You blockhead! Blockchain domain names can cause big grief

Brand owners are facing many new challenges with the advent of Web3 (a decentralized vision of the Internet built on blockchains and other permissionless networks). One of the most difficult of these involves so-called "blockchain domain names." Unlike traditional domain names, which point to websites, blockchain domain names point to wallets that can hold cryptocurrencies or non-fungible tokens (NFTs). That makes blockchain domain names prime targets for fraud. Even worse, that fraud may be hard to rectify after the fact. That is because unlike traditional domain names, blockchain domain names are difficult to challenge and can be lost forever if not handled carefully from the outset.

Although Web3 is still in its infancy, the permanence (and potential permanent loss) of blockchain domain names means brand owners should be taking steps today to protect and defend their trademarks in this new digital realm. Even for brands that don't currently plan to operate in the Web3 space, securing blockchain domain names can help avoid costly fraud against consumers that can affect a brand's reputation.

Below, we describe both traditional domain names and blockchain domain names in order to highlight their differences, and some strategies for protecting brands in this new digital frontier.

Traditional Domain Names: Enabling Navigation

Domain names make it easier to navigate the Internet. It is a lot easier to remember <google.com> than 142.251.116.100 - which is the internet protocol (IP) address of one of the servers on which Google's homepage resides. If you type that IP address into a web browser, it will take you to the Google homepage, but virtually everyone just relies on the domain name in order to find Google's homepage.

A lot goes on behind the scenes for that domain name to be converted into an IP address and to deliver a website to a user's computer. That work is orchestrated by the Internet Corporation for Assigned Names and Numbers (ICANN), which maintains the Domain Name System (DNS), authorizes the creation of domain names in certain generic top level domains (gTLDs, such as .com or .shop), designates registries to manage the domain names within each gTLD (such as Verisign, for the .com gTLD), and authorizes registrars (like GoDaddy) to sell registrations of domain names to companies and individuals. One important feature of the DNS is that ownership of domain names is inherently temporary: Domain names are leased (even if on a very long-term basis), not owned.

Most brand owners are very familiar with the need to renew their domain name registrations, and many also are familiar with how to handle cybersquatters who register confusingly similar domain names in order to scam unwitting Internet users. One option is recourse to the Uniform Domain-Name Dispute-Resolution Policy (UDRP), which is an expedited, efficient administrative procedure for resolving claims of abusive registration of domain names. Another option is to file suit in court, such as for trademark infringement or dilution, or for breach of contract or conversion, or for violation of Section 43(d) of the Lanham Act - also known as the Anticybersquatting Consumer Protection Act (ACPA) - which provides a cause of action for registering, trafficking in, or using a domain name that is confusingly similar to or dilutive of a trademark. A plaintiff usually can file suit in court only if the court has personal jurisdiction over the defendant, but the ACPA does allow for in rem jurisdiction over a "domain name" directly, as a piece of property, if the registrar or registry is subject to U.S. jurisdiction (such as Verisign, which is based in Virginia, or GoDaddy, which is based in Arizona).

These two different mechanisms - the UDRP and the ACPA - provide trademark owners with clear mechanisms to combat cybersquatting and trademark infringement in connection with a traditional domain name. In the last twenty years, more than one hundred thousand domain name disputes successfully have been resolved under these mechanisms.

Blockchain Domain Names: Enabling Payments

Blockchain domain names are superficially similar to traditional domain names in their look (e.g., <google.eth>), but they function differently in important ways. Unlike a traditional domain name (e.g., "google.com") that is converted into an IP address to navigate to a website, a blockchain domain name points to a blockchain wallet to which people can send or store valuable digital assets like cryptocurrency or NFTs. Because ordinary blockchain wallet addresses are even more difficult to memorize than IP addresses, blockchain domain names can help streamline transactions, and provide brands with an easy way to identify themselves to consumers who are sending digital assets. A customer could send their digital assets to a simple blockchain domain name (like "google.eth") rather than a complex anonymous wallet address (like 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa, which is the wallet address believed to be holding Satoshi Nakamoto's bitcoins).

Unlike traditional domain names, most blockchain domain names are permanent, not leased. At a technical level, for those blockchain domain names that point to digital wallets, the blockchain domain name is stored as an NFT in the domain name owner's wallet - that NFT tells transaction services what wallet is associated with the blockchain domain name (much in the same way that ICAAN's root server identifies which traditional domain name is associated with each IP address).

Just because the blockchain domain name incorporates a famous brand name does not mean that it was created by, or is owned by, that brand. That is because anyone can buy a blockchain domain name as long as it is not already owned. A recent analysis identified thousands of blockchain domain names incorporating prominent brand names like Apple, Amazon, and Google, which almost certainly are not all owned by those brand owners. (Alex Deacon, DNS Research Foundation: "Brand Names in Blockchain Domains: New Frontier for Brand Owners" (Mar. 23, 2023).) Even worse, once the name is purchased and distributed to the owner, there are significant hurdles to a brand owner's ability to recapture that name for itself.

Blockchain domain names' ease of use, coupled with their ability to receive payments, makes them an ideal target for bad actors seeking to commit fraud or otherwise siphon goodwill from legitimate companies. A payment scam can look much more legitimate when it uses a well-known brand or trademark as the wallet address. Imagine, for example, in the week after a company launches a new NFT project, some scammers create a <brand.eth> wallet address and start sending phishing emails asking people to send cryptocurrency to that wallet if they want to participate in the NFT launch. If any consumers fell for the scam, it would be nearly impossible to get their funds back, given the permanent nature of blockchain transactions. Because the scammed consumers will no doubt be angry at the company itself (even though it had nothing to do with the scam), brand owners need to be proactive. They need to understand this new arena for infringement and take preemptive steps to protect their valuable trademarks from being misused.

Blockchain domain names are not offered by traditional Internet registrars, and are not available on traditional Internet registries. At this time, there are two primary naming services selling blockchain domain names - Unstoppable Domains, which offers blockchain domain names with extensions including ".crypto", ".nft", and ".bitcoin", and Ethereum Name Service ("ENS"), which offers blockchain domain names with the extension ".eth". To date, Unstoppable Domains has over 3.4 million names registered, while ENS has over 2.7 million. The actual terms of ownership for blockchain domain names will vary depending on the naming service used. For example, Unstoppable Domains does not require any renewals of blockchain domain names, but ENS requires periodic renewals.

Unlike traditional domain names, blockchain domain names are not subject to ICANN's DNS-related rules or the UDRP. So trademark owners cannot take advantage of these well-established procedures to combat bad-faith cybersquatting and trademark infringement arising from use of trademarks in connection with blockchain domain names.

It is also far from clear that blockchain domain names are within the ACPA's statutory definition of "domain name," which courts have construed narrowly. Courts have, for example, prohibited use of the UDRP to challenge third level parts of a URL (for example, it was not possible to use the ACPA to challenge "GOFORIT" in the domain name <goforit.org>) because that part of the URL was not registered through a standard registrar. Goforit Entertainment, LLC v. Digimedia.Com L.P., 750 F. Supp. 2d 712 (N.D. Tex. 2010). Courts may similarly decline to reach objectionable parts of a blockchain domain name because they are not registered through ordinary Internet registrars. And, even if courts might apply the ACPA in blockchain domain name disputes, the ACPA's valuable in rem cause of action works only if the blockchain domain name itself (the res) is subject to jurisdiction in U.S. courts. Naming services may not be located in the United States (ENS, for example, is run out of Singapore) and do not use centrally located servers, and, in any event, often do not even have the ability to reverse a blockchain domain name that has already been purchased.

Protecting Against Infringing Blockchain Domain Names

This challenging landscape does not mean that all enforcement options are foreclosed. Trademark owners can pursue traditional litigation claims pursuant to Sections 43(a) and 43(d) of the Lanham Act, seeking to stop an infringing use of their trademark. But potential difficulties abound. If you notify an infringing blockchain domain name owner of a claim against them, they might respond by "burning" the domain name. "Burning" refers to transferring the domain name NFT to a wallet that is inaccessible by anyone, thereby removing the domain name from circulation and use (even though it technically still exists on the blockchain). Burning a blockchain domain name might put an end to fraudulent use, but it is not an ideal solution because, since the domain name still exists on the blockchain, it is foreclosed in the future as an option to any businesses that may be interested in using it.

Even if a trademark owner were able to identify the relevant blockchain domain name owner, locate a U.S. court with jurisdiction over that owner, file and serve a lawsuit, and obtain a judgment, remedies may be limited. For matters where the court has personal jurisdiction over the defendant, a court might be able to order the defendant to transfer the blockchain domain name to the plaintiff. But if the court does not have the ability to control the defendant's activities, the only recourse may be to third parties, such as the naming service. Those services, though, typically cannot transfer the name; the most they generally can do is burn it.

As an alternative to litigation, companies may try to rely on the blockchain domain name companies' takedown procedures. However, ENS and Unstoppable Domains do not offer clear takedown procedures. ENS has not yet offered any guidance on how trademark owners can respond to infringement via its service. Unstoppable Domains offers a dispute mechanism, but it only works in a narrow window. If a brand owner can prove its ownership of a relevant trademark after a blockchain domain name incorporating that mark has been sold but before it has been distributed, Unstoppable Domains will reimburse the third-party purchaser and stop distribution. But if a blockchain domain name has already been distributed, there is nothing Unstoppable Domains can do to transfer that domain name to a purported trademark owner.

For now, in the absence of clear enforcement options, some companies are pursuing self-help by rushing to purchase blockchain domain names that contain or are similar to their trademarks. Others are using Unstoppable Domains' "Protected Brands" service, through which Unstoppable Domains scans for and identifies names potentially incorporating trademarks. Identified domains can thereafter be purchased by a third party only upon proof of rights to the corresponding trademarks. Although this service won't resolve trademark-related disputes after the names are distributed, it does help prevent them in the first instance.

In the future, we expect litigation to probe the boundaries of the Lanham Act's definition of "domain name," which may help clarify whether the ACPA can be used in blockchain domain name disputes. It also is possible that naming services will develop more robust enforcement procedures, or that a more centralized regulation of blockchain domain names will be adopted, even though such centralization would be contrary to some of the principles of Web3. Unless and until some standardized system is developed, trademark owners will often face an uphill battle in protecting and enforcing their rights against infringing activity in this new and changing landscape. Right now, the best defense is a good offense: We recommend that companies register blockchain domain names using their key trademarks before bad actors get to them first.

David H. Bernstein and Megan K. Bannigan are partners, and Christopher S. Ford is counsel at Debevoise & Plimpton LLP.