Westmore · UDRP DecisionAuth-lastpass.com
The Panel ordered transfer of <auth-lastpass.com> after finding that the domain was confusingly similar to Complainant’s registered LASTPASS mark, that Respondent had no rights or legitimate interests, and that the domain was registered and used in bad faith. The domain incorporated LASTPASS in its entirety with the term “auth.” Respondent filed no response, and the Panel found sufficient evidence of bad faith under section 3.2.1 of the WIPO Overview 3.0.
The timeline behind auth-lastpass.com
Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.
Westmore reconstructs the full history behind auth-lastpass.com — from public RDAP and the Internet Archive — as part of UDRP Intelligence:
The case illustrates how a domain combining a cybersecurity brand with an authentication-related term can strengthen the appearance of affiliation and support transfer when accompanied by deceptive-site indicators, email capability, and no respondent explanation. It also shows that a default does not automatically establish the complaint; the Panel expressly reviewed whether the submitted evidence met each UDRP element.
Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.
WIPO Arbitration and Mediation Center ADMINISTRATIVE PANEL DECISION LogMeIn, Inc. v. Withheld for Privacy Purposes, Privacy service provided by Withheld for Privacy ehf / Felipe Jackson Case No. D2021-2186 1. The Parties Complainant is LogMeIn, Inc., United States of America (“United States”), represented by Day Pitney LLP, United States. Respondent is Withheld for Privacy Purposes, Privacy service provided by Withheld for Privacy ehf, Iceland / Felipe Jackson, United States. 2. The Domain Name and Registrar The Disputed Domain Name <auth-lastpass.com> is registered with NameCheap, Inc. (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on July 7, 2021. On July 8, 2021, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Disputed Domain Name. On July 8, 2021, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Disputed Domain Name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to Complainant on July 9, 2021, providing the registrant and contact information disclosed by the Registrar, and inviting Complainant to submit an amendment to the Complaint. Complainant filed an amended Complaint on July 13, 2021. The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on July 19, 2021. In accordance with the Rules, paragraph 5, the due date for Response was August 8, 2021. Respondent did not submit any response. Accordingly, the Center notified Respondent’s default on August 12, 2021. The Center appointed Richard W. Page as the sole panelist in this matter on August 18, 2021. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background Complainant, along with all related subsidiaries and affiliates, is a leading global provider of software and software-as-a-service (“SaaS”) of cloud-based remote connectivity. Founded in 2003, Complainant has grown to become one of the world’s top SaaS companies, with platform and products that support two million users each day. Complainant owns and operates the LastPass password manager, which is offered to customers over the Internet, via software plug-ins, and through mobile applications. In operation since 2008, LastPass is among the world’s most popular password managers, serving over 7 million users worldwide. Complainant has widely used and promoted the LASTPASS Mark throughout the United States and internationally, and has secured trademark registrations for the same in connection with goods and services related to password management and security software. Shortly after its registration in May 2021, Complainant became aware of the Disputed Domain Name, which included the LASTPASS Mark in its entirety paired only with the term “auth”. The Disputed Domain Name was registered on May 12, 2021. 5. Parties’ Contentions A. Complainant Complaint contends that the Disputed Domain Name is confusingly similar to the LASTPASS Mark pursuant to paragraph 4(a)(i) of the Policy. Complainant further contends that it has a registration for the LASTPASS Mark in the United States as Trademark Registration No. 4514427, registered on April 15, 2014 with a date of first use on August 15, 2008. In addition, Complainant own registrations of the LASTPASS Mark in Australia (Registration No. 1840784), Brazil (Registration No. 912200723), Canada (Registration No. TMA 1042981), the European Union (Registration No. 1341702), India (Registration No. 3540377) and the United Kingdom (Registration No. UK00801341702). Complainant further contends that the Disputed Domain Name is confusingly similar because the entirety of the LASTPASS Mark is contained in the Disputed Domain Name. Complainant further contends that the term “auth” and the generic Top-Level Domain (“gTLD”) “.com” do not distinguish the Disputed Domain Name from the LASTPASS Mark. Complainant further contends that the term “auth” suggests that the source of the website content and/or communications is from an “authenticated” or “authorized” LastPass account. Complainant asserts that Respondent lacks rights and legitimate interests in the Disputed Domain Name pursuant to paragraph 4(a)(ii) of the Policy. Complainant’s initial concern over the Disputed Domain Name was increased when attempts to visit the website to which the Disputed Domain Name resolved displayed a warning: “Deceptive site ahead”, suggesting that “[a]ttackers on auth-lastpass.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone number, or credit cards)”. Similar notices appear regardless of the type of browser used to visit the Disputed Domain Name website. Complainant’s concern was further heightened when an MX record search of the Domain Name System (“DNS”) record indicated that the Disputed Domain Name is configured for email capabilities. Given the construction of the Disputed Domain Name, notice of deceptive content at the website and the Disputed Domain Name’s email capabilities, Complainant can only conclude that the Disputed Domain Name was registered and is being used to deceive unsuspecting victims into providing sensitive username and password information under the guise of being an “authorized” LastPass account. Complainant further asserts that Respondent has used the website to which the Disputed Domain Name resolves to host malicious content, and/or set up for email capabilities presumably to exploit confusion with the LastPass password management software to further solicit login credentials from unsuspecting LastPass software users. Complainant further asserts that the fact that MX records are associated with the Disputed Domain Name suggests that Respondent is capable of using the Disputed Domain Name to send emails, which cannot be bona fide as any email address using the Disputed Domain Name could only be use for confusing purposes. Complainant further asserts that an infringing use of the LASTPASS Mark cannot give rise to a right or legitimate interest on the part of Respondent. Respondent is making an infringing use of the LASTPASS Mark connection with the term “auth” to suggest that the source behind the Disputed Domain Name is “authorized” or “authenticated” by Complainant’s LastPass software network. Complainant further asserts Respondent is not commonly known by the name LASTPASS or AUTH-LASTPASS. Complainant further asserts Respondent has no relation with Respondent and there is nothing to suggest that Respondent has ever made use of the name LASTPASS, other than in connection with the unauthorized registration and suspected fraudulent use of the Disputed Domain Name. Complainant further asserts that there is no evidence to suggest that Respondent owns any trademark or service mark registration for LASTPASS, nor any variation thereof. Respondent does not have a license, permission or authorization from Complainant to use the LASTPASS Mark. Complainant further asserts that Respondent’s registration and use of the Disputed Domain Name cannot be considered “fair use” as it falsely suggests affiliation with Complainant and the LASTPASS Mark. Complainant alleges that Respondent has registered and used the Disputed Domain Name in bad faith, pursuant to paragraph 4(a)(iii) of the Policy. Complainant further alleges that the evidence of bad faith is in the elements not included in paragraph 4(b) of the Policy. Additional considerations include (a) the incorporation of the entire LASTPASS Mark plus a descriptive term in the Disputed Domain Name, (b) the content of any website to which the Disputed Domain Name resolves, (c) whether there is a credible explanation of Respondent’s choice of the Disputed Domain Name. Complainant cites section 3.2.1 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“ WIPO Overview 3.0 ”). B. Respondent Respondent did not reply to Complainant’s contentions. 6. Discussion and Findings Paragraph 15(a) of the Rules instructs the Panel as to the principles the Panel is to use in determining the dispute: “A Panel shall decide a complaint on the basis of the statements and documents submitted in accordance with the Policy, these Rules, and any rules and principles of law that it deems applicable”. Even though Respondent has failed to file a Response or to contest Complainant’s assertions, the Panel will review the evidence proffered by Complainant to verify that the essential elements of the claims are met. See section 4.3 of the WIPO Overview 3.0 . Paragraph 4(a) of the Policy directs that Complainant must prove each of the following: i) that the Disputed Domain Name registered by Respondent is identical or confusingly similar to LASTPASS Mark in which Complainant has rights; and, ii) that Respondent has no rights or legitimate interests in respect of the Disputed Domain Name; and, iii) that the Disputed Domain Name has been registered and is being used in bad faith. A. Identical or Confusingly Similar Complainant contends that the Disputed Domain Name is confusingly similar to the LASTPASS Mark pursuant to paragraph 4(a)(i) of the Policy. Section 1.2.1 of the WIPO Overview 3.0 states that registration of a trademark is prima facie evidence of Complainant having enforceable rights in the LASTPASS Mark. Complainant has set forth several registrations of the LASTPASS Mark, which is undisputed by Respondent. Therefore, the Panel finds that complainant has enforceable rights in the LASTPASS Mark for purposes of this proceeding. The Panel further finds that the entirety of the LASTPASS Mark is included within the Disputed Domain Name, with the addition of the term “auth”. Section 1.7 of the WIPO Overview 3.0 says that inclusion of the entire trademark in a domain name will be considered confusingly similar. Also, section 1.8 of the WIPO Overview 3.0 instructs that the addition of other terms (whether descriptive, geographical, pejorative, meaningless or otherwise) does not prevent a finding of confusing similarity. Also, section 1.11.1 of the WIPO Overview 3.0 instructs that gTLDs such as “.com” may be disregarded for purposes of assessing confusing similarity. Based upon this record, the Panel finds that the Disputed Domain Name is confusingly similar to the LASTPASS Mark and that Complainant has satisfied the requirements of paragraph 4(a)(i) of the Policy. B. Rights or Legitimate Interests Complainant contends that Respondent has no rights or legitimate interest in the Disputed Domain Name pursuant to paragraph 4(a)(ii) of the Policy. Section 2.1 of the WIPO Overview 3.0 states that once Complainant makes a prima facie case in respect of the lack of rights or legitimate interests of Respondent, Respondent carries the burden of demonstrating it has rights or legitimate interests in the Disputed Domain Name. Where Respondent fails to do so, Complainant is deemed to have satisfied paragraph 4(a)(ii) of the Policy. Paragraph 4(c) of the Policy allows three non-exclusive methods for the Panel to conclude that Respondent has rights or legitimate interests in the Disputed Domain Name: (i) before any notice to you [Respondent] of the dispute, your use of, or demonstrable preparations to use, the Disputed Domain Name or a name corresponding to the Disputed Domain Name in connection with a bona fide offering of goods or services; or (ii) you [Respondent] (as an individual, business, or other organization) have been commonly known by the Disputed Domain Name, even if you have acquired no trademark or service mark rights; or (iii) you [Respondent] are making a legitimate noncommercial or fair use of the Disputed Domain Name, without intent for commercial gain to misleadingly divert consumers or to tarnish the LASTPASS Mark. Complainant asserts that Respondent has used the website to which the Disputed Domain Name resolves to host malicious content, and/or set up for email capabilities presumably to exploit confusion with the LastPass password management software to further solicit login credentials from unsuspecting LastPass software users. Complainant further asserts that the fact that MX records are associated with the Disputed Domain Name suggests that Respondent is capable of using the Disputed Domain Name to send emails, which cannot be bona fide as any email address using the Disputed Domain Name could only be use for confusing purposes. Complainant further asserts that an infringing use of the LASTPASS Mark cannot give rise to a right or legitimate interest on the part of Respondent. Complainant alleges that Respondent is making an infringing use of the LASTPASS Mark connection with the term “auth” to suggest that the source behind the Disputed Domain Name is “authorized” or “authenticated” by Complainant’s LastPass software network. Complainant further asserts that Respondent is not commonly known by the name LASTPASS or AUTH-LASTPASS. Complainant further asserts that Respondent has no relation with Complainant and there is nothing to suggest that Respondent has ever made use of the name LASTPASS, other than in connection with the unauthorized registration and suspected fraudulent use of the Disputed Domain Name. Complainant further asserts that there is no evidence to suggest that Respondent owns any trademark or service mark registration for LASTPASS, nor any variation thereof. Respondent does not have a license, permission or authorization from Complainant to use the LASTPASS Mark. Complainant further asserts that Respondent’s registration and use of the Disputed Domain Name cannot be considered “fair use” as it falsely suggests affiliation with Complainant and the LASTPASS Mark. The Panel finds that Complainant has made a prima facie showing under paragraph 4(a)(ii) of the Policy. Respondent has not contested Complainant’s assertions or offered any explanation why it registered the Disputed Domain Name. Therefore, the Panel finds that Complainant has satisfied the requirements of paragraph 4(a)(ii) of the Policy. C. Registered and Used in Bad Faith Paragraph 4(b) of the Policy sets forth four non-exclusive criteria for Complainant to show bad faith registration and use of the Disputed Domain Name. Complainant states that the evidence of bad faith is in the elements not included in paragraph 4(b) of the Policy. Additional considerations include (a) the incorporation of the entire LASTPASS Mark plus a descriptive term in the Disputed Domain Name, (b) the content of the website to which the Disputed Domain Name resolves contains malicious software, (c) there is no credible explanation of Respondent’s choice of the Disputed Domain Name. Complainant cites section 3.2.1 of the WIPO Overview 3.0 . The four criteria set forth in the Policy paragraph 4(b) are non-exclusive. See, Telstra Corporation Limited v. Nuclear Marshmallows , WIPO Case No. D2000-0003 (“ Telstra ”). In addition to these criteria, other factors alone or in combination can support a finding of bad faith. The Panel finds that Complainant has shown sufficient evidence that Respondent is acting in bad faith under section 3.2.1 of the WIPO Overview 3.0 . Respondent has offered no explanation of its registration and/or use of the Disputed Domain Name. Therefore, the Panel finds that Complainant has proven the required elements of paragraph 4(a)(iii). 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Disputed Domain Name, <auth-lastpass.com> be transferred to Complainant. Richard W. Page Sole Panelist Date: August 27, 2021
Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.
What Westmore sees around auth-lastpass.com
The decision is only the record. Westmore connects it to the cases, authorities, panelists, parties and domain evidence surrounding it.
A short, grounded explanation drawn only from this decision's record — not legal advice or a prediction.
Grounded in the Westmore record for this decision. Research/informational only — not legal advice or a prediction of any outcome.
The decision is only the beginning.
You've seen what happened. Now discover the deeper intelligence behind the case, the panelist, the parties and the authorities that matter.
Go beyond the public record: see how this case has been cited, find comparable decisions, analyze the panelist and apply the relevant authorities to your Matter.
Westmore Professional · $395/month
Research with UDRP IntelligenceWestmore AI drafts an attorney-review-ready UDRP response from your facts, grounded in the exact panel and closest precedent.
$895 one-time per matter · no subscription required. Self-help drafting aid — not legal advice.
Build your responseWestmore UDRP records draw on WIPO-indexed decisions and are provided for research and informational purposes only. Not legal advice, a clearance opinion, or a prediction of any outcome.