Bitcoinusamining.com + 16 more domains

The timeline behind bitcoinusamining.com

Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.

How each disputed name was decided in this proceeding.

Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.

ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Utility Services Advisory Group, Inc. v. Syed Abidi Case No. D2026-0126 1. The Parties The Complainant is Utility Services Advisory Group, Inc., United States of America (“United States”), internally represented. The Respondent is Syed Abidi, Pakistan. 2. The Domain Names and Registrar The disputed domain names <bitcoinusamining.com>, <btcusamining.com>, <cleanusaenergy.com>, <cusaenergy.com>, <getmycompanyinsurance.com>, <getmycompanyrefund.com>, <usabitcoinstrategies.com>, <usabitcoinstrategy.com>, <usaceaas.com>, <usaenergy.com>, <usagenergy.com>, <usagroupenergy.com>, <usagroupenterprises.com>, <usagroupev.com>, <usagroupinsurance.com>, <usagroupsolar.com>, and <usagrouptelehealth.com> are registered with Gname.com Pte. Ltd. (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on January 15, 2026. On January 20, 2026, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain names. On January 21, 2026, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain names which differed from the named Respondent (“Unknown individual(s) using the alias ‘The Professor’”) and contact information in the Complaint. The Center sent an email communication to the Complainant on January 21, 2026, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on January 21, 2026, and an amendment to the Complaint on January 23, 2026. The Center verified that the Complaint together with the amended Complaint and amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). page 2 In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on February 2, 2026. In accordance with the Rules, paragraph 5, the due date for Response was February 22, 2026. The Response was filed with the Center on February 3, 2026. The Respondent sent the email communications to the Center on January 21, 2026, January 30, 2026, and February 3, 2026. A third party sent email communications to the Center on January 21, 2026, January 27, 2026, and January 30, 2026. The Center appointed Andrew D. S. Lothian as the sole panelist in this matter on February 17, 2026. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. On February 18, 2026, the Complainant filed a supplemental filing. On February 26, 2026, the Panel issued Procedural Order No. 1 to the Parties. This requested the Complainant, in light of the large volume of disputed domain names and potential number of claimed unregistered trademarks, to reformulate its submissions and evidence into a table setting out each unregistered trademark claimed, together with an individual documentary annex for each such mark evidencing the manner in which the Complainant had used such mark in commerce, and noting that the Complainant should refer to WIPO Overview of WIPO Panel Views on Select UDRP Questions (“WIPO Overview 3.1”), section 1.3, and should supplement its documentary evidence for each claimed unregistered mark in accordance with that section. The Complainant was invited to provide such table and annexes by March 8, 2026. The Respondent was invited to comment on any such submission by the Complainant, and on the Complainant’s supplemental filing of February 18, 2026, which the Panel had decided to admit, by March 18, 2026. The Respondent was requested, by March 18, 2026, to provide evidence of how it acquired the disputed domain names, and from whom, including communications between the alleged seller of the disputed domain names, the Respondent and the Registrar, together with evidence of the sale price and the manner of transfer, and evidence of the due diligence, if any, that it undertook into either the alleged seller or the past use of the disputed domain names themselves before acquiring them. On March 8, 2026, the Complainant duly filed a submission in response to Procedural Order No. 1. This included the requested table together with copies of the documentary annexes numbered 4, 5, 6, 7, and 8 that the Complainant had already filed with the Complaint, albeit edited to highlight the portions referenced in the table. The Complainant also filed a supplemental annex with additional highlighted information. On March 9, 2026, the Respondent duly filed a submission in response to Procedural Order No. 1. This included the transfer documentation for the disputed domain names set out in the factual background section below. 4. Factual Background According to the Complaint, the Complainant is a Florida, United States, corporation, filed on March 29, 2016, effective April 24, 2013. The Complainant demonstrates that it maintains multiple registrations of fictitious business names and similar authorities to do business in multiple states of the United States. The Complainant’s primary brand is “USA Group” or “USA Group Energy”. The Complainant is in the energy business, providing energy consulting services related to the supply of electricity and natural gas to commercial and residential customers, and is a licensed energy broker. The disputed domain names were formerly registered by or on behalf of the Complainant. The Complainant’s evidence indicates that, on or about October 23, 2025, its account with its domain name registrar (GoDaddy.com, LLC) was compromised, whereby a party or parties unknown seized control and transferred the disputed domain names to the Registrar. The Complainant produces example historic RDAP and DNS records in respect of the disputed domain names <usaenergy.com>, <usagenergy.com>, and <usagroupenergy.com> showing said transfer occurring between October 23, 2025, and about October 27, page 3 2025, redelegation of the said domain names to new nameservers, Mail Exchange (“MX”) records being substituted, and a registrant name being entered of “Redacted for Privacy” with a country of “Pakistan”. Over this period, entries were added to the DNS records for the corresponding disputed domain names indicating an attempt to take over the Complainant’s Google Workspace account. The Complainant further shows by way of a transcript of a recorded telephone call, voicemail, and text messages that it received ransom demands from and after October 23, 2025, from a person claiming to be part of a ransomware group which was holding the Complainant’s database and the disputed domain names. This person demanded payments at various different levels in return for concessions including the return of the disputed domain names. The Complainant reported these communications to the United States Federal Bureau of Investigation on October 24, 2025. On December 3, 2025, the Complainant’s registrar informed the Complainant that it was contacting the gaining Registrar in respect of the disputed domain names and was providing its investigation findings. On December 15, 2025, the Complainant’s said registrar advised that it was unable to recover the disputed domain names and suggested that the matter would appropriately be addressed through the Policy, as the issue centered on a dispute with the registrant. The contacts with the alleged ransomware group continued by email and text messages through November 2025. The final communications received by the Complainant from the alleged ransomware group occurred on January 13, 2026, being two days before the date of filing of the Complaint. According to lookups dated February 2, 2026, the disputed domain names were registered and (then) last updated as follows: 1. <bitcoinusamining.com> registered on June 25, 2025, and last updated on October 31, 2025; 2. <btcusamining.com> registered on June 25, 2025, and last updated on October 31, 2025; 3. <cleanusaenergy.com> registered on April 17, 2025, and last updated on October 23, 2025; 4. <cusaenergy.com> registered on April 17, 2025, and last updated on October 31, 2025; 5. <getmycompanyinsurance.com> registered on March 8, 2024, and last updated on October 31, 2025; 6. <getmycompanyrefund.com> registered on June 7, 2023, and last updated on October 31, 2025; 7. <usabitcoinstrategies.com> registered on July 9, 2025, and last updated on October 31, 2025; 8. <usabitcoinstrategy.com> registered on July 9, 2025, and last updated on October 31, 2025; 9. <usaceaas.com> registered on April 18, 2025, and last updated on October 31, 2025; 10. <usaenergy.com> registered on October 14, 2001, and last updated on October 23, 2025; 11. <usagenergy.com> registered on November 14, 2013, and last updated on October 23, 2025; 12. <usagroupenergy.com> registered on August 8, 2013, and last updated on October 23, 2025; 13. <usagroupenterprises.com> registered on August 5, 2024, and last updated on October 31, 2025; 14. <usagroupev.com> registered on August 10, 2024, and last updated on October 31, 2025; 15. <usagroupinsurance.com> registered on May 6, 2024, and last updated on October 31, 2025; page 4 16. <usagroupsolar.com> registered on August 10, 2024, and last updated on October 31, 2025; and 17. <usagrouptelehealth.com> registered on August 10, 2024, and last updated on October 31, 2025. The Complainant claims unregistered trademarks in names allegedly corresponding to the disputed domain names based upon “continuous and widespread use in commerce”. The marks which it claims are: UTILITY SERVICES ADVISORY GROUP, first used in 2013; USA GROUP ENERGY, first used in 2013; USA ENERGY, first used in 2013; USA GROUP, first used in 2013; USA GROUP ENTERPRISES, first used in August 2024; GET MY COMPANY REFUND, first used in October 2023; CLEAN USA ENERGY, first used in 2024; GET MY COMPANY INSURANCE, first used in April 2024; USA GROUP INSURANCE, first used in May 2024; and USA BITCOIN STRATEGIES, first used in July, 2025. The Complainant’s evidence to support these claims to unregistered trademarks consists of corporation registration records including fictitious names, supplier contracts showing involvement in electricity and gas utilities, business and utility licenses (including those from state utility agencies), and marketing and promotional materials. In terms of websites associated with the disputed domain names, all of these have no associated websites with the exception of <getmycompanyrefund.com> which contains advertising relating to professional accounting services and which notes that it is “parked free, courtesy of Godaddy.com” (the previous registrar for the disputed domain names). The Respondent describes itself as “a multinational technology and domain-investment company holding a substantial portfolio of domain names acquired over time through secondary-market transactions”. The Respondent produced the following transfer documentation and notifications from the Complainant’s former registrar, GoDaddy in respect of the disputed domain names: 1. <bitcoinusamining.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 2. <btcusamining.com> composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 3. <cleanusaenergy.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 23, 2025, at 20:36, (2) notification from GoDaddy to “mike” to remove domain protection product to complete transfer dated October 23, 2025, at 18:45, and (3) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. page 5 4. <cusaenergy.com> composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 5. <getmycompanyinsurance.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 6. <getmycompanyrefund.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:51, (2) authorization code from GoDaddy to “mike” issued on October 31, 2025 at 07:49. 7. <usabitcoinstrategies.com> composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 8. <usabitcoinstrategy.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 9. <usaceaas.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 10. <usaenergy.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 23, 2025, at 19:59, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 11. <usagenergy.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 23, 2025, at 20:07, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 12. <usagroupenergy.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 23, 2025, at 19:35, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 13. <usagroupenterprises.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:08, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 14. <usagroupev.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 15. <usagroupinsurance.com> composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 16. <usagroupsolar.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. 17. <usagrouptelehealth.com> (1) completion of domain transfer notification from GoDaddy to “Mike Campbell” dated October 31, 2025, at 07:57, (2) composite domain status notification from GoDaddy to “mike” confirming request to unlock domain name dated October 23, 2025, at 14:35. page 6 5. Parties’ Contentions A. Complainant The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain names. Notably, the Complainant contends that it has operated under several names that correspond to the disputed domain names for more than a decade and has invested substantial resources into building brand recognition in the energy sector in the United States. The Complainant adds that the names have been used extensively in contracts, marketing materials, corporate filings, and communications with thousands of clients and vendors, and that it has developed ancillary and spin-off business lines using distinct but related brand identities. The Complainant produces supporting evidence of its corporation and fictitious business name registrations, energy supplier contracts, utility and business licenses, evidence relating to spin-off brands, and marketing and promotional materials in support of its said contentions. The Complainant asserts that the Respondent is not known by any of the names incorporated in the domain names, has no affiliation with the Complainant, and has not been authorized, licensed, or permitted to use any of the Complainant’s names, marks, or domain names in any manner, noting that the disputed domain names were unlawfully transferred from the Complainant’s registrar account, and describing the attempts made to extort ransom payments from it. The Complainant asserts that the Respondent’s only use of the disputed domain names has been “to hold them hostage”. The Complainant contends that the hijacking of the disputed domain names and demands for payment in respect of their return constitutes bad faith conduct on the Respondent’s part. The Complainant notes that the Respondent provided no legitimate explanation for holding the disputed domain names, and claims that some of them were listed for sale after having been transferred. The Complainant asserts that the Respondent gained unauthorized access to the Complainant’s cryptocurrency wallets and withdrew company and personal funds, using this to extort additional payments. The Complainant concludes that the Respondent’s actions align with paragraph 4(b)(i) and paragraph 4(b)(iv) of the Policy, constituting registration and use in bad faith. B. Respondent The Respondent contends that the Complainant has not satisfied the elements required under the Policy for a transfer of the disputed domain names and requests that the Panel deny the Complaint and issue a finding of Reverse Domain Name Hijacking. In an informal email dated January 30, 2026, the Respondent asserts that the disputed domain names were acquired by it from an individual based in the United States “who contacted us offering the domains for sale”. The Respondent adds that the communications were conducted by WhatsApp chat, that the individual represented himself as “Mike” and stated that he was no longer interested in retaining the disputed domain names, adding that following agreement on terms, payment was remitted by USDT (the Panel presumes that this refers to a USD pegged stablecoin cryptocurrency also known as United States Dollar Tether), after which the Respondent was provided with valid authorization codes. The Respondent adds that it has provided full cooperation with the Registrar including supporting documentation confirming its lawful acquisition of the disputed domain names. The Respondent asserts that at the time of acquisition, it had no notice of any dispute, restriction or adverse claim relating to the disputed domain names. In its formal Response, the Respondent states that it first became aware of any alleged dispute over the disputed domain names months after their acquisition, upon receipt of the Complaint. The Respondent asserts that it has no affiliation, relationship or coordination with the person said to have demanded ransoms from the Complainant, asserting that any alleged hacking, ransom demands, or criminal activity described in the annexes occurred prior to the Respondent’s acquisition of the disputed domain names and outside the page 7 Respondent’s knowledge or control. The Respondent asserts that bad faith is not automatically imputed to a subsequent good faith registrant under the Policy. The Respondent states that after notification of the Complaint, the Respondent cooperated fully with the Registrar, provided identity verification and submitted documentation confirming its lawful acquisition and registration of the disputed domain names, asserting that the Registrar’s disclosure to the Center reflects this cooperation and verification. With reference to the Complainant’s claim of unregistered trademark rights, the Respondent asserts that descriptive or geographic terms cannot be monopolized, absent compelling evidence of acquired distinctiveness, adding that the Complainant does not demonstrate exclusive trademark rights sufficient to satisfy the Policy across all of the disputed domain names. The Respondent argues that it has rights and legitimate interests in terms of the Policy because the disputed domain names were acquired as part of a bona fide domain name investment business, the terms in the disputed domain names are descriptive or generic and capable of multiple lawful uses, the Respondent did not target the Complainant or its alleged marks, and no impersonation, phishing, or deceptive conduct has occurred. The Respondent adds that holding descriptive domain names for investment or resale is a recognized legitimate interest under longstanding Policy precedent. The Respondent submits that bad faith under the Policy must be established at the time of registration or acquisition, asserting that the Respondent had no knowledge of any alleged dispute or wrongdoing, relied on valid authorization codes and registrar confirmation, and did not register or acquire the disputed domain names to target the Complainant. The Respondent notes that passive holding or offering domain names for sale, without targeting a trademark owner, does not constitute bad faith under the Policy. The Respondent contends that the Policy is not a forum for theft or criminal allegations, asserting that “The UDRP is not designed to adjudicate allegations of theft, hacking, or criminal misconduct” citing the terms of WIPO Overview 3.0, section 4.14 (the Panel notes in passing that section 4.14 does not contain this quotation and does not deal with that topic). The Respondent seeks a finding of Reverse Domain Name Hijacking on the basis that the Complainant was aware that the disputed domain names were acquired through completed secondary market transfers, that the Complaint nevertheless characterizes the Respondent as an alleged wrongdoer without evidence of targeting or bad faith, and that the case consists of an attempt to pursue recovery of domain names in circumstances involving third-party disputes beyond the Policy’s scope. The Respondent concludes that it respects legitimate business interests and remains open to voluntary, mutually agreed resolution discussions outside the Policy framework. C. Complainant’s Supplemental Filing The Complainant contends that it should be allowed to make a supplemental filing to respond to new factual claims raised in the Response, namely assertions that the Respondent made a good faith purchase of the disputed domain names from a United States individual. The Complainant produces the evidence described in the factual background section above showing in respect of three of the disputed domain names that the RDAP and DNS history establishes when control moved to the Registrar, and that the disputed domain names were subsequently configured and used in a manner consistent with bad faith targeting of the Complainant’s digital assets, including email interception and attempts to compromise the Complainant’s Google Workspace. The Complainant notes that the Respondent provides no transaction documentation sufficient to evaluate its claim of an alleged good faith purchase from a United States seller, adding that the asserted narrative conflicts with the record showing immediate ransom/buy-back positioning and post-transfer control activity. The Complainant asserts that the Respondent provides no WhatsApp transcript or screenshots evidencing page 8 the alleged negotiation, seller identity, or representations, no USDT transaction hash, wallet addresses, or payment proof tied to the alleged acquisition, no identifying information for the alleged United States seller “Mike,” no corroboration that such person existed or controlled the disputed domain names, no proof of transfer provenance beyond the fact that transfers technically occurred (which is not disputed by the Complainant), no explanation why an alleged “good-faith buyer” would entertain “buy-back” discussions in the midst of a theft dispute, rather than providing verifiable acquisition evidence. The Complainant concludes that the Respondent’s alleged good-faith purchase is unsupported by basic documentary evidence. D. Complainant’s Supplemental Filing in response to Procedural Order No. 1 The Complainant provides a table identifying claimed unregistered marks, associated domain names and references to the relevant annexes. The Complainant produces its original annexes number 4, 5, 6, 7, and 8 with portions highlighted to reflect references from the table. The Complainant produces one additional supplemental annex with further information. This consists of a filing confirmation of the Articles of Organization for a Florida Limited Liability Company; an email dated July 10, 2025, using the disputed domain names domain names <usaenergy.com>, <cleanusaenergy.com>; and <usagroupenergy.com> referencing an exclusivity agreement; a further email using two of these domain names dated April 21, 2025; an email dated August 15, 2025, referencing <cleanusaenergy.com> relating to a contractual negotiation and non-disclosure agreement; an application for registration of a fictitious name for USA GROUP INSURANCE dated May 13, 2024; a sales agreement referencing “Get My Company Refund, LLC dba Get My Company Insurance” dated April 16, 2024; a Notice Under Fictitious Name Law, State of Florida, United States dated May 24, 2024 referencing “USA Group Insurance”; and a copy of a logo design containing the capitalized words “USA GROUP INSURANCE”. E. Respondent’s Supplemental Filing in response to Procedural Order No. 1 In answer to Procedural Order No. 1, the Respondent made the following additional submissions: The Complainant relies upon unregistered trademark rights. The referenced terms consist of common or descriptive words such as “USA”, “Energy”, and “Group”, which are widely used in commerce. The Respondent had no knowledge of any alleged trademark rights in such terms and regarded the disputed domain names as suitable for domain name investment purposes. The Respondent’s purpose was to offer the disputed domain names for sale on the open market, but it has been prevented from doing so by the registrar locks following the initiation of the administrative proceeding. The Respondent acquired the disputed domain names through a secondary-market transaction with a third- party seller who approached it offering them for sale. The seller stated that he was located in the United States and identified himself as “Mike.” The seller voluntarily provided identification documents to demonstrate that the transaction was legitimate. These included a government-issued driver’s license and a photograph of the seller holding a passport. The identification provided indicated the name “Mike Campbell,” consistent with the name used by the seller in communications with the Respondent. In order to respect personal data and privacy considerations, the Respondent has not produced these identification documents but is able to provide them if the Panel considers it necessary. The seller demonstrated control of the disputed domain names by providing valid authorization codes required to initiate registrar transfers. The losing registrar accepted the transfers and the disputed domain names were moved into the Respondent’s account with the Registrar. The Respondent relied upon the losing registrar’s transfer mechanism and authorization codes. Communications with the seller occurred through WhatsApp, which is commonly used in the domain name investment industry where transactions often take place quickly between buyers and sellers. The Respondent does not routinely archive all such conversations when a transaction appears ordinary and there is no indication of any dispute. The Respondent did retain screenshots showing authorization codes supplied by the seller and showing completed transfers. page 9 The evidence provided by the Respondent contains all materials that are available and preserved including screenshots from its Google Photos account during the WhatsApp communications with the seller. The records demonstrate that the seller had operational control of the disputed domain names and transfers were completed in a standard manner. The disputed domain names were acquired on or around October 31, 2025, and the present trademark dispute was initiated several months after the transfers had already been completed. The transaction was a private, routine, domain name acquisition. Consideration was paid as part of the transaction but detailed payment records were not retained as the transaction appeared ordinary at the time and no dispute existed. The Respondent manages a portfolio of over 1,200 domain names across multiple registrars, regularly acquires domain names through secondary-market transactions, and participates in the global domain name investment community, including established industry forums. The Respondent relied upon the fact that the seller had operational control of the domain names and provided valid authorization codes, the registrar transfer process was successfully completed, and no warnings, disputes, or locks existed on the domain names at the time of transfer. The successful completion reasonably indicates that the seller has authority to transfer the disputed domain names. The Respondent had no knowledge of any alleged hacking or unauthorized access relating to the disputed domain names when they were acquired, and has no relationship with any alleged threat actor mentioned by the Complainant. Such allegations were only raised after the present dispute was initiated. The Respondent acted in good faith and acquired the disputed domain names as part of legitimate domain name investment activity. The Respondent did not target the Complainant or any of its alleged trademark rights. The Respondent remains open to an amicable resolution should the Complainant believe that the disputed domain names are essential to its business operations and has no desire to escalate the matter unnecessarily. The circumstances of the case may warrant consideration of Reverse Domain Name Hijacking because the Complaint is primarily based on allegations of hacking and criminal activity allegedly carried out by unknown third parties with whom the Respondent has no connection. Proceedings were initiated against the Respondent as a downstream purchaser who relied upon the registrar transfer mechanisms and had no knowledge of any alleged dispute when acquiring the disputed domain names, despite the Complainant’s own materials indicating that the alleged wrongdoing involved another party. 6. Discussion and Findings 6.1. Procedural Issue: Parties’ Supplemental Filings Paragraph 12 of the Rules expressly provides that it is for the panel to request, in its sole discretion, any further statements or documents from the parties it may deem necessary to decide the case. Unsolicited supplemental filings are generally discouraged, unless specifically requested by the panel. WIPO Overview 3.1, section 4.6. Panels have sole discretion, under paragraphs 10 and 12 of the Rules, whether to accept an unsolicited supplemental filing from either party, bearing in mind the need for procedural efficiency, and the obligation to treat each party with equality and ensure that each party has a fair opportunity to present its case. The party submitting a supplemental filing would normally need to show its relevance to the case and explain why it was unable to provide that information in the complaint or response (for example, owing to some exceptional circumstance). As noted in the procedural history section above, the Complainant filed a supplemental filing on February 18, 2026. The Complainant asserted that there were exceptional circumstances for this, notably that there were page 10 new factual claims raised in the Response which it wished to answer. The submission included, broadly speaking, an analysis of DNS changes when the disputed domain names were said to be under the Respondent’s control, and corresponding historic WhoIs records for some of the disputed domain names. The Panel considered that it was appropriate to admit the Complainant’s supplemental filing and likewise to provide the Respondent with an opportunity to answer this, which was given via Procedural Order No. 1. 6.2. Discussion and Findings This administrative proceeding concerns 17 disputed domain names that were formerly registered by, or on behalf of, the Complainant. The Complainant’s registrar account appears to have been compromised on or about October 23, 2025. In the immediate aftermath, changes to nameserver delegations and MX records were made, and the disputed domain names were transferred to the Registrar without the Complainant’s authorization. Ransom demands were made by an unidentified third party to the Complainant following this activity. Following discussions with the gaining Registrar, the Complainant’s registrar later advised that it could not reverse the transfers and that the issue would need to be addressed through the Policy. For its part, the Respondent states that it acquired the disputed domain names through what it believed to be an ordinary secondary-market purchase from an individual identifying himself as “Mike Campbell,” relying on authorization codes and standard registrar transfer procedures. The Respondent denies any involvement in any hacking or ransom activity targeting the Complainant, and asserts that it had no notice of any dispute at the time of acquisition. While the Complainant points out that attempts were made to compromise its Google Workspace account and emails were received with a reply address using one of the disputed domain names after control of all of the disputed domain names had been transferred to the Respondent, this does not of itself lead to a conclusion that the Respondent must have been involved in the alleged fraudulent activity. Notably, the disputed domain names were redelegated to nameservers under the control of the party initiating the fraud, and this may have taken place before they were transferred to the Respondent’s registrar. If, as may be the case, the Respondent did nothing to redelegate the disputed domain names to new nameservers once they were transferred to its Registrar, the redelegations put in place by the fraudster would have continued to operate, and the fraudster would probably have been able to have continued access to the nameservers and their associated DNS records without reference to the Respondent. The text message from GoDaddy to the Complainant timed at “Thursday 5:05 AM”, which the Panel presumes refers to Thursday October 23, 2025, contains a verification code “to update the DNS records” on one of the disputed domain names (<getmycompanyrefund.com>) suggesting that nameserver redelegation was one of the earliest attempted acts of the party initiating the fraud after compromising the Complainant’s GoDaddy account. In fact, that particular disputed domain name is the only one which remains on GoDaddy nameservers, possibly because the fraudster did not obtain the verification code. The other disputed domain names appear to have been redelegated, apparently on the same day that each was transferred to the Respondent, going by the available completions of domain name transfer notifications and the WhoIs “last updated” dates. The Complainant’s detailed research in respect of three of the disputed domain names (<usaenergy.com>, <usagenergy.com> and <usagroupenergy.com>) indicates that nameservers for the disputed domain names were redelegated from those provided by GoDaddy to those provided by Cloudflare, a third party provider of DNS services, and that MX records to redirect email for those particular disputed domain names were inserted into these newly delegated nameservers on October 23, 2025, October 26, 2025, and October 24, 2025 respectively. Indeed, all but the one disputed domain name noted above have been redelegated to Cloudflare nameservers. It therefore appears from the evidence before the Panel that the bulk of the disputed domain names were probably redelegated on their respective dates of transfer to the gaining Registrar. Crucially, the Panel does not know whether such redelegation occurred before the disputed domain names left the losing registrar, or whether they were performed after receipt by the gaining Registrar and came under the Respondent’s control. The latter would more likely indicate the Respondent’s involvement in the fraudulent activities, although the Panel could not exclude the possibility that the original bad actors would have been able to page 11 compromise a Cloudflare account ostensibly under the Respondent’s control. Notably, the Respondent has not redelegated the disputed domain names on any date after the transfers were completed, and it has never redelegated <getmycompanyrefund.com> to new nameservers following the transfer of that disputed domain name to its Registrar. If a third party engaged in the fraudulent activity had redelegated the bulk of the disputed domain names to the Cloudflare nameservers before transfer to the Respondent’s registrar, it could then have continued to make changes to DNS records via its ongoing access to the Cloudflare account even after the disputed domain names had been transferred to the Respondent’s Registrar and ultimately placed under the Respondent’s control. Likewise, that third party would have been able to receive emails addressed to the disputed domain names (assuming the continued existence of MX records pointing where the third party wished). As far as the Panel is concerned (and the Panel stresses here that it is not an IT security expert or forensic computer investigator, nor is it in receipt of any suitable expert evidence from either of the Parties or their respective registrars) this means that the evidence before it, insofar as the Panel is capable of interpreting this, appears to be inconclusive as to the question of the Respondent’s direct involvement in any fraudulent activity regarding the disputed domain names. All of the above, however, is necessarily a preliminary assessment on the Panel’s part, and is based upon a record that is incomplete and notably lacking in expert evidence. Of greater importance is the fact that the Parties have presented sharply divergent explanations for how the disputed domain names came to be held by the Respondent, as the factual background and Parties’ contentions amply illustrate. The Parties’ respective supplemental submissions expand upon these conflicting narratives, underlining the fact that the dispute is rooted primarily in contested allegations surrounding the provenance of the domain name transfers rather than in typical cybersquatting conduct of the type that the Policy is designed to address. These circumstances are broadly similar, although not identical, to those described in Aleksandr Danilchuk v. WhoisGuard Protected, WhoisGuard, Inc. / Vadym Didenko, WIPO Case No. D2020-1981, in which the panel had this to say: “This dispute however concerns the question of who is the rightful owner of the disputed domain name and whether the Respondent has acquired it legitimately or through forgery and theft. The Policy was not designed to decide whether a domain name was taken with or without the Complainant’s knowledge or consent and to deal with allegations of forgery and theft, as there is generally no hearing available and no opportunity to examine witnesses or to conduct cross-examination. Simply put, this is not the appropriate forum to deal with these issues. See in this regard the decisions in Jimmy Alison v. Finland Property Services (Pty) Ltd., WIPO Case No. D2008-1141, and in Andrew Prince v. Registrant [3197190]: Sven Echternach / Moniker Privacy Services (2579748), WIPO Case No. D2010-1661, as well as the summary in section 4.14.6 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition” [The Panel notes in passing that the material part of the section referred to has not changed in the WIPO Overview of WIPO Panel Views on Select UDRP Questions (“WIPO Overview 3.1”)]. The Panel observes that there are also examples in previous cases under the Policy where fraudulent transfer of a domain name has been alleged and the panel has nevertheless considered the case appropriate for determination under the Policy. See, for example, LDW Software, LLC v. Stella Chang, WIPO Case No. D2017-0430 (and the cases cited therein). However, the material difference between those cases and the present (and indeed between those cases and Aleksandr Danilchuk v. WhoisGuard Protected, WhoisGuard, Inc. / Vadym Didenko, supra) is the lack of any substantive counter-narrative from the respondent concerned. The focus of such cases is typically the complainant’s uncontested allegations that a fraudulent transfer has been made, and that the respondent is the person who is responsible for such transfer. Those scenarios may be more suited to determination under the Policy because the absence of a competing factual narrative and contested claim to ownership removes the need for fact-finding beyond that which can properly be accommodated in an administrative proceeding of this nature. page 12 The Panel considers that the Complainant’s evidence does support the notion that a fraud has been perpetrated upon it. However, the critical aspect to this case is not just whether that fraud occurred, but whether this was done with the knowledge and/or involvement of the Respondent, which, as noted above, appears at best to be inconclusive. Where there is a counter-narrative on that question, the Policy is not the appropriate forum, not least, as observed in Aleksandr Danilchuk v. WhoisGuard Protected, WhoisGuard, Inc. / Vadym Didenko, supra, because there is no opportunity to examine witnesses or to conduct cross-examination. Furthermore, there are no opportunities for the Parties to seek protective orders and/or orders for discovery of the kind which would be available to them in court proceedings. As indicated above, panels under the Policy are not forensic computer investigators or IT security specialists. The Panel does sympathize with the Complainant’s predicament (and indeed that of the Respondent if it has transferred value for stolen domain names, albeit that while alleging such transfer of value, it has not provided any evidence of it despite being invited to do so). Although it is not for the Panel to advise the Parties as to what they should do next in light of the present Decision, it could be observed that the Complainant might benefit from exploring its rights and remedies with legal counsel experienced in domain name related litigation in the United States, as it does not appear to have engaged an external professional representative in connection with the Complaint to date. Likewise, the Respondent may also want to consider its position according to national law where it is based. The Complainant may also want to understand, if it can, who was controlling the corresponding Cloudflare account regarding the redelegated nameservers for the bulk of the disputed domain names. For completeness, the Panel notes that, had it determined that the case was suitable for resolution under the Policy, the Complainant would likely not have satisfied the first element with respect to its claimed unregistered trademark rights. The record does not provide adequate evidence of secondary meaning showing that the claimed marks had become “distinctive identifier(s) which consumers associate with the complainant’s goods and/or services”. WIPO Overview 3.1, section 1.3. The materials relied upon, principally corporate registrations and contractual references, are insufficient for that purpose on their own in this case. The marketing materials are principally template communications or logo designs. There is no evidence supporting sales volumes, advertising and marketing spend, numbers of customers, recognition in the media or similar. The Complainant was invited in Procedural Order No. 1 to recast and supplement its evidence in accordance with WIPO Overview 3.1, section 1.3, but did not do so to any substantive extent. This further suggests that the Policy may not have been the most suitable mechanism for addressing the Complainant’s concerns, which would more appropriately be considered in a court of competent jurisdiction. As the case is not suitable for resolution under the Policy, the Complaint fails, and it follows that the Respondent’s claim of Reverse Domain Name Hijacking also falls to be denied. The dismissal of the Complaint does not restrict the Complainant from pursuing the matter in an alternative (court) forum, and the Panel does not address this decision to any such forum that might ultimately be seized of the dispute. 7. Decision For the foregoing reasons, the Complaint is denied. /Andrew D. S. Lothian/ Andrew D. S. Lothian Sole Panelist Date: March 23, 2026

Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.