Cobaltstrike.net

The timeline behind cobaltstrike.net

Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.

Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.

ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Help/Systems, LLC v. Contact Privacy Inc. Customer 7151571251 / Feras Bashiti, Jordan FreeDOM Case No. D2022-2999 1. The Parties Complainant is Help/Systems, LLC, United States of America (“United States” or “USA”), represented by Fredrikson & Byron, P.A., USA. Respondent is Contact Privacy Inc. Customer 7151571251, Canada / Feras Bashiti, Jordan FreeDOM, USA. 2. The Domain Name and Registrar The disputed domain name <cobaltstrike.net> is registered with Google LLC (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on August 10, 2022. On August 15, 2022, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On August 15, 2022, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name, which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to Complainant on August 16, 2022, providing the registrant and contact information disclosed by the Registrar, and inviting Complainant to submit an amendment to the Complaint. Complainant filed an amendment to the Complaint on August 18, 2022. The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on August 22, 2022. In accordance with the Rules, paragraph 5, the due date for Response was September 11, 2022. Respondent submitted an informal email communication on August 18, 2022, but did not submit any formal response. Accordingly, the Center notified the Parties that it would proceed with panel appointment on September 12, 2022. page 2 The Center appointed Georges Nahitchevansky as the sole panelist in this matter on September 15, 2022. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background Complainant, Help/Systems, LLC, is a provider of security assessment software that is used for adversary simulations and “Red Teaming” operations of computer networks. Complainant uses the name and mark COBALT STRIKE for its software and owns a trademark registration in the United States for the COBALT STRIKE mark (Registration No. 4,272,000) which issued to registration on January 8, 2013, and was acquired from Complainant’s predecessor in interest on or about May 11. 2021. Complainant also owns and uses the domain name <cobaltstrike.com> for a website providing information regarding Complainant’s COBALT STRIKE software. Respondent appears to be based in the United States in the State of New York. Respondent registered the disputed domain name on November 24, 2020. At some point after the disputed domain name was registered, a website appeared at the disputed domain name with the title “Cybersecurity News” and offering various articles on cybersecurity related topics in English and Russian. On or about July 29, 2022, Complainant apparently sent a demand letter to Respondent. Thereafter, the Parties had limited communications and Respondent, or someone acting on behalf of Respondent, asserted that the disputed domain name is owned by an entity called “Cobalt Strike LLC” allegedly formed in 2018 in the country of Georgia and asked whether Complainant had the “potential to buy the company name or domain.” No further communications followed and the disputed domain name currently continues to resolve to a website featuring articles on various cybersecurity topics. 5. Parties’ Contentions A. Complainant Complainant maintains that it owns rights in the COBALT STRIKE mark by virtue of its United States trademark registration for that mark. Complainant also claims unspecified common law rights in the COBALT STRIKE mark. Complainant contends that the disputed domain name is identical or confusingly similar to the COBALT STRIKE mark as it wholly encompasses the COBALT STRIKE mark. Complainant asserts that Respondent has no rights or legitimate interests in the disputed domain name as Respondent (i) has not used the disputed domain name for a bona fide offering of goods and services or to make a legitimate noncommercial or fair use, and (ii) is not commonly known by the disputed domain name. Lastly, Complainant argues that Respondent has registered and used the disputed domain name in bad faith as Respondent has copied and used Complainant’s COBALT STRIKE mark to attract Internet users to Respondent’s website and has offered to sell the disputed domain name to Complainant. B. Respondent Respondent did not submit a formal response. However, on August 18, 2022, Respondent submitted an informal communication via email to the Center in which Respondent contended that “we already registered company in Georgia” that Respondent maintained is called Cobaltstrike LLC. page 3 6. Discussion and Findings Under paragraph 4(a) of the Policy, to succeed Complainant must satisfy the Panel that: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which Complainant has rights; (ii) Respondent has no rights or legitimate interests in respect of the disputed domain name; and (iii) the disputed domain name has been registered and is being used in bad faith. A. Identical or Confusingly Similar Ownership of a trademark registration is generally sufficient evidence that a complainant has the requisite rights in a mark for purposes of paragraph 4(a)(i) of the Policy. See section 1.2.1 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0 ”). Complainant has provided evidence that it owns a trademark registration for the COBALT STRIKE mark. Complainant has also claimed that it owns common law rights in COBALT STRIKE, but provided no evidence to support that contention or when such rights arose. In any event, as the first element is essentially a standing requirement, Complainant’s trademark registration for COBALT STRIKE satisfies this requirement. With Complainant’s rights in the COBALT STRIKE mark established, the remaining question under the first element of the Policy is whether the disputed domain name (typically disregarding the generic Top-Level Domain such as “.net”) is identical or confusingly similar with Complainant’s mark. See B & H Foto & Electronics Corp. v. Domains by Proxy, Inc. / Joseph Gross, WIPO Case No. D2010-0842 . Here, the Panel finds that the disputed domain name is identical to Complainant’s COBALT STRIKE mark as it solely consists of the COBALT STRIKE mark. The Panel therefore finds that Complainant has satisfied the requirements of paragraph 4(a)(i) of the Policy. B. Rights or Legitimate Interests Under paragraph 4(a)(ii) of the Policy, the complainant must make at least a prima facie showing that the respondent possesses no rights or legitimate interests in a disputed domain name. Malayan Banking Berhad v. Beauty, Success & Truth International, WIPO Case No. D2008-1393 . Once the complainant makes such a prima facie showing, the burden of production shifts to the respondent, though the burden of proof always remains on the complainant. If the respondent fails to come forward with evidence showing rights or legitimate interests, the complainant will have sustained its burden under the second element of the UDRP. Here, the evidence before the Panel, which is quite limited and could be characterized as minimal, shows that Respondent has used the disputed domain name with a website providing various articles concerning topics related to cybersecurity, the very field that Complainant’s COBALT STRIKE software is marketed in. While Respondent claims to have a registered company in Georgia in 2018, Respondent merely made the unsubstantiated assertion and provided no evidence to support the claim, making it suspect at best. Given that (i) the disputed domain name solely consists of the COBALT STRIKE name and mark, (ii) the website at the disputed domain name has featured the COBALT STRIKE mark in a version reminiscent to Complainant’s display of its COBALT STRIKE mark on Complainant’s website, and (iii) Respondent has used graphical elements that have appeared on Complainant’s website, it appears more likely than not that Respondent is seeking to pass off its website as connected to or affiliated in some way with Complainant and/or that consumers will likely see the disputed domain name and associated website as implicitly connected to Complainant. Such use of the disputed domain name does not amount to a bone fide use or provide Respondent with a legitimate interest in the disputed domain name. See WIPO Overview 3.0 at sections 2.5.1 through 2.5.3. page 4 Given that Complainant has established with sufficient evidence that it owns rights in the COBALT STRIKE mark, and given Respondent’s above noted actions and failure to substantively appear in this matter, the Panel concludes that Respondent does not have a right or legitimate interest in the disputed domain name and that none of the circumstances of paragraph 4(c) of the Policy are evident in this case. C. Registered and Used in Bad Faith In this matter, Respondent has registered and used the disputed domain name with a website promoting various articles and postings concerning cybersecurity, hacking, and ransomware, some of which relate directly to Complainant’s COBALT STRIKE software. Given that the disputed domain name fully and solely consists of the COBALT STRIKE name and mark, and given Respondent’s display on its website of the COBALT STRIKE mark in the nearly identical form shown on Complainant’s website along with graphic elements that are similar to those appearing on Complainant’s website, web users seeing the disputed domain name and associated website are likely to mistakenly believe that such are connected to or authorized by Complainant, particularly as the articles on Respondent’s website relate specifically to the very field Complainant operates in. In view of Respondent’s actions and failure to meaningfully participate in this proceeding to explain or justify his actions with actual evidence, it appears from what is before the Panel, although minimal, that Respondent was likely aware of Complainant and its COBALT STRIKE software and registered and used the disputed domain name that is based on the COBALT STRIKE mark for Respondent’s benefit. That some of the articles and postings are unrelated to Complainant does not alter this conclusion, as Respondent has opportunistically registered and used the disputed domain name, which is likely to be seen as connected to Complainant, to intentionally and misleadingly bring Internet users to Respondent’s website for Respondent’s own profit. See WIPO Overview 3.0 at section 3.1.4 (and cases cited therein). Moreover, the Panel notes that Respondent, or someone acting on behalf of Respondent, sent an email communication responding to Complainant’s demand letter asking whether Complainant wanted to “buy the company name or domain.” It thus appears that Respondent likely registered the disputed domain name for Respondent’s profit, further supporting the notion that Respondent has registered and used the disputed domain name in bad faith. Accordingly, the Panel finds that Complainant succeeds under this element of the Policy. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <cobaltstrike.net> be transferred to Complainant. /Georges Nahitchevansky/ Georges Nahitchevansky Sole Panelist Date: September 29, 2022

Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.