GitHub, Inc. v Jonathan Lew

WIPO Case No. D2024-3773

ARBITRATION
AND
MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

GitHub, Inc. v. Jonathan Lew

Case No. D2024-3773

1. The Parties

The Complainant is GitHub, Inc., United States of America (“USA”), represented by Chestek Legal, USA.

The Respondent is Jonathan Lew, USA .

2. The Domain Name and Registrar

The disputed domain name, <githubapp.net>, is registered with Spaceship, Inc. (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on September 16, 2024. On September 17, 2024, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On September 18, 2024, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent (Redacted for Privacy) and contact information in the Complaint. The Center sent an email communication to the Complainant on September 18, 2024, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on September 19, 2024.

The Center verified that the Complaint together with the amended Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for
Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on September 23, 2024. In accordance with the Rules, paragraph 5, the due date for Response was October 13, 2024. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on October 14, 2024.

The Center appointed Dennis A. Foster as the sole panelist in this matter on October 21, 2024. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration

page 2

of Impartiality and Independence, as required by the Center to ensure compliance with the Rules,

paragraph 7.

4. Factual Background

The Complainant is a USA software company that specializes in mobile phone apps. It describes itself as “a code/program developer platform”. The Complainant has been in business since 2007 and conducts business worldwide. In this regard, the Complainant owns a number of USA and International trademark registrations for its GITHUB trademark, e.g.: International (with USA designation) Trademark No. 5378794, registration date January 16, 2018; European Union Trade Mark No. 012454823, registration date May 14, 2014. Both trademarks include International Class 42 for computer and scientific services.

The Complainant has used the <github.com> domain name for its primary website since 2007.

The disputed domain name was registered on February 17, 2024. The disputed domain name does not apparently been used for illicit cyber activities.

currently resolve to a website, but the Complainant has provided evidence that the Federal Bureau of
Investigation, Cybersecurity and Infrastructure Security Agency, and the Department of Defense Cyber

5. Parties’ Contentions

A. Complainant

- The Complainant’s trademark GITHUB is an invented, fanciful trademark with no meaning in any language.

- The incorporation of a trademark in its entirety is sufficient to establish that a domain name is identical or

confusingly similar to a complainant’s registered mark.

- The Respondent’s domain name adds a generic term at the end to suggest to Internet visitors that they
have reached a domain name that contains a GitHub app that is authorized by or affiliated with the

Complainant.

- Adding a generic term to a mark, regardless of its connection to the Complainant’s services, does not

differentiate the disputed domain name from the mark.

- The Respondent does not use the disputed domain name in connection with a bona fide offering of goods
and services. The Respondent’s aim in registering the disputed domain name was to exploit the GITHUB

trademark in order to carry out cyberattacks.

- The Respondent is not commonly known by the disputed domain name.

- The Respondent registered the disputed domain name in February 2024, long after the Complainant’s first

use of its trademark in 2007 and subsequent registration in 2010.

- There is no doubt that the Respondent has registered and is using the disputed domain name in bad faith

to create a likelihood of confusion with the Complainant’s trademark.

- The disputed domain name should be transferred to the Complainant.

B. Respondent

The Respondent did not file a response in this proceeding.
page 3

6. Discussion and Findings

Paragraph 4(a) of the Policy provides that a complainant must demonstrate each of the following:

(i)        the disputed domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;

(ii)       the respondent has no rights or legitimate interests in respect of the disputed domain name; and

(iii)      the disputed domain name has been registered and is being used in bad faith.

Under paragraph 15(a) of the Rules, a Panel shall decide a complaint on the basis of the statements and documents submitted and in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable.

A. Identical or Confusingly Similar

The Complainant has produced the data for some of its numerous GITHUB trademark registrations in the customary under the Policy, the Panel accepts these trademark registrations as proof that the Complainant has trademark rights in the disputed domain name. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, (“WIPO Overview 3.0”), section 1.2.1.

As to whether the disputed domain name is identical or confusingly similar to the Complainant’s trademark,
the Panel observes that the disputed domain name contains all of the Complainant’s GITHUB trademark.
The Respondent has also added the term “app”. The Panel finds that the disputed domain name is
confusingly similar to the Complainant’s trademark because it incorporates the entirety of the Complainant’s
trademark and the addition of the word “app” does not prevent a finding of confusing similarity. WIPO
Overview 3.0, sections 1.7 and 1.8. And see TPI Holdings, Inc. v. Carmen Armengol, WIPO Case No.
D2009-0361.

Therefore, the Panel finds that the Complainant has carried its burden of proof to show that the disputed domain name is confusingly similar to the Complainant’s trademark per Policy paragraph 4(a)(i).

B. Rights or Legitimate Interests

It is well-settled under the Policy that, given the difficulty for a complainant to prove the negative proposition that a respondent does not have rights or legitimate interests in a disputed domain name, the Complainant initially need only put forth a prima facie case, and then the Respondent should come forward with evidence

that it does have rights or legitimate interests in the disputed domain name. Nota bene, however, that the
ultimate burden of proof remains on the Complainant. WIPO Overview 3.0, section 2.1.

The Complainant has contended that the Respondent has no authorization to use its trademark in the disputed domain name, and that the Respondent has registered the disputed domain name in order to exploit the Complainant’s trademark in bad faith. The Panel accepts the Complainant’s contentions as a

prima facie case. WIPO Overview 3.0, section 2.1. The Respondent did not file a response, and thus did
not come forward to rebut the Complainant’s prima facie case.

Nonetheless, the Policy at paragraph 4(c) gives the Respondent three ways in which it may show that it does have rights or legitimate interests in the disputed domain name. The Panel will review the record to see if one or more of these ways are available to the Respondent.

Policy paragraph 4(c)(i) allows the Respondent to claim legitimate rights and interests in the disputed domain name if the Respondent can show that it is using the disputed domain name to make a bona fide offering of goods and services. However, the Respondent in our case is using the disputed domain name to foment

page 4

cyber attacks and malware mischief. The Panel finds this is not a bona fide offering of goods and services.
See WIPO Overview 3.0, Section 2.13.1.

Next, according to the WhoIs and Registrar information available, the Respondent is not commonly known by the disputed domain name as would be required to claim rights and legitimate interests under Policy paragraph 4(c)(ii). And finally, relative to Policy paragraph 4(c)(iii), the Respondent is not using the disputed domain name for a noncommercial or fair use.

Ergo, the Panel finds that the Complainant has carried its burden of proof to show that the Respondent does not have rights or legitimate interests in the disputed domain name per Policy paragraph 4(a)(ii).

C. Registered and Used in Bad Faith

Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith, but other circumstances may be relevant in assessing whether a respondent’s registration and use of a domain name is in bad faith. WIPO Overview 3.0, section 3.2.1.

In our case, the Respondent registered the disputed domain name in February 2024, several decades after the Complainant had become an established business in open source app development. The Panel finds that this, in addition to the composition of the disputed domain name itself, proves that the Respondent had in mind the Complainant and its business when it registered the disputed domain name in order to capitalize on the Complainant’s status and contacts by adopting a domain name that indicated affiliation with the Complainant.

Once it had the disputed domain name, the Respondent leveraged the collaborative practices of open source
programming and the claimed, but nonexistent, connection to the Complainant to gain access to the work
and contacts of many persons and entities in this field. From this vantage point, the Respondent moved to
carry out cyber and malware attacks.

The Panel thus finds that the Respondent registered and is using the disputed domain name in bad faith in violation of the Policy. See WIPO Overview 3.0, section 3.4.

And finally, the Panel finds the Complainant has carried its burden of proof under Policy paragraph 4(a)(iii).

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <githubapp.net> be transferred to the Complainant.

/Dennis A. Foster/
Dennis A. Foster
Sole Panelist
Date: November 4, 2024