO"), a panel denied a Complaint regarding the disputed domain name <parkngofly.com> (the "Domain Name"), finding that the Complainant had failed to demonstrate that the Respondent's intent was to profit from or exploit the Complainant's trade mark when registering the Domain Name. 

The Complainant was a United States company that had been operating airport parking and shuttle services in the United States since 1967.

The Complainant was the owner of a number of trade mark registrations for PARK 'N FLY, including United States Trademark Registration No. 1111956, registered on 23 January 1979.  The Complainant was also the registrant of the domain name <parknfly.com>, which redirected to the Complainant's website at "www.theparkingspot.com". 

The Domain Name was registered on 4 May 2024.  The Domain Name resolved to a parking page displaying Pay-Per-Click ("PPC") links related to parking services at airports from around the world. 

To succeed under the UDRP, a complainant must satisfy the requirements of paragraph 4(a) of the Policy:

  1. The disputed domain name is identical or confusingly similar to a trade mark or service mark in which the complainant has rights;
  2. The respondent has no rights or legitimate interests in respect of the disputed domain name;and
  3. The disputed domain name was registered and is being used in bad faith.

Identity or confusing similarity

The Panel found that the Complainant had established rights in the trade mark PARK 'N FLY, and that despite the inclusion of the term "go" in the Domain Name, the Panel considered the Domain Name to be confusingly similar to the Complainant's trade mark.  The Complainant had satisfied the requirements of paragraph 4(a)(i) of the Policy.

Rights or legitimate interests

The Panel noted that the Respondent, who had not come forward to submit a Response to the Complaint, had not rebutted the Complainant's assertions regarding the Respondent's lack of rights or legitimate interests in the Domain Name.  The Panel noted, however, that the Domain Name was composed of dictionary terms that when read together formed a commonly used phrase, and that the phrase "park and fly" could be used in a descriptive sense by third parties.  Indeed, the Panel observed that the same phrase was used by other operators in a number of jurisdictions, including in Canada where the Respondent was based.  Noting that the Complaint would go on to fail under the third element, the Panel did not consider it necessary to reach a finding under paragraph 4(a)(ii) of the Policy.

Bad faith

The Complainant argued that the Respondent had registered the Domain Name with the Complainant's PARK 'N FLY trade mark in mind.  However, the evidence presented by the Complainant was insufficient to support this claim.  The Panel noted once more that the terms "park and fly" are commonly used in the context of airport parking services, and the inclusion of "go" in the disputed domain name suggested a possible descriptive use of the Domain Name rather than an intent on the part of the Respondent to target the Complainant.  Additionally, the Complainant did not provide evidence of malicious intent, such as phishing activities.  The Panel also found that a missing SSL certificate and the Respondent's silence in response to the Complainant's pre-Complaint correspondence did not necessarily indicate bad faith registration and use.  The presence of PPC links on the parking page to which the Domain Name resolved was not inherently indicative of cybersquatting or bad faith, as monetizing domain names composed of dictionary terms can be legitimate.  Ultimately, the Panel concluded that the Complainant did not meet the burden of proof required to establish bad faith registration and use by the Respondent.  The Complainant therefore failed to satisfy the requirements of paragraph 4(a)(iii) of the Policy.

Comment:

There are a number of key points that can be drawn from this decision.  First, under the UDRP the Complainant carries the burden of proof to demonstrate bad faith registration and use.  Filing parties should ensure that substantial and direct evidence is provided to support claims of trade mark misuse.  Secondly, when dealing with domain names composed of dictionary terms, Complainants ought to consider the commonality and descriptive nature of terms used.  If the relevant terms are widely used in a particular industry, it may weaken claims of bad faith registration and use.  Thirdly, while claims of bad faith may be established by evidence of malicious intent such as phishing or other fraudulent activity, mere assumptions or indirect indicators may not suffice (in this instance, the absence of an SSL certificate or a lack of Response from the Respondent did not support a finding of bad faith).  Finally, additional terms (in this case the inclusion of the term "go") can amount to evidence of alternative uses of a phrase unrelated to a Complainant's trade mark, further undermining a Complainant's claim of bad faith.

The full decision is available here.

Back to the top

Authored by the Anchovy News team.

Anchovy News editorial team:

  • Laëtitia Arrault
  • Sean Kelly         
  • Ying Lou
  • Cindy Mikul
  • Eliza Parr
  • Thomas Raudkivi
  • Maria Rozylo
  • Jane Seager
  • David Taylor
  • Tony Vitali
  • Grace Wilshaw

Anchovy® - Global Domain Name and Internet Governance

Hogan Lovells offers a unique, comprehensive and centralised Paris-based online brand protection service called Anchovy® for global domain name strategy, portfolio management and global enforcement.  We are the only law firm to be an ICANN-accredited registrar and we are accredited with a number of country-specific Registries worldwide. 

We also specialise in all aspects of ICANN’s new generic Top Level Domain (gTLD) process and we are an agent for the Trademark Clearinghouse.  As the global Domain Name System undergoes an unprecedented expansion, brand owners must revise their online protection strategies and we are ideally placed to guide them.

We are also frequently brought in to advise on cybersecurity, data protection and on a whole range of technology-related issues.

For more information on our services, please contact David Taylor or Jane Seager.

View more insights and analysis

Register now to receive personalized content and more!