CyberArk Software Ltd. v Cyber Arky

WIPO Case No. D2025-3212

ARBITRATION
AND
MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION
CyberArk Software Ltd. v. Cyber Arky

Case No. D2025-3212

1. The Parties

The Complainant is CyberArk Software Ltd., Israel, internally represented.

The Respondent is Cyber Arky, United States of America.

2. The Domain Name and Registrar

The disputed domain name <cyberarky.com> is registered with GoDaddy.com, LLC (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on August 11, 2025.
On August 12, 2025, the Center transmitted by email to the Registrar a request for registrar verification in
connection with the disputed domain name. On the same day, the Registrar transmitted by email to the
Center its verification response disclosing registrant and contact information for the disputed domain name,
which differed from the named Respondent (Registration Private, Domains By Proxy, LLC) and contact
information in the Complaint. The Center sent an email communication to the Complainant on August 13,
2025, providing the registrant and contact information disclosed by the Registrar, and inviting the
Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on

August 27, 2025.

The Center verified that the Complaint together with the amended Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for

Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the
Complaint, and the proceedings commenced on August 29, 2025. In accordance with the Rules, paragraph
5, the due date for Response was September 18, 2025. The Respondent did not submit any response.
Accordingly, the Center notified the Respondent’s default on September 19, 2025.

page 2

The Center appointed Knud Wallberg as the sole panelist in this matter on September 24, 2025. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

Founded in 1999, CyberArk offers identity security, centered on privileged access security, a critical layer of IT security to protect data, infrastructure, and assets across an enterprise to reduce risk and protect against advanced cyber threats across business applications, distributed workforces, hybrid cloud work cloud

workloads and the DevOps lifecycle. CyberArk is commercially active in 110 countries and serves more than for Privileged Access Management and in 2022 Gartner Magic Quadrant for Access Management.

60 percent of the Fortune 100 companies, to protect against external attackers and malicious insiders.

The Complainant is the owner of the following trademarks, among others:

- United States Registration No. 2,557,762 for CYBERARK, registered on April 9, 2002, in class 9.

- International Registration No. 1259493 for CYBERARK registered on March 4, 2015 in classes 9 and 42, designating various jurisdictions, including (but not limited to) China, the European Union, and India

Further, the Complainant owns a large number of domain names containing its mark CYBERARK including
<cyberark.com>, <cyberark.us>, and <cyberarkcloudsecurity.com>.

The disputed domain name was registered on January 7, 2019, and resolves to a website that appears to offer what is described as “professional technology assistance”.

5. Parties’ Contentions

A. Complainant

The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain name.

Notably, the Complainant contends that the disputed domain name is confusingly similar to the Complainant’s trademark CYBERARK and that the Respondent has no rights or legitimate interests in respect of the domain name. Finally, the Complainant contends that the disputed domain name has been registered and used in bad faith. The Respondent’s use of the name “CyberArky” in the disputed domain name and on the website, along with the offering of enterprise security services, creates a strong likelihood of confusion and falsely implies an affiliation with or endorsement by the Complainant. The Respondent is thus deliberately attempting to attract internet users to the website for commercial gain by creating a likelihood of confusion with the Complainant’s mark regarding the source, sponsorship, affiliation, or endorsement of the website and its services.

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

page 3

6. Discussion and Findings

A. Identical or Confusingly Similar

It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain name. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, (“WIPO Overview 3.0”), section 1.7.

The Complainant has shown rights in respect of a trademark or service mark for the purposes of the Policy.
WIPO Overview 3.0, section 1.2.1.

The entirety of the mark is reproduced within the disputed domain name. Accordingly, the disputed domain name is confusingly similar to the mark for the purposes of the Policy. WIPO Overview 3.0, section 1.7.

The Panel finds the first element of the Policy has been established.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name.

Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.0, section 2.1.

Having reviewed the available record, the Panel finds the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent has not rebutted the Complainant’s prima facie showing and has not come forward with any relevant evidence demonstrating rights or legitimate interests in the disputed domain name such as those enumerated in the Policy or otherwise.

Although the Respondent has provided a registrant name of “Cyber Arky”, there is nothing in the record suggesting that the Respondent is commonly known by the disputed domain name for the purposes of the Policy. Moreover, as discussed further below, it appears more likely than not that this name was chosen because of its similarity to the Complainant’s trademark in order to unfairly trade off of such mark, and accordingly, absent further explanation or evidence does not demonstrate rights or legitimate interests in the disputed domain name.

The Panel finds the second element of the Policy has been established.

C. Registered and Used in Bad Faith

The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith.

page 4

In the present case, the Panel notes that the Respondent has not offered any explanation for having registered a domain name that is quasi-identical to the Complainant’s distinctive trademark. Given the circumstances of the case, it is inconceivable to the Panel in the current circumstances that the Respondent registered the disputed domain name without prior knowledge of the Complainant and the Complainant’s mark.

Given the circumstances of the case, including the evidence on record of the use and reputation of the Complainant’s trademark CYBERARK, and the distinctive nature of this mark, it is inconceivable to the Panel that the Respondent registered the disputed domain name without prior knowledge of the Complainant and the Complainant’s mark. This is substantiated by the fact that the Respondent appears to be operating a business within the same sector as the Complainant. The Panel therefore finds that the Respondent could not have been unaware of the fact that it chose a domain name, which could attract Internet users in a manner that is likely to create confusion for such users.

The Panel also notes that postal addresses provided for the registration details of the disputed domain name
and on the Respondent’s website are on opposites sides of the United States, and that no physical
commercial site of the Respondent is apparent at either location according to public map information.
WIPO Overview 3.0, section 4.8. Moreover, the Respondent’s website provides relatively generic
information about its proposed services and at least one nonfunctional website feature, without specific
information about the Respondent’s identity, specific services, pricing structures, or other content Internet
users would expect on a fully operative website. In the context of the other circumstances in this case, these

facts further support the Panel’s findings above.

The Panel finds that the Complainant has established the third element of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <cyberarky.com> be transferred to the Complainant.

/Knud Wallberg/
Knud Wallberg
Sole Panelist
Date: October 8, 2025