December 17, 2021

How AirBnB contributed to it's domain being stolen

Article Headline Image (12)

Airbnb is the world-famous platform that allows hosts to rent their rooms or houses to travellers from around the world. During 2017 Airbnb bought the social payments start up Tilt. The acquisition included the domains crowdtilt.com and tilt.com

It appears that Airbnb, after the acquisition, did not update the Whois information for those two domains. The archived registrant information of Tilt.com is shown below. 

Registrant Name: Tilt.com, Inc 

Registrant Organization: Tilt.com, Inc 

Registrant Street: 370 TOWNSEND ST 

Registrant City: SAN FRANCISCO 

Registrant State/Province: CA 

Registrant Postal Code: 94107-1607 

Registrant Country: us 

Registrant Phone: 118669712365 

Registrant Email: tech@crowdtilt.com 

The domain crowdtilt.com was then allowed to lapse, later snapped up by a third party. The new domain owner then set up the email address tech@crowdtilt.com, which allowed him to gain access to Tilt.com ultimately transferring the domain away from Airbnb. 

The matter did not sit well with Airbnb so they filed a UDRP complaint to recover the domain but failed in its attempt.  

The Panelist denied the complaint on the ground that Airbnb did not meet its burden of proof of bad faith registration and use. 

The Panelist went on to say that the UDRP is designed to deal with clear cases of cybersquatting but “not intended to thwart every sort of questionable business practice imaginable.” In short, the UDRP was the incorrect forum to address the theft of the domain. 

However, the Panelist did make a controversial statement that the Respondent was the escrow agent and acquired the domain in that capacity thus lacked bad faith. This could create an absurd situation that a Respondent’s defence is merely that they are acting as an escrow agent or holding the domain in trust. The vast majority of domains that infringe trade marks make use of a privacy service, which is essentially a trust service. 

What could Airbnb have done differently?  

They should have: 

  • Transferred the Tilt domains to their corporate registrar so they could be managed centrally.
  • Updated the Whois information, which includes the domain registrant email address.
  • Considered a different forum to recover the domain as the domain has generic elements (tilt is a descriptive term) and its acquisition had a criminal aspect.

Acquisitions occur all the time and the timeframes for integrating acquired assets can take time, however domains are mostly renewed annually and the risk of losing them in such a transaction are high. We strongly suggest that they be assigned a higher importance. 

If you are concerned about your domains or merely want to know if your domains are at risk please reach out to us.