MediSpa Maui fell victim to a common cyberscheme last month after an overseas internet user acquired the company’s domain name, posted explicit images on the site and offered to sell it back to the company for $9,700, all within legal bounds.

The Kihei-based skin care and laser center has since changed its website to medispamaui.net and is spreading a cautionary tale for other businesses.

“We work so hard to have a reputable business that is strategically placed on Google Analytics due to our patient following,” Chief Operating Officer Corey Pearson said last week. “This person is getting a highly ranked website It’s really unfortunate. They know enough about the law to go in and extort it.”

On April 28, a former staff member alerted the business that its previous website, medispamaui.com, had been plastered with pornographic content. Pearson said that the company had been receiving multiple spam emails in the days leading up to the discovery. A few of the emails appeared to be from Chinese government officials claiming that someone was trying to register the company’s website in China. Other emails said that the domain name registration was soon to expire. Mainland consultants told the company to dismiss what appeared to be a load of spam, Pearson said.

Meanwhile, the domain expired and was purchased by someone named Al Perkins, who told Pearson it would cost $9,700 to regain ownership of the domain. She offered him $500, but Perkins called it a “derisory offer” in email correspondence and told Pearson not to contact Perkins again.

Wild West Domains, where the website is registered, shows that medispamaui.com has been registered to Perkins since April 27. The listed address is for a street in St. Helier on the island of Jersey, a British crown dependency off the northern coast of France.

Perkins could not be reached for comment. However, after pulling a similar move on a Chamber of Commerce website for a British Columbia town in January, Perkins told the Canadian news outlet National Post that it was “just pure business and that’s it, nothing personal.”

It’s a strategy called “cybersquatting,” said Debasis Bhattacharya, director of the Center for Cybersecurity Education and Research at the University of Hawaii Maui College. Businesses can purchase domain registrations for long periods of time, but “they’re not forever.” Since registration information is public on websites that authorize domains, anyone can sit and wait for a domain to expire, snap it up and demand a sum from the original owners, all a legal process, he said.

“To use this as a technique to extort or slander or defame, that’s the illegal part,” Bhattacharya said.

In 2015, more than 2,700 cases of cybersquatting were filed with the World Intellectual Property Organization. Perkins has been cited in numerous dispute cases. In 2014, the WIPO forced Perkins to give up the website collliers.com, which was found to be deliberately similar to global real estate website colliers.com.

However, proving defamation or slander is no easy matter, Wailuku attorney Tony Takitani said.

“You’ve got to prove intent. You’ve got to prove somebody intended to do harm,” Takitani said. “If the content was directed at (MediSpa), it would be a different story. But if it’s just vulgar or obscene, I don’t think so.”

As for whether it could qualify as extortion in court, Takitani didn’t think so because Perkins owns the website, making it essentially a business transaction, he said.

Bhattacharya said it’s important for businesses not to pay in these cases “because this perpetuates the issue.”

“These are people that try to serially extort from businesses,” he said.

After its hard lesson, MediSpa is reminding others of the importance of web domain renewal. Pearson said that she didn’t know the domain was expiring. She added that the company was in the process of switching web developers and hadn’t decided whether to renew the domain or not.

MediSpa’s IT team quickly transferred data to the new website, and no patient data was affected, Pearson said. However, the scheme will cost the business thousands of dollars to reprint business cards and brochures with the new web address.

“We want to let people know these things are real,” Pearson said. “Even though we’re in a protected island community, people are patrolling the internet for vulnerabilities.”

* Colleen Uechi can be reached at cuechi@mauinews.com.