Cyberark.store

The timeline behind cyberark.store

Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.

Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.

ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION CyberArk Software Ltd. v. Edwin Woods, Edgesource Case No. D2026-0248 1. The Parties The Complainant is CyberArk Software Ltd., Israel, internally represented. The Respondent is Edwin Woods, Edgesource, United States of America (“United States”). 2. The Domain Name and Registrar The disputed domain name <cyberark.store> is registered with NameCheap, Inc. (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on January 21, 2026. On January 22, 2026, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On January 23, 2026, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent (Redacted for Privacy / Privacy service provided by Withheld for Privacy ehf) and contact information in the Complaint. The Center sent an email communication to the Complainant on January 23, 2026, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on January 30, 2026. The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on February 2, 2026. In accordance with the Rules, paragraph 5, the due date for Response was February 22, 2026. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on February 23, 2026. page 2 The Center appointed Rodrigo Azevedo as the sole panelist in this matter on March 3, 2026. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background The Complainant is CyberArk Software Ltd., is an Israeli company that provides cybersecurity products and services to organizations worldwide and operates in more than 110 countries. The Complainant owns numerous trademark registrations for CYBERARK, including, for example: - United States Trademark Registration No. 2557762 for CYBERARK, registered on April 9, 2002; - International Registration No. 1662105 for CYBERARK, registered on March 8, 2022; and - International Registration No. 1259493 for CYBERARK, registered on March 4, 2015. The Complainant also owns and operates several domain names incorporating its CYBERARK trademark, including <cyberark.com>, which was registered on March 6, 1996, and is used as the Complainant’s principal commercial website. The disputed domain name <cyberark.store> was registered on February 14, 2025. The Panel accessed the disputed domain name on March 12, 2026, when it was not linked to any active website. From the evidence provided by the Complainant, the disputed domain name was recently used to send messages to the Complainant’s clientele, trying to impersonate the Complainant. 5. Parties’ Contentions A. Complainant The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain name. Notably, the Complainant contends that: (i) The disputed domain name is identical or confusingly similar to the Complainant’s trademark. The Complainant asserts that it is the owner of numerous trademark registrations for the mark CYBERARK in several jurisdictions worldwide. The disputed domain name <cyberark.store> incorporates the CYBERARK trademark in its entirety. The mere addition of the generic Top-Level Domain (“gTLD”) “.store” does not prevent a finding of confusing similarity under the Policy. The disputed domain name is confusingly similar not only to its registered trademark but also to the domain names owned and operated by the Complainant incorporating the same mark, particularly <cyberark.com>, registered and used by the Complainant long before the registration of the disputed domain name. The immediate and overall impression created by the disputed domain name is that of a connection with the Complainant, its trademark, and its commercial activities. (ii) The Respondent has no rights or legitimate interests in the disputed domain name. The Complainant is the exclusive owner of the CYBERARK trademark and has never assigned, licensed, authorized, or otherwise permitted the Respondent to use the CYBERARK mark or to register any domain name incorporating that mark. The Respondent’s conduct amounts to trademark infringement, trademark dilution, unfair competition, and cybersquatting, given that the disputed domain name reproduces the Complainant’s trademark in its entirety and is used in a manner that falsely suggests an association with the Complainant. page 3 (iii) The disputed domain names were registered and are being used in bad faith. The Complainant’s CYBERARK trademark has become well known internationally as a result of more than two decades of global commercial activity, extensive investments in marketing and advertising, and widespread recognition in the cybersecurity industry. The disputed domain name was registered many years after the Complainant had established its trademark rights and reputation in the CYBERARK mark. The Respondent could not credibly claim to have been unaware of the Complainant’s trademark when registering the disputed domain name. The Respondent intentionally registered the disputed domain name in order to create a false impression of association with the Complainant. In particular, the Respondent used an email address associated with the disputed domain name to impersonate one of the Complainant’s employees and contact a third-party executive, thereby falsely representing itself as acting on behalf of the Complainant. Such conduct demonstrates that the Respondent registered and used the disputed domain name with the intention of misleading third parties and taking unfair advantage of the goodwill associated with the Complainant’s trademark. B. Respondent The Respondent did not reply to the Complainant’s contentions. 6. Discussion and Findings Paragraph 4(a) of the Policy provides that in order to be entitled to a transfer of the disputed domain name, a complainant shall prove the following three elements: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; and (ii) the respondent has no rights or legitimate interests in respect of the disputed domain name; and (iii) the disputed domain name has been registered and is being used in bad faith. A. Identical or Confusingly Similar It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain name. WIPO Overview of WIPO Panel Views on Select UDRP Questions (“WIPO Overview 3.1”), section 1.7. Annex 4 to the Complaint shows registrations of CYBERARK trademark obtained by the Complainant in the United States as early as in 2002. Based on the available record, the Panel finds the Complainant has shown rights in respect of a trademark or service mark for the purposes of the Policy. WIPO Overview 3.1, section 1.2.1. The trademark CYBERARK is wholly encompassed within the disputed domain name, together with the gTLD “.store”. It is well established that the addition of a gTLD, such as “.store”, is typically disregarded when determining whether a domain name is confusingly similar to a complainant’s trademark as such is viewed as a standard registration requirement. WIPO Overview 3.1, section 1.11.1. Accordingly, the disputed domain name is identical to the mark for the purposes of the Policy. WIPO Overview 3.1, section 1.7. The Panel finds the first element of the Policy has been established. page 4 B. Rights or Legitimate Interests Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name. Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.1, section 2.1. Having reviewed the available record, the Panel finds the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent has not rebutted the Complainant’s prima facie showing and has not come forward with any relevant evidence demonstrating rights or legitimate interests in the disputed domain name such as those enumerated in the Policy or otherwise. The Panel finds no indication that the Respondent is commonly known by the disputed domain name and the Complainant has asserted that the Respondent is not an authorized representative, nor has it obtained any permission for such use of the CYBERARK trademark. Therefore, the Panel finds that the nature of the disputed domain name carries a risk of implied affiliation. WIPO Overview 3.1, section 2.5.1. Although the website at the disputed domain name does not resolve to any active website, the Complainant brought evidence that it has been used to send email messages trying to impersonate an employee of the Complainant. Panels have held that the use of a domain name for illegal activity (here, claimed impersonation/passing off) can never confer rights or legitimate interests on a respondent. WIPO Overview 3.1, section 2.13.1. Based on the available record, the Panel finds the second element of the Policy has been established. C. Registered and Used in Bad Faith The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith. Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith, but other circumstances may be relevant in assessing whether a respondent’s registration and use of a domain name is in bad faith. WIPO Overview 3.1, section 3.2.1. The second level of the disputed domain name is basically comprised by the Complainant’s trademark CYBERARK. The adoption of the gTLD extension “.store” may even enhance the perception that the disputed domain name is related to Complainant’s, suggesting that it links to an official webstore or to a store operated by an authorized online representative. Furthermore, when the disputed domain name was registered (in 2025) the CYBERARK trademark was already connected with the Complainant’s business, especially in the United States. Therefore, the Panel concludes that it is not feasible that the Respondent was unaware of the Complainant’s trademark nor that the registration of the disputed domain name was a mere coincidence. page 5 Actually, the use of the disputed domain name to send false email messages impersonating the Complainant demonstrates that the Respondent targeted the Complainant when registering the disputed domain name. Therefore, the Panel concludes that the Respondent has intentionally attempted to attract, through the registration and use of the disputed domain name, the Complainant’s customers, for commercial gain, by creating a likelihood of confusion with the Complainant’s mark as to the source, sponsorship, affiliation, or endorsement of the website. Therefore, having reviewed the record, the Panel finds the registration and use of the disputed domain name constitutes bad faith under the Policy. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <cyberark.store> be transferred to the Complainant. /Rodrigo Azevedo/ Rodrigo Azevedo Sole Panelist Date: March 17, 2026

Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.