DECISION

 

Morgan, Lewis & Bockius LLP v. Host Master / Njalla Okta LLC

Claim Number: FA2602002204854

 

PARTIES

Complainant is Morgan, Lewis & Bockius LLP ("Complainant"), represented by Griffin Barnett of Morgan, Lewis & Bockius LLP, District of Columbia, USA. Respondent is Host Master / Njalla Okta LLC ("Respondent"), Saint Kitts and Nevis.

 

REGISTRAR AND DISPUTED DOMAIN NAME

The domain name at issue is <morganlewisinternal.com>, registered with Tucows Domains Inc.

 

PANEL

The undersigned certifies that he has acted independently and impartially and to the best of his knowledge has no known conflict in serving as Panelist in this proceeding.

 

Ho-Hyun Nahm, Esq. as Panelist.

 

PROCEDURAL HISTORY

Complainant submitted a Complaint to Forum electronically on February 11, 2026; Forum received payment on February 11, 2026.

 

On February 11, 2026, Tucows Domains Inc. confirmed by e-mail to Forum that the <morganlewisinternal.com> domain name is registered with Tucows Domains Inc. and that Respondent is the current registrant of the names. Tucows Domains Inc. has verified that Respondent is bound by the Tucows Domains Inc. registration agreement and has thereby agreed to resolve domain disputes brought by third parties in accordance with ICANN's Uniform Domain Name Dispute Resolution Policy (the "Policy").

 

On February 12, 2026, Forum served the Complaint and all Annexes, including a Written Notice of the Complaint, setting a deadline of March 4, 2026 by which Respondent could file a Response to the Complaint, via e-mail to all entities and persons listed on Respondent's registration as technical, administrative, and billing contacts, and to postmaster@morganlewisinternal.com. Also on February 12, 2026, the Written Notice of the Complaint, notifying Respondent of the e-mail addresses served and the deadline for a Response, was transmitted to Respondent via post and fax, to all entities and persons listed on Respondent's registration as technical, administrative and billing contacts.

 

Having received no response from Respondent, Forum transmitted to the parties a Notification of Respondent Default.

 

On March 5, 2026, pursuant to Complainant's request to have the dispute decided by a single-member Panel, Forum appointed Ho-Hyun Nahm, Esq. as Panelist.

 

On March 6, 2026, the Panel issued a Procedural Order directing Complainant to submit a supplemental brief and/or additional evidence to substantiate the claims concerning the link between the disputed domain name and a phishing scheme. On March 6, 2026, Complainant submitted its Additional Submission in response to said Procedural Order.

 

Having reviewed the communications records, the Administrative Panel (the "Panel") finds that Forum has discharged its responsibility under Paragraph 2(a) of the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") "to employ reasonably available means calculated to achieve actual notice to Respondent" through submission of Electronic and Written Notices, as defined in Rule 1 and Rule 2. Therefore, the Panel may issue its decision based on the documents submitted and in accordance with the ICANN Policy, ICANN Rules, Forum's Supplemental Rules and any rules and principles of law that the Panel deems applicable, without the benefit of any response from Respondent.

 

RELIEF SOUGHT

Complainant requests that the domain name be transferred from Respondent to Complainant.

 

PARTIES' CONTENTIONS

A. Complainant

i) Since its founding in 1873, Complainant has established itself as a global law firm offering a wide range of legal services across all major industries. Complainant advises clients in numerous industry sectors, representing close to 90 percent of the Fortune 100 companies. Complainant has consistently been honored for its legal services and has received numerous industry awards. Complainant operates as a global law firm with 33 offices throughout North America, Europe, Asia, and the Middle East. Complainant owns numerous registrations for the MORGAN LEWIS mark around the world, inter alia, its registration with the USPTO (e.g., Reg. No. 2,469,580, registered July 17, 2001). The disputed domain name is confusingly similar to Complainant's MORGAN LEWIS mark, as it incorporates the mark in its entirety and simply adds the descriptive term "internal" and the .com generic top-level domain ("gTLD").

 

ii) Respondent has no rights or legitimate interests in the disputed domain name. Respondent is not commonly known by the disputed domain name, nor has Complainant authorized Respondent to use the MORGAN LEWIS mark. Respondent has not employed the disputed domain name for any bona fide offering of goods or services. Instead, Respondent has used, or intended to use, the disputed domain name in bad faith in connection with a fraudulent phishing scheme to gain access to Complainant's network credentials or single sign-on methods (i.e., credential harvesting). Respondent's goal in such a scheme is to gain access to Complainant's corporate environments in an attempt to exfiltrate sensitive data and to then leverage that data for profit. There can be no rights or legitimate interests under Policy 4(c)(i), as Respondent was on notice that Complainant possesses strong trademark rights in the MORGAN LEWIS mark at the time of registration.

 

iii) Respondent registered and uses the disputed domain name in bad faith. The notoriety and distinctive qualities of the MORGAN LEWIS trademark make it implausible that Respondent acted independently or innocently. Respondent's willful intent to violate Complainant's rights is evident from the registration of a domain name fully incorporating the MORGAN LEWIS mark to impersonate Complainant for fraudulent revenue generation. Respondent could not have chosen or subsequently used the disputed domain name for any reason other than to trade on Complainant's goodwill, to confuse Internet users, and thereby attract them to a website with a name which is identical to Complainant's prominent mark. Respondent's connection to phishing activity and status as a serial cybersquatter, having lost at least 81 UDRP cases, further confirms bad faith.

 

B. Respondent

Respondent did not submit a Response in this proceeding.

 

C. Complainant's Additional Submission

At the Panel's request, Complainant has provided additional explanation and evidence regarding Respondent's use of the disputed domain name in connection with phishing activities. Between January and February 2026, Complainant received multiple alerts from cybersecurity vendors, including CrowdStrike, regarding a surge in phishing attacks by groups such as SHINYHUNTERS targeting the legal sector via domains mimicking internal SSO platforms. In response, Complainant's IT personnel identified the disputed domain name as potentially connected to these credible threats, prompting firm-wide security warnings. Notably, public reports link the SHINYHUNTERS operation to domains registered through Tucows with Njalla privacy services, which is the exact configuration used by Respondent. Similar domains targeting peer firms, for example, JONESDAYINTERNAL.COM and PERKINSCOIEINTERNAL.COM, share these technical characteristics, and have been deactivated by the registrar. Collectively, this circumstantial evidence demonstrates that Respondent registered the disputed domain name in bad faith and in connection with a coordinated phishing scheme.

 

FINDINGS

1. The disputed domain name was registered on January 26, 2026.

 

2. Complainant has established rights in the MORGAN LEWIS mark around the world, inter alia, through its registration with the USPTO (e.g., Reg. No. 2,469,580, registered July 17, 2001).

 

3. Between January and February 2026, Complainant received multiple alerts from cybersecurity vendors, including CrowdStrike, regarding a surge in phishing attacks by groups such as SHINYHUNTERS targeting the legal sector via domains mimicking internal SSO platforms. In response, Complainant's IT personnel identified the disputed domain name as potentially connected to these credible threats, prompting firm-wide security warnings.

 

4. Respondent is a serial cybersquatter who has lost at least 81 prior UDRP cases covering at least 206 domain names.

 

DISCUSSION

Paragraph 15(a) of the Rules instructs this Panel to "decide a complaint on the basis of the statements and documents submitted and in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable."

 

Paragraph 4(a) of the Policy requires that Complainant must prove each of the following three elements to obtain an order that a domain name should be cancelled or transferred:

 

(1)       the domain name registered by Respondent is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and

(2)       Respondent has no rights or legitimate interests in respect of the domain name; and

(3)       the domain name has been registered and is being used in bad faith.

 

In view of Respondent's failure to submit a response, the Panel shall decide this administrative proceeding on the basis of Complainant's undisputed representations pursuant to paragraphs 5(f), 14(a) and 15(a) of the Rules and draw such inferences it considers appropriate pursuant to paragraph 14(b) of the Rules.  The Panel is entitled to accept all reasonable allegations set forth in a complaint; however, the Panel may deny relief where a complaint contains mere conclusory or unsubstantiated arguments. See WIPO Jurisprudential Overview 3.1 at ¶ 4.3; see also eGalaxy Multimedia Inc. v. ON HOLD By Owner Ready To Expire, FA 157287 (Forum June 26, 2003) ("Because Complainant did not produce clear evidence to support its subjective allegations [. . .] the Panel finds it appropriate to dismiss the Complaint").

 

Identical and/or Confusingly Similar

Complainant claims rights in the MORGAN LEWIS mark around the world, inter alia, through its registration with the USPTO (e.g., Reg. No. 2,469,580, registered July 17, 2001). Registration of a mark with the USPTO is sufficient to establish rights in that mark per Policy ¶ 4(a)(i). Complainant provides copies of its USPTO registrations for the MORGAN LEWIS mark. Therefore, the Panel finds that Complainant has established rights in the MORGAN LEWIS mark under Policy ¶ 4(a)(i).  

 

Complainant contends that the disputed domain name, <morganlewisinternal.com>, is confusingly similar to its mark, as it fully incorporates the MORGAN LEWIS mark and merely adds the descriptive term "internal" and the gTLD ".com." The Panel agrees and finds that the disputed domain name is confusingly similar to Complainant's mark under Policy ¶ 4(a)(i).

 

Rights or Legitimate Interests

Complainant must first make a prima facie case that Respondent lacks rights and legitimate interests in the disputed domain name under Policy ¶ 4(a)(ii), then the burden shifts to Respondent to show it does have rights or legitimate interests. See Section 2.1, WIPO Jurisprudential Overview 3.1 ("Where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name. If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element.").

 

Complainant argues that Respondent has no rights or legitimate interest in the disputed domain name as Respondent is not commonly known by the disputed domain name, nor has Respondent been authorized by Complainant to use Complainant's mark, and Respondent is not affiliated with Complainant. Relevant information, such as WHOIS information, can be used as evidence to show a respondent is or is not commonly known by the disputed domain name under Policy ¶ 4(c)(ii).  The Panel notes that the unmasked WHOIS data identifies "Host Master / Njalla Okta LLC" as the registrant, and the record contains no evidence to suggest Respondent was authorized to use the mark. Therefore, the Panel finds that Respondent is not commonly known by the disputed domain name under Policy ¶ 4(c)(ii).

 

Complainant asserts that Respondent does not use the disputed domain name for a bona fide offering of goods or services or a legitimate noncommercial or fair use. Complainant submits that between January and February 2026, Complainant received multiple alerts from cybersecurity vendors, including CrowdStrike, regarding a surge in phishing attacks by groups such as SHINYHUNTERS targeting the legal sector via domains mimicking internal SSO platforms. In response, Complainant's IT personnel identified the disputed domain name as potentially connected to these credible threats, prompting firm-wide security warnings.  

 

The Panel finds that Respondent's use of the disputed domain name to impersonate Complainant as part of a phishing scheme is not recognized as a bona fide offering of goods or services or a legitimate noncommercial or fair use under Policy ¶¶ 4(c)(i) or (iii). see Abbvie, Inc. v. James Bulow, FA 1701075 (Forum Nov. 30, 2016) ("Respondent uses the at-issue domain name to pose as Complainant's CEO by means of email addresses at the confusingly similar domain name in an attempt to determine Complainant's ability to process a transfer. Using the domain name in this manner is neither a bona fide offering of goods and services under Policy ¶ 4(c)(i), nor a legitimate noncommercial or fair use under Policy ¶ 4(c)(iii).")  

 

Based on these findings, the Panel determines that Complainant has established a prima facie case regarding Respondent's lack of rights or legitimate interests in the disputed domain name. As Respondent has not submitted a response or otherwise rebutted the prima facie case, the Panel concludes that Respondent has no rights or legitimate interests in the disputed domain name.

 

Registration and Use in Bad Faith

Complainant asserts that Respondent registered and uses the disputed domain name in bad faith. Complainant contends that Respondent's registration and use of the disputed domain name, which fully incorporates Complainant's MORGAN LEWIS mark in connection with actual or intended phishing activity, demonstrates Respondent's bad faith registration and use of the disputed domain name.  

 

Registering a confusingly similar domain name to disrupt business through phishing schemes constitutes bad faith under Policy ¶ 4(b)(iv). see Qatalyst Partners LP v. Devimore, FA 1393436 (Forum July 13, 2011) (holding that using a domain name for phishing purposes is evidence of bad faith).  

 

As previously noted, Complainant's IT personnel identified the disputed domain name as potentially connected to credible threats, prompting firm-wide security warnings. The Panel finds that Respondent's phishing scheme disrupts Complainant's business and constitutes bad faith registration and use under Policy ¶ 4(b)(iv).

 

DECISION

Having established all three elements required under the ICANN Policy, the Panel concludes that relief shall be GRANTED.

 

Accordingly, it is Ordered that the <morganlewisinternal.com> domain name be TRANSFERRED from Respondent to Complainant.

 

 

 

Ho-Hyun Nahm, Esq., Panelist

Dated: March 7, 2026