ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Hack The Box Ltd. v. Host Master, 1337 Services LLC Case No. D2025-3332 1. The Parties Complainant is Hack The Box Ltd., United Kingdom, represented by Stobbs IP Limited, United Kingdom. Respondent is Host Master, 1337 Services LLC, Saint Kitts and Nevis. 2. The Domain Name and Registrar The disputed domain name is registered with Tucows Domains Inc. (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on August 19, 2025. On August 19, 2025, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On August 19, 2025, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent (Redacted for Privacy) and contact information in the Complaint. The Center sent an email communication to Complainant on August 20, 2025, providing the registrant and contact information disclosed by the Registrar, and inviting Complainant to submit an amendment to the Complaint. Complainant filed an amendment to the Complaint on August 25, 2025. The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on August 28, 2025. In accordance with the Rules, paragraph 5, the due date for Response was September 17, 2025. Respondent did not submit any response. Accordingly, the Center notified Respondent’s default on September 18, 2025.
page 2 The Center appointed Gabriel F. Leonardos as the sole panelist in this matter on September 23, 2025. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background Complainant was founded in 2017 and focuses on offering courses, labs, certifications, and simulations for cybersecurity professionals and organizations. Its services are offered under the HACK THE BOX trademark and its acronym HTB, equally registered as a trademark. Complainant is a relevant actor in its sector and has surpassed three million platform members. Accordingly, Complainant is the owner of several trademark registrations for the term HACK THE BOX and HTB as attached in Annex 8 of the Complaint, and also owns a domain name incorporating the HACK THE BOX trademark, . Registration Number Trademark Jurisdiction International Class Registration Date UK00918144282 HACK THE BOX United Kingdom 41, 42 February 13, 2020 UK00004069581 HTB United Kingdom 41, 42 October 11, 2024 1830238 HTB CBBH Australia 41 March 18, 2025 2510964 HTB CDSA Australia 41 March 17, 2025 18456183 European Union 41, 42 August 10, 2021 The disputed domain name was registered on September 6, 2022, and resolves to a website that uses the HACK THE BOX and HTB trademarks and appears to be associated or endorsed by Complainant. The website purportedly offers for sale “a bundle of all Hackthebox Prolabs Writeup with discounted price” and other simulation environments. It also displays the copyright notice “Copyright © HTBPro 2022-2025”. 5. Parties’ Contentions A. Complainant Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain name. Notably, Complainant contends that the disputed domain name includes an identical spelling of its trademark HTB and only adds the term “pro”, meaning “professional”, which is closely related to Complainant’s activities of provision of strategic cybersecurity expertise and certifications. Therefore, according to Complainant, the disputed domain name is confusingly similar to Complainant’s trademark HTB, fulfilling paragraph 4(a)(i) of the Policy and paragraphs 3(b)(viii) and (b)(ix)(1) of the Rules. Complainant states that it has not given a license or authorization of any kind for the registration or use of the trademark HTB in a domain name. Moreover, it affirms that Respondent is not using the disputed domain name in connection with a bona fide offering of goods and services.
page 3 In this manner, Complainant states that no legitimate use of the disputed domain names could be reasonably claimed by Respondent, fulfilling paragraph 4(a)(ii) of the Policy and paragraph 3(b)(ix)(2) of the Rules. According to Complainant, Respondent was aware of Complainant's trademarks and intends to profit from a fraudulent association with Complainant, especially considering that Respondent is engaged in selling proprietary materials and is actively infringing Complainant’s intellectual property rights. Thus, according to Complainant, the requirements for the identification of a bad faith registration and use of the disputed domain name have been fulfilled, pursuant to paragraphs 4(a)(iii) and 4(b) of the Policy and paragraph 3(b)(ix)(3). Accordingly, Complainant requests the disputed domain name be transferred to it. B. Respondent Respondent did not reply to Complainant’s contentions. 6. Discussion and Findings To succeed in a UDRP complaint, Complainant must demonstrate that all the elements listed in paragraph 4(a) of the Policy have been satisfied, as following: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and (ii) Respondent has no rights or legitimate interests in respect of the disputed domain name; and (iii) the disputed domain name has been registered and is being used in bad faith. The burden of proving these elements is upon Complainant. After formal commencement of the administrative proceeding, Respondent had 20 days to submit a response in accordance with paragraph 5(a) of the Rules and failed to do so. Paragraph 5(f) of the Rules establishes that if a respondent does not respond to the complaint, in the absence of exceptional circumstances, the Panel’s decision shall be based upon the Complaint. A. Identical or Confusingly Similar It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between Complainant’s trademark and the disputed domain name. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, (“WIPO Overview 3.0”), section 1.7. Based on the available record, the Panel finds Complainant has shown rights in respect of a trademark or service mark for the purposes of the Policy. WIPO Overview 3.0, section 1.2.1. The Panel notes that the disputed domain name was registered before Complainant’s trademarks for HTB. Nevertheless, the fact that a domain name may have been registered before a complainant has acquired trademark rights does not by itself preclude a complainant’s standing to file a UDRP case, nor a panel’s finding of identity or confusing similarity under the first element. See WIPO Overview 3.0 section 1.1.3.
page 4 Panels have acknowledged the possibility of such a finding and have recognized the identity between disputed domain names and trademarks, even when the trademark rights were established after the domain name registration. See MADRID 2012, S.A. v. Scott Martin-MadridMan Websites, WIPO Case No. D2003-0598. In this sense, the entirety of the trademark HTB is reproduced within the disputed domain name. Accordingly, the disputed domain name is confusingly similar to the mark for the purposes of the Policy. WIPO Overview 3.0, section 1.7. Although the addition of the term “pro” in the disputed domain name may bear on assessment of the second and third elements, the Panel finds that such change does not prevent a finding of confusing similarity between the disputed domain names and the mark for the purposes of the Policy. WIPO Overview 3.0, section 1.8. Therefore, based on the available record, the Panel finds the first element of the Policy has been established. B. Rights or Legitimate Interests Paragraph 4(c) of the Policy provides a list of circumstances in which Respondent may demonstrate rights or legitimate interests in a disputed domain name. Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.0, section 2.1. Having reviewed the available record, the Panel finds Complainant has established a prima facie case that Respondent lacks rights or legitimate interests in the disputed domain names. Respondent has not rebutted Complainant’s prima facie showing and has not come forward with any relevant evidence demonstrating rights or legitimate interests in the disputed domain names such as those enumerated in the Policy or otherwise. Panels have held that the use of a domain name for impersonation can never confer rights or legitimate interests on a Respondent. WIPO Overview 3.0, section 2.13.1. Based on the available record, Respondent is not entitled to any trademark, trade name, or any other right associated with the disputed domain name. Additionally, Respondent has not been authorized by Complainant to use the HACK THE BOX and HTB trademarks, and there is no commercial relationship between the Parties. Respondent is not recognized by the disputed domain names. Furthermore, the website at the disputed domain name fails to disclose its lack of relationship with Complainant, and instead impersonates or falsely suggests affiliation with Complainant. In light of these circumstances, the Panel finds that no rights or legitimate interests can be found on behalf of Respondent. Accordingly, the Panel finds the second element of the Policy has been established.
page 5 C. Registered and Used in Bad Faith The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith. In the present case, the Panel notes that Respondent has registered a domain name that is confusingly similar to Complainant’s HTB trademarks. Based on the available record, it is established that Respondent has no affiliation with Complainant nor has it sought authorization or a license to utilize the referred trademarks. Also, Respondent does not own any trademarks containing the term HTB or shown any rights in the trademark or any related terms. Moreover, the choice of additional term “pro” to the Complaint’s trademark tends to increase the confusion of Internet users, since the term equates to “professional” and is closely related to Complainant's services and its provision of strategic cybersecurity expertise to professionals and certifications. Furthermore, it is noticeable that the element “htb” corresponds to an acronym derived from Complainant’s earlier marks for HACK THE BOX. Complainant has become known for this acronym and has secured several trademark registrations incorporating this term and its variations, such as HTB CBBH and HTB CDSA, which refer to different certification levels offered by Complainant. As a result, users are likely to associate the disputed domain name with Complainant. In this sense, Respondent evidently knew or should have known of the existence of Complainant’s prior trademark rights, which were matters of public record, before registering the disputed domain names. Accordingly, the fact that the disputed domain name was registered before the registration of Complainant’s HTB trademark does not prevent a finding of bad faith registration. Furthermore, as shown in Annex 10, Respondent was impersonating Complainant by using Complainant’s trademarks in nominative and composite forms on its website, as well as reproducing Complainant’s overall visual identity to purportedly offer for sale Complainant’s proprietary materials. This use has already resulted in the suspension of Respondent’s social media accounts. Panels have held that the use of a domain name for illegal activity (i.e. impersonation/passing off), constitutes bad faith. WIPO Overview 3.0, section 3.4. Having reviewed the record, the Panel finds Respondent’s registration and use of the disputed domain name constitutes bad faith under the Policy. See Groupe Canal + v. johon Host Master, Njalla Okta LLC, and WALID MSR, WIPO Case No. D2025-1465. It is evident that Respondent intends to financially profit from misleading internet users to its website under the false impression that they are dealing with Complainant and its services. Therefore, the Panel finds that the circumstances of the present case allow for a finding of bad faith in the registration and use of the disputed domain names, considering that (i) Respondent attempted to impersonate/pass off as Complainant; and, (ii) Respondent was most likely aware of Complainant’s trademark rights, especially considering Respondent’s previous use of the website under the disputed domain name, which aimed to create a likelihood of confusion within Internet users to create the facade of a link to Complainant. Based on the available record, the Panel finds that Complainant has established the third element of the Policy.
page 6 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name be transferred to Complainant. /Gabriel F. Leonardos/ Gabriel F. Leonardos Sole Panelist Date: October 6, 2025
Full & Egal Universal Law Academy