Westmore · UDRP DecisionGithub-sso.com
The Panel ordered transfer of <github-sso.com> after finding all three UDRP elements satisfied. The domain incorporated the GITHUB mark with the additional term “sso” and was used as infrastructure supporting the unauthorized collection of GitHub users’ login credentials. The Respondent did not file a response.
The timeline behind github-sso.com
Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.
Westmore reconstructs the full history behind github-sso.com — from public RDAP and the Internet Archive — as part of UDRP Intelligence:
The case illustrates that a domain can violate the UDRP when it functions as back-end infrastructure for credential harvesting, even where the deceptive login page is displayed through a different URL. It also shows that adding an authentication-related abbreviation to a trademark generally does not avoid confusing similarity where the mark remains fully recognizable.
Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.
WIPO Arbitration and Mediation Center ADMINISTRATIVE PANEL DECISION GitHub, Inc. v. Domain Administrator, See PrivacyGuardian.org / Alex Bro Case No. D2018-2045 1. The Parties The Complainant is GitHub, Inc. of San Francisco, California, United States of America (“United States”), represented by Chestek Legal, United States. The Respondent is Domain Administrator, See PrivacyGuardian.org of Phoenix, Arizona, United States / Alex Bro of Wood Dale, Illinois, United States. 2. The Domain Name and Registrar The disputed domain name <github-sso.com> is registered with NameSilo, LLC (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on September 6, 2018. On September 7, 2018, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On September 7, 2018, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on September 13, 2018 providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant declined to amend the Complaint. The Center verified that the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on September 18, 2018. In accordance with the Rules, paragraph 5, the due date for Response was October 8, 2018. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on October 9, 2018. The Center appointed Evan D. Brown as the sole panelist in this matter on October 18, 2018. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background The Complainant operates a website that hosts its users’ software code. Like many websites, participating in the Complainant’s website requires creating a username and password combination that is used to log in to the platform. The Complainant owns a number of trademark registrations for the mark GITHUB, including United States Reg. No. 3,805,847, which issued on June 22, 2010. The Respondent registered the disputed domain name on August 5, 2018. The Complainant submitted a sworn declaration of one of its security operations engineers explaining how someone (presumably the Respondent or someone working in concert with him) set up a Github account under the username “sso‑login” and proceeded to create a fake page on the Github platform. The fake page was designed to resemble the real <github.com> login page, and contained fields for collecting usernames and passwords. The use of the “sso-login” username caused the URL of the fake page (“www.sso-login.github.io”) to appear legitimate, and to induce unsuspecting users to enter their login credentials, thinking they were actually logging into Github. But underneath the surface, so to speak, something sinister was occurring – the creator of the fake page had embedded code that caused the login credentials to be uploaded to a service residing on a server associated with the disputed domain name. The disputed domain name was being used to support technology that was fraudulently collecting purloined Github login credentials. 5. Parties’ Contentions A. Complainant The Complainant contends that the disputed domain name is identical or confusingly similar to the Complainant’s registered trademarks; that the Respondent has no rights or legitimate interests in respect of the disputed domain name; and that the disputed domain name was registered and is being used in bad faith. B. Respondent The Respondent did not reply to the Complainant’s contentions. 6. Discussion and Findings To succeed, the Complainant must demonstrate that all of the elements listed in paragraph 4(a) of the Policy have been satisfied: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights; (ii) the Respondent has no rights or legitimate interests in respect of the disputed domain name; and (iii) the disputed domain name has been registered and is being used in bad faith. The Panel finds that all three of these elements have been met in this case. A. Identical or Confusingly Similar The incorporation of a trademark in its entirety is sufficient to establish that a domain name is identical or confusingly similar to a complainant’s registered mark. See Britannia Building Society v. Britannia Fraud Prevention , WIPO Case No. D2001-0505 . In this case, the disputed domain name contains the Complainant’s trademark GITHUB in its entirety. The additional letters “sso” in this context – which, according to the Complainant, refer to the online authentication technology “single sign on” – do not prevent a finding of confusing similarity. A registered trademark provides a clear indication that the rights in the mark shown on the trademark certificate belong to its respective owner. See Advance Magazine Publishers Inc., Les Publications Conde Nast S.A. v. Voguechen , WIPO Case No. D2014-0657 . The Complainant has demonstrated its rights because it has shown that it is the owner of valid and subsisting trademark registrations for the mark GITHUB as noted above. Accordingly, the Panel finds that the Complainant has shown that the disputed domain name is identical or confusingly similar to a trademark in which the Complainant has rights. B. Rights or Legitimate Interests The Panel evaluates this element of the Policy by first looking to see whether the Complainant has made a prima facie showing that the Respondent lacks rights or legitimate interests in respect of the disputed domain name. If the Complainant makes that showing, the burden of demonstrating rights or legitimate interests shifts to the Respondent. The Complainant has made a prima facie showing that the Respondent lacks rights or legitimate interests in respect of the disputed domain name. By failing to respond to the Complaint, the Respondent did not overcome its burden of demonstrating rights or legitimate interests, and no other facts in the record tip the balance in the Respondent’s favor. Paragraph 4(c) of the Policy instructs respondents on a number of ways they could demonstrate rights or legitimate interests (“you” and “your” in the following refers to the particular respondent): (i) before any notice to you of the dispute, your use of, or demonstrable preparations to use, the domain name or a name corresponding to the domain name in connection with a bona fide offering of goods or services; or (ii) you (as an individual, business, or other organization) have been commonly known by the domain name, even if you have acquired no trademark or service mark rights; or (iii) you are making a legitimate noncommercial or fair use of the domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue. In this case, the principal indicator of the lack of rights or legitimate interests comes from the alleged fraudulent nature of the Respondent’s use of the disputed domain name to engage in the unauthorized collection of Github login credentials from unsuspecting users. See Regeneron Pharmaceuticals, Inc. v. Nikki Dockum, Tred , WIPO Case No. D2018-0155 ; Syngenta Participations AG v. Guillaume Texier, Gobain ltd , WIPO Case No. D2017-1147 (registrant cannot acquire rights or legitimate interests by the use of a domain name as an email address from which to send phishing emails). Accordingly, the Respondent does not have any rights or legitimate interests in regard to the disputed domain name. C. Registered and Used in Bad Faith The Policy requires the Complainant to establish that the disputed domain name was registered and is being used in bad faith. Based on the available record, the Panel finds that the Respondent registered and is using the disputed domain name in bad faith. Registering and using the disputed domain name as an essential part of the unauthorized collection of Github login credentials from unsuspecting users is a strong example of bad faith under the Policy. Accordingly, the Complainant has satisfied this third element of the Policy. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name, <github-sso.com>, be transferred to the Complainant. Evan D. Brown Sole Panelist Date: October 18, 2018
Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.
What Westmore sees around github-sso.com
The decision is only the record. Westmore connects it to the cases, authorities, panelists, parties and domain evidence surrounding it.
A short, grounded explanation drawn only from this decision's record — not legal advice or a prediction.
Grounded in the Westmore record for this decision. Research/informational only — not legal advice or a prediction of any outcome.
The decision is only the beginning.
You've seen what happened. Now discover the deeper intelligence behind the case, the panelist, the parties and the authorities that matter.
Go beyond the public record: see how this case has been cited, find comparable decisions, analyze the panelist and apply the relevant authorities to your Matter.
Westmore Professional · $395/month
Research with UDRP IntelligenceWestmore AI drafts an attorney-review-ready UDRP response from your facts, grounded in the exact panel and closest precedent.
$895 one-time per matter · no subscription required. Self-help drafting aid — not legal advice.
Build your responseWestmore UDRP records draw on WIPO-indexed decisions and are provided for research and informational purposes only. Not legal advice, a clearance opinion, or a prediction of any outcome.