What do you propose they do? Purchasing the .com for well-known software is prohibitively expensive, especially for FOSS projects. You could attempt a UDRP, but

What do you propose they do? Purchasing the .com for well-known software is prohibitively expensive, especially for FOSS projects. You could attempt a UDRP, but that’s also prohibitively expensive. To suggest that inability to do anything—or even indifference, as you characterize your argument in a later comment—implies they’re “in on it” is simply illogical. There’s no evidence of KeePass developers being involved here, and it’s quite unlikely that they are. Short of using their own money—thousands of dollars—to hire a lawyer, there’s not much they can do. Rebranding doesn’t really make sense. People are going to keep searching for and suggesting KeePass for a long time after the rebrand. It’s too established for them to pull that off; they’d end up driving even more people into the hands of malicious actors. When people search for KeePass, being unaware of the rebrand, they’ll inevitably stumble upon nefarious websites purporting to be KeePass. It just amplifies the problem.