The online vacation rental marketplace Airbnb has recently failed to win a cybersquatting case in an attempt to recover the premium domain name, Tilt.com, that was snagged from the company.

However, this isn’t a case of a domain registrant forgetting to renew a domain name. The story behind this case actually involves a clever online thief who noticed a pretty big oversight on Airbnb’s part.

Back in 2017, Airbnb acquired Tilt, a once-promising crowdfunding startup that previously went by the name Crowdtilt. Along with Airbnb’s acquisition of the company came two domain names: Tilt.com and Crowdtilt.com.

Fast forward to 2021. Earlier this year, the domain Crowdtilt.com sold on the domain name aftermarket to an unknown buyer for more than $17,000 after it expired.

Why did the domain name sell for so much? It could have had significant SEO value due to all the links and press mentions it received when Crowdtilt was a flourishing upcoming tech startup. However, it appears that the buyer may have noticed something even more valuable: Airbnb had failed to update the registrant information for Tilt.com after it acquired the company.

As domain industry blog DomainGang pointed out when the domain was first reported stolen over the summer, the email that the Tilt.com domain name was attached to was tech@crowdtilt.com. By purchasing the Crowdtilt.com domain, the thief gained access to the “tech@crowdtilt.com” email address. Next, they reset the registrar password in order to gain unauthorized control over Tilt.com.

In July 2021, the thief attempted to sell Tilt.com to James Booth, a well-known domain name investor, on the aftermarket.

It’s unclear how much the investor had intended to spend on Tilt.com. A short, four-letter dictionary word with a .com domain name could fetch top dollar. Remember, the thief apparently spent $17,000 on Crowdtilt.com in order to carry out the theft of Tilt.com.

The deal between the thief and the domain investor was almost complete. The two parties went so far as to enter into a transaction on Escrow.Domains, a third-party escrow service, before reports of the domain name being stolen from Airbnb spread.

Escrow services act as a middleperson between buyer and seller for large transactions. In a domain name escrow, the seller would send the domain name to the escrow service before receiving money from the buyer. The transaction was so far along that the law firm that runs Escrow.Domains now holds the Tilt.com domain.

According to domain news outlet Domain Name Wire, the firm has been working on returning the domain to Airbnb since July. However, there’s been a disagreement in the settlement between Airbnb and the law firm over legal fees involved with the matter.

So, Airbnb filed a UDRP dispute against the lawyers in September. UDRP is the official process dealing with instances of cybersquatting by the Internet Corporation for Assigned Names and Numbers (ICANN), the organization setup to govern the global domain name system.

But, Airbnb lost the suit because UDRP is not set up to deal with instances of theft.

It appears Airbnb will eventually regain ownership of Tilt.com. But the whole ordeal could have been avoided if it just renewed Crowdtilt.com or kept Tilt.com’s whois information up to date.

The morale of the story: Make sure you actually have control of the email address connected to your domain name.

Mashable has reached out to Airbnb for comment and we’ll update this post if we hear back.