Nordlayer.org

The timeline behind nordlayer.org

Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.

Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.

ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION NordSec B.V. v. Ronin Daniel Case No. D2026-1218 1. The Parties The Complainant is NordSec B.V., Netherlands (Kingdom of the), represented by Jurgita Baltramiejūnienė, United States of America (“United States”). The Respondent is Ronin Daniel, Israel. 2. The Domain Name and Registrar The disputed domain name <nordlayer.org> is registered with IONOS SE (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on March 20, 2026. On March 20, 2026, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On April 2, 2026, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent ([Unknown]) and contact information in the Complaint. The Center sent an email communication to the Complainant on April 8, 2026, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on April 9, 2026. The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on April 10, 2026. In accordance with the Rules, paragraph 5, the due date for Response was April 30, 2026. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on May 1, 2026. page 2 The Center appointed Ganna Prokhorova as the sole panelist in this matter on May 11, 2026. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background The Complainant is a Dutch company providing a business-focused network security platform marketed under the “NordLayer” name. Developed by the team behind NordVPN, the Complainant’s solution enables organizations of all sizes to ensure secure connectivity, protect data, and mitigate cyber threats without compromising performance or productivity. The Complainant is the owner of multiple trademark registrations incorporating the mark NORDLAYER, in classes 9, 38, 42, and 45, including, inter alia: - Israel trademark NORDLAYER (word), No. 349927, registered on October 9, 2023; - International trademark NORDLAYER (word), No. 1649131, registered on September 29, 2021; - German trademark NORDLAYER (word), No. 302021011237, registered on October 29, 2021. The Complainant has also operated the domain name <nordlayer.com> since 2021. The disputed domain name was registered on December 27, 2025. At the time of filing of the Complaint, the disputed domain name resolved to a website presenting itself as an official download page for the VPN services under the name “NordLayer”, including references to “NordLayer VPN” and “Secure Network Access”. The website invited users to download software for various operating systems and prompted them to enter sensitive information, including an organization ID, email address, and password. As of the date of this Decision, the disputed domain name no longer resolves to an active website. 5. Parties’ Contentions A. Complainant The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain name. Notably, the Complainant contends that: (1) The disputed domain name is identical to the Complainant’s trademark, since it incorporates the NORDLAYER mark in its entirety, and the addition of the “.org” extension does not prevent confusion. (2) The Respondent has no rights or legitimate interests in respect of the disputed domain name. The Respondent is not affiliated with the Complainant, has no license or authorization to use the NORDLAYER mark, and is not commonly known by “Nordlayer”. The disputed domain name resolved to a webpage where visitors were asked to provide their NordLayer login credentials by filling out the presented form, which is not a bona fide offering of goods or services. Impersonating the Complainant and its authorized service negates any claim of legitimate interest. (3) The disputed domain name was registered and is being used in bad faith. The disputed domain name was registered on December 27, 2025. Registering the disputed domain name so obviously connected to a well-known mark without authorization is itself evidence of bad faith. The Respondent used the disputed domain name to resolve to a webpage where visitors were asked to fill in their login credentials. page 3 The design and content of the website to which the disputed domain name resolved reproduced the Complainant’s official website, thereby creating the false impression that users were accessing a genuine NordLayer platform. The misleading nature of this website is further evidenced by a report from one of the Complainant’s customers, who was deceived by the imitation and confirmed that the page was fraudulently harvesting login information. After the Respondent’s use of the disputed domain name has been reported to the registrar, the page became inactive. Passive holding of the disputed domain name does not prevent a finding of bad faith. B. Respondent The Respondent did not reply to the Complainant’s contentions. 6. Discussion and Findings Paragraph 15(a) of the Rules provides that the Panel is to decide the Complaint on the basis of the statements and documents submitted in accordance with the Policy, the Rules, and any rules and principles of law that it deems applicable. The onus is on the Complainant to make out its case and it is apparent, both from the terms of the Policy and the decisions of past UDRP panels, that the Complainant must show that all three elements set out in paragraph 4(a) of the Policy have been established before any order can be made to transfer the Disputed Domain Name. In UDRP cases, the standard of proof is the balance of probabilities. To succeed in a UDRP complaint, the Complainant has to demonstrate that all the elements listed in paragraph 4(a) of the Policy have been satisfied, namely: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; (ii) the Respondent has no rights or legitimate interests in respect of the disputed domain name; and (iii) the disputed domain name has been registered and is being used in bad faith. The Respondent was given proper notice of the Complaint and had the opportunity to respond. Under paragraph 5(a) of the Rules, the Respondent was required to submit its response within 20 days of commencement of the proceeding. The Respondent failed to do so. Pursuant to paragraph 5(f) of the Rules, in the event of such a default, the Panel shall proceed to a decision based on the Complaint. However, the Respondent’s default does not mean that the Complainant automatically prevails; the Complainant continues to bear the burden of proof on each element. The Panel may draw appropriate inferences from the Respondent’s silence, and, where appropriate, accept as true the reasonable allegations in the Complaint that are not contradicted by evidence. The Panel has reviewed the entire case file and the evidence provided. The Panel is also guided, where pertinent, by the WIPO Overview of WIPO Panel Views on Select UDRP Questions (“WIPO Overview 3.1”), which reflects consensus positions of UDRP panels on many common issues. The Panel will make reference to these consensus views in the analysis below as applicable. A. Identical or Confusingly Similar It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s mark and the disputed domain name. WIPO Overview 3.1, section 1.7. page 4 Based on the evidence submitted by the Complainant, the Panel finds that the Complainant has shown rights in respect of its NORDLAYER mark for the purposes of the Policy. WIPO Overview 3.1, section 1.2.1. The Panel finds that the Complainant’s mark is recognizable within the disputed domain name. The disputed domain name incorporates the Complainant’s NORDLAYER mark in its entirety, without any additional elements or alterations. The Panel further notes that the generic Top-Level Domain (“gTLD”) “.org” is required only for technical reasons and is generally ignored for the purposes of comparison of the Complainant’s mark to the disputed domain name. WIPO Overview 3.1, section 1.11.1. Accordingly, the Panel concludes that the disputed domain name is identical to the Complainant’s mark and that the first element of paragraph 4(a) of the Policy is satisfied. B. Rights or Legitimate Interests Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name. Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.1, section 2.1. Having reviewed the record, the Panel finds that the Complainant has made a prima facie showing that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent has not filed a Response and therefore has not rebutted the Complainant’s case or provided any evidence demonstrating rights or legitimate interests under the Policy or otherwise. The evidence shows that the Respondent is not making any bona fide offering of goods or services through the disputed domain name, but instead is using it to host a website that impersonates the Complainant’s official platform and solicits sensitive user credentials. Such use demonstrates that the Respondent lacks any rights or legitimate interests in the disputed domain name and is exploiting it for deceptive and fraudulent purposes rather than any legitimate business activity. The Complainant has established rights in the NORDLAYER trademark and confirms that it has no business or other relationship with the Respondent. The Complainant has not authorized, licensed, or otherwise permitted the Respondent to use its mark. Furthermore, there is nothing in the record to suggest that the Respondent is commonly known by the disputed domain name or any corresponding name. Because the Respondent has chosen not to participate in these proceedings, it has failed to rebut the Complainant’s prima facie showing. In view of the above, the Panel concludes that the Respondent has no rights or legitimate interests in the disputed domain name. Accordingly, the Complainant has satisfied the requirement of paragraph 4(a)(ii) of the Policy. page 5 C. Registered and Used in Bad Faith The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith. In the present case, the Panel finds that the Respondent both registered and is using the disputed domain name in bad faith under paragraph 4(b) of the Policy. The Complainant is a Dutch cybersecurity company that provides business-oriented network security solutions under the Nordlayer name and owns numerous trademark registrations for NORDLAYER in various jurisdictions. The Complainant offers its services to organizations worldwide, enabling secure network access, data protection, and threat mitigation through its integrated platform. Given the Complainant’s reputation internationally and the distinctive nature of its NORDLAYER mark, the Panel finds it implausible that the Respondent was unaware of the Complainant’s rights. The registration itself, mirroring the Complainant’s trademark in full, demonstrates clear targeting. The disputed domain name incorporates the NORDLAYER in its entirety, merely adding the gTLD “.org” and creates an identical variation. Under WIPO Overview 3.1, section 3.2.1, this composition strongly suggests deliberate targeting. The disputed domain name previously resolved to a fraudulent website impersonating the Complainant, reproducing the Complainant’s NORDLAYER mark, visual identity, and content, and prompting users to download software and enter sensitive user credentials. This conduct falls squarely within paragraph 4(b)(iv) of the Policy, as the Respondent intentionally attempted to attract Internet users by creating a likelihood of confusion with the Complainant’s mark for deceptive purposes. The evidence shows that at least one customer was misled by the website and reported that it imitated the Complainant’s official platform and harvested credentials. Although the website has since been deactivated following a report to the Registrar, this does not negate a finding of bad faith. On the contrary, the deliberate imitation of the Complainant’s website confirms that the Respondent had no bona fide use in mind, but instead sought to exploit the Complainant’s reputation, disrupt its business, and undermine user trust. The Respondent has not provided any explanation for selecting the disputed domain name, is not commonly known by it, and has not been authorized, licensed, or otherwise permitted by the Complainant to use its mark. The absence of any Response further strengthens the inference of bad faith. See WIPO Overview 3.1, section 4.3. Considering the totality of the circumstances, including the Complainant’s established trademark rights, the Respondent’s reproduction of the Complainant’s website design and content, the use of the disputed domain name to solicit sensitive login credentials, the evidence of actual consumer deception, and the clear absence of any rights or legitimate interests, the Panel concludes that the disputed domain name was registered and is being used in bad faith under paragraph 4(a)(iii) of the Policy. Accordingly, the third element of paragraph 4(a) of the Policy has been established. page 6 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <nordlayer.org> be transferred to the Complainant. /Ganna Prokhorova/ Ganna Prokhorova Sole Panelist Date: May 14, 2026

Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.