I registered a domain name with a client's trademarked name in it as part of an authorized penetration test of that client a few years ago. At the end of the test, I asked if they wanted me to transfer it to them, and they didn't. A year later, when it expired and the domain privacy stuff went away, all of that automated enforcement machinery started running, and suddenly I was being threatened with all sorts of arbitration/court appearances if I didn't transfer the domain (which I no longer owned) to them. Took weeks to sort out, and that was with documentation that I'd bought the domain as part of a pen test the client had specifically agreed to.