10 October, 2026

Managing Potential Phishing Risks in Domain Squatting Disputes

UDRP Cases

Fisher Asset Management successfully recovered domains fishersinvestment.net and fishersinvestors.com after the respondent failed to provide a defense. The panel ruled in favor of transfer, citing the risk posed by the respondent’s configuration of email-enabling MX records as evidence of bad faith.

Case Snapshot

Case Number D2026-3737
Complainant Fisher Asset Management, LLC
Respondent ROBIN CLARK
Disputed Domain
fishersinvestment.netfishersinvestors.com
Threat Tactic Phishing and Email Fraud
Decision Date 2026-10-05
Panelist Lawrence K. Nodine
OutcomeTransfer
Official Source https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2026-3737
UDRP Legal Assistance

Facing Unauthorized Domain Registrations or Brand Abuse?

Our domain dispute attorneys represent trademark owners and businesses worldwide before WIPO, Forum (NAF), and CAC. Explore our Domain Name Disputes and Enforcement & Takedowns services, or request a free case evaluation.

Request Case Evaluation

Operational Risks of Email-Enabled Typosquatting

The configuration of MX records on the disputed domains ‘fishersinvestment.net’ and ‘fishersinvestors.com’ created a significant security risk for Fisher Asset Management, despite the absence of evidence confirming actual consumer losses. By enabling email capabilities, the respondent established the infrastructure necessary for sophisticated phishing campaigns, such as credential harvesting or invoice fraud, targeting the brand’s extensive client base of over 200,000 individuals. The panel in D2026-3737 acknowledged that while no fraudulent emails were documented, the latent capacity for deception-based injury warrants proactive intervention from brand protection teams when similar typosquatted domains are identified.

This case illustrates the strategic importance of monitoring domain registrations for MX record updates, even when domains display only ‘under construction’ notices. The respondent’s failure to provide a substantive defense did not mitigate the inherent danger posed by the technical setup, which the panel ultimately relied upon to infer bad faith registration. For businesses managing substantial assets, this precedent confirms that the presence of email-routing configurations on domains mimicking a registered trademark provides a sufficient legal basis to establish bad faith, allowing brand owners to disrupt potential fraud vectors before they manifest into active, consumer-facing phishing operations.

Strategic Leverage of MX Records and Default Proceedings

Fisher Asset Management’s strategy focused on the proactive identification of high-risk technical configurations despite the absence of active consumer-facing content. By documenting that the disputed domains—fishersinvestment.net and fishersinvestors.com—were configured with active Mail Exchange (MX) records, the Complainant provided the panel with actionable evidence of potential phishing intent. Even though the Complainant could not produce evidence of actual fraudulent emails or consumer losses, the panel accepted the presence of email-enabling records as a sufficient proxy for bad faith usage. This approach illustrates a persuasive tactical pivot: positioning the mere technical capability for credential harvesting or invoice fraud as a latent business risk that requires immediate mitigation, rather than waiting for realized damage.

The Complainant benefited significantly from the Respondent’s failure to file a formal defense. Under the UDRP framework, this procedural default allowed the panel to adopt a more favorable interpretation of the evidence regarding rights and legitimate interests. By clearly establishing the global reputation of the Fisher Investments mark—spanning decades of operations and over USD 387 billion in assets—the Complainant created an evidentiary bridge that made the Respondent’s unauthorized registration appear inherently opportunistic. This case reinforces the value of exhaustive evidentiary background, as providing the panel with a comprehensive history of the mark’s prominence effectively neutralized the Respondent’s opportunity to claim a legitimate, non-infringing interest in the domains.

Practical Recommendations

  • Include DNS technical evidence, specifically the presence of MX records, in all UDRP complaints to demonstrate ‘bad faith use’ even in the absence of active website content or documented phishing incidents.
  • Proactively monitor newly registered domains using your brand’s trademark to identify potential threats, specifically targeting those with email-enabling records that indicate an intent to impersonate your communication channels.
  • Draft UDRP complaints to emphasize the potential for deception-based injury, arguing that MX record configuration creates a dormant yet credible risk of credential harvesting or invoice fraud against your client base.
  • Leverage the ‘under construction’ status of suspicious domains as supporting evidence for a lack of legitimate interests, reinforcing your claim that the respondent is not making a bona fide offering of goods or services.
  • When facing typosquatted domains, perform a WHOIS lookup and DNS check immediately upon discovery; use the documentation of mail-server settings as a primary exhibit to establish bad faith at the registration stage.

Frequently Asked Questions (FAQ)

Why were the domains fishersinvestment.net and fishersinvestors.com considered confusingly similar to the Fisher Asset Management brand?

The panel applied a standard threshold test, determining that the domains incorporate the well-known FISHER mark in a manner that creates a high likelihood of confusion for consumers, meeting the standing requirements under the UDRP Policy.

How did the presence of MX records influence the finding of bad faith in this case?

Although there was no direct evidence of actual phishing attacks, the panel found that the respondent’s configuration of email-enabling MX records for these dormant domains created a significant risk of deception-based injury, which the panel accepted as evidence of bad faith registration.

How was the respondent’s lack of rights or legitimate interests established?

The respondent failed to submit a response to the complaint, and the domains were merely displaying ‘under construction’ notices rather than any active, legitimate business content, leading the panel to conclude the respondent had no rights or interests in the names.

What is the key takeaway for brand owners regarding domains that are ‘under construction’ but have active MX records?

This case highlights that brand owners should monitor for registrations that include email-routing configurations, as the infrastructure for potential invoice fraud or credential harvesting can support a successful UDRP transfer even before specific evidence of actual consumer loss occurs.

Concerned about fake email or invoice fraud?

Even without active content, domains configured with MX records pose a significant risk of credential harvesting and business email compromise. Our team helps you identify and mitigate these threats early.

Request phishing analysis

Get Expert UDRP & Domain Dispute Assistance
Request a confidential case evaluation from our domain dispute attorneys. We will review your domain situation and reply within 24 hours.

    Thank You for Your Request!
    Our legal team is reviewing your dispute details and will contact you via email shortly.
    Image
    This site uses cookies to improve your experience. By continuing, you agree to our Privacy Policy.
    Privacy settings

    When you visit websites, they may store or retrieve data in your browser. This storage is often required for basic website functionality. Storage may be used for marketing, analytics and site personalization purposes, such as storing your preferences. Privacy is important to us, so you can disable certain types of storage that may not be necessary for the basic functioning of the website. Blocking categories may affect the performance of the website.

    Manage settings

    Necessary
    Always active

    These cookies are necessary for the website to function and cannot be disabled in our systems. They are usually only set in response to actions you take that constitute a request for services, such as adjusting your privacy settings, logging in, or filling out forms. You can set your browser to block these cookies or notify you about them, but some parts of the site will not work. These cookies do not store any personal information.

    Marketing

    These elements are used to show you advertising that is more relevant to you and your interests. They can also be used to limit the number of ad views and measure the effectiveness of advertising campaigns. Advertising networks usually place them with the permission of the site operator.

    Personalization

    These elements allow the website to remember your choices (such as your username, language or region you are in) and provide enhanced, more personalized features. For example, a website may provide you with local weather forecasts or traffic news by storing data about your current location.

    Analytics

    These elements help the website operator understand how their website works, how visitors interact with the site and whether there may be technical problems. This type of storage usually does not collect information that identifies the visitor.