A brand domain was cybersquatted and used in phishing emails impersonating the company: how can an overseas-expanding enterprise recover the domain through UDRP?

If a Chinese overseas-expanding enterprise discovers that someone abroad has registered a domain containing its brand name and is using that domain to impersonate company employees and send payment-change emails to customers, its first reaction is often "this is fraud—can we just get it back?" A domain name does not automatically belong to the trademark owner; recovering it usually requires going through a domain dispute resolution procedure.

A decision issued on 15 by the Arbitration and Mediation Center of the World Intellectual Property Organization (WIPO) in 2026 10 illustrates the review approach in such cases. Case No. D2026-3975, sole panelist Dawn Osborne. The complainant was the Swiss company Liebherr-International AG, the respondent was the U.S. individual Mike Parker, and the disputed domain name liebherrgroupusa.com was registered with the registrar HOSTINGER operations, UAB.

The facts are not complicated, but the details are worth examining. The complainant is the parent company of the Liebherr group, which was founded in 1949 and, according to official materials, has more than 150 companies in more than 50 countries, with products including earthmoving machinery, mining equipment, cranes and concrete technology. The complainant holds multiple LIEBHERR trademarks, including International Registration No. 860617 (registered on 26 in 4 2005), and owns domains such as liebherr.com and liebherr.us.

The disputed domain name was registered on 6 in 2 2026 and was thereafter used as an email address for payment fraud targeting a U.S. trucking company. The methods used in the fraud included the graphic form of the complainant's logo, the name of one of the complainant's employees, the complainant's real website address, and the name "Liebherr Group Inc." In other words, beyond the domain name, the other party also carried over the rights holder's logo, personnel and website address.

The procedural timeline is also instructive. The complaint was filed on 4 in 9 2026; the registrar responded with verification on 7 9, and the registrant information disclosed did not match the respondent named in the complaint; the Center informed the complainant on 10 9 and invited an amendment, and the complainant submitted an amended complaint on 11 9; the proceedings commenced on 15 9, with a response deadline of 5 10; the respondent did not respond, and the Center notified default on 7 10; a sole panelist was appointed on 15 10, and the decision was issued the same day.

The findings on the three elements are as follows.

First, confusing similarity. The disputed domain name fully copies the LIEBHERR trademark, and the added "group," "usa" and ".com" do not prevent a finding of confusing similarity. Although these two added words may affect the assessment of the second and third elements, they play no distinguishing role at the first-element threshold.

Second, rights or legitimate interests. The complainant first establishes a prima facie case: the respondent used the trademark without authorization, there is no evidence that the respondent is widely known by the domain name, and the domain name was used in fraudulent emails impersonating the complainant. The burden of proof thereby shifts to the respondent, who submitted no materials, so this element is found established. The panel also noted that using a domain name for illegal activities such as phishing and fraud can never create rights or legitimate interests for the respondent.

Third, bad-faith registration and bad-faith use. The panel explained that the circumstances listed in Article 4(b) of the UDRP are not exhaustive, and other circumstances may likewise be used to assess bad faith; in this case, the domain name was used in fraudulent emails impersonating the complainant, which constitutes using the domain name for illegal activities and amounts to bad faith. Both the registration and the use of the domain name were found to be in bad faith.

The reason findings in such cases are relatively straightforward is that this is not a borderline "similar but unused" scenario: here the domain name was not used for normal business operations but as the sending address for fraudulent emails, pointing directly to illegal activity. In such circumstances, the room for defending the second and third elements is very narrow—there is neither an authorization relationship nor any bona fide use to speak of. Conversely, if the respondent asserted prior use, lawful distribution, or other legitimate reasons, the conclusion could be different.

There are two procedural details worth remembering.

First, the naming of the respondent. The registrant information disclosed by the registrar after verification did not match what was listed in the complaint, so the Center invited the complainant to amend, and the complainant submitted an amended complaint the next day. If this step is not handled, the proceedings may only discover after commencement that the wrong party was named, slowing the pace. Checking the registrant details disclosed by the registrar before commencement is a step often overlooked in practice.

Second, default is not an automatic win. The respondent did not respond at any stage, but the panel still examined each element and cited the relevant sections of the WIPO Overview, giving reasons for each element separately. Default relieves the other party of its burden of proof, not the complainant of its burden of proof.

For companies preparing to initiate domain name dispute proceedings, several categories of materials can be organized in advance: registration information and the status of rights in the brand trademark; the correspondence between the disputed domain name and the trademark; screenshots, emails and correspondence records showing the domain name used for impersonation, fraud or other improper use; and materials showing the company's own continuous use and promotion of the brand. The third category is often the easiest to lose—fraudulent emails, counterfeit pages, and payment-change notices received by customers are most complete in the early stage of an incident; once the other party changes addresses or disables email accounts, obtaining evidence becomes noticeably more difficult.

It is also necessary to distinguish the objectives of the proceedings. Domain name dispute proceedings resolve domain name ownership, and the remedies are transfer or cancellation; they do not directly handle recovery of defrauded funds, nor do they replace trademark infringement litigation, criminal reports, or contractual communication with customers. Domain name proceedings seek control, trademark enforcement addresses counterfeit use, and responding to fraud involves customers, banks and local law enforcement agencies; the objectives, evidentiary requirements and timing of these paths all differ and need to be arranged separately.

It should be noted that in this case the complainant presented sufficient evidence and the respondent was absent throughout, so the findings on the three elements were relatively straightforward; a single decision cannot be treated as a general rule. Whether the conditions for filing are met and under which procedural framework to assert a claim should still be checked item by item against the basis of the trademark right, the evidence of use and the rules of the target jurisdiction.

Source: WIPO Arbitration and Mediation Center case D2026-3975, "Liebherr-International AG v. Mike Parker", sole panelist Dawn Osborne, 2026 10 15.

Note: This article provides general intellectual property education and practical observations and does not constitute legal advice for any specific case.