Phishers are unscrupulous scammers that use domains with content that can compromise one’s login credentials.
In a UDRP case involving the domain name instagram.tel, the Respondent attempted to utilize the domain as an entry point to a password capturing form.
According to the Complainant, Instagram LLC, the domain displayed the following message:
“Due to the large number of unused accounts, inactive accounts will be deleted to provide more space for new users. Please make sure the account is active or the account will be deleted. Click the link and then log out and access the link below to check your Instagram account activity,
http://instagram.tel
Team Support
Instagram corporation
Redmond, WA 98052”
This type of phishing attempt might appear to be basic and “dumb” but statistically, it works, and people lose access to their social media accounts by clicking on links such as this.
The sole panelist at the WIPO ordered the domain instagram.tel to be transferred to the Complainant. Full details on this decision follow.
Instagram, LLC v. Alanazi Ksa, ksa
Case No. D2019-10801. The Parties
The Complainant is Instagram, LLC, United States of America, represented by Hogan Lovells (Paris) LLP, France.
The Respondent is Alanazi Ksa, ksa, Saudi Arabia.
2. The Domain Name and Registrar
The disputed domain name <instagram.tel> (“the Disputed Domain Name”) is registered with CSL Computer Service Langenbach GmbH dba Joker.com (the “Registrar”).
3. Procedural History
The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on May 9, 2019. On May 10, 2019, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Disputed Domain Name. On May 13, 2019, the Registrar transmitted by email to the Center its verification response confirming that the Respondent is listed as the registrant and providing the contact details.
The Center verified that the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).
In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on May 15, 2019. In accordance with the Rules, paragraph 5, the due date for Response was June 4, 2019. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on June 5, 2019.
The Center appointed Jacques de Werra as the sole panelist in this matter on June 14, 2019. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.
Based on the confirmation given by the Registrar, the Registration Agreement relating to the Disputed Domain Name is available both in German and English. Pursuant to paragraph 11 of the Rules, unless otherwise agreed by the parties, the default language of the proceeding is the language of the Registration Agreement, subject to the authority of the panel to determine otherwise.
The Rules do not specify how to determine the language of the proceedings in the case when the registration agreement is in two (or more) languages, which is the case here. The Panel considers as a matter of principle that when the registration agreement is in two (or more) languages, each of those languages can be selected as the language of the proceedings because each of those languages can be considered as “the language of the Registration Agreement” pursuant to paragraph 11(a) of the Rules.
This appears adequate in light of the principles under paragraph 10 of the Rules that the Panel shall conduct the proceeding in a manner it considers appropriate while also ensuring both that the parties are treated with equality, and that each party is given a fair opportunity to present its case.
In addition to these general elements, the Panel considers in this case that the choice of English as the language of the proceedings is appropriate given that the content was previously available in English on the webpage associated with the Disputed Domain Name. This factor can be taken into account by panels in order to choose a language for the proceedings that is not the language of the registration agreement. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), section 4.5.1. By applying it to this case by analogy (knowing that in this case English is one of the two languages of the Registration Agreement), this factor confirms that it is not unfair to conduct the proceedings in English for the Respondent, whereby the Panel notes that the Respondent has not participated in the proceedings and has thus not objected that English be the Language of the Proceedings.
4. Factual Background
The Complainant is a leading online photo and video sharing social networking application (“Instagram”). It was launched on October 6, 2010 and was acquired by Facebook in April 2012. The Complainant has currently over 1 billion monthly active users and 500 million daily active users, with more than 95 million photos and videos shared per day.
The Complainant owns numerous trademark registrations in the term “instagram” in connection with online photo-sharing software which include the following ones (“the Trademark”):
− Saudi Arabia Trademark No. 1436025386, for INSTAGRAM, registered on October 7, 2015;
− European Union Trademark No. 014493886, for INSTAGRAM, registered on December 24, 2015:
− United States Trademark No. 4146057, for INSTAGRAM, registered on May 22, 2012 (first use in commerce on October 6, 2010); and
− International Trademark No. 1129314, for INSTAGRAM, registered on March 15, 2012.Given the exclusive online nature of the Complainant’s business, the Complainant’s domain names consisting of the Trademark are at the heart of its entire business and one critical way for its millions of users to avail themselves of its services. As a result, the Complainant owns and operates many domain names reflecting the Trademark including <instagram.com> and numerous national country code domain names reflecting the Trademark.
The Disputed Domain Name was registered on March 3, 2019. It is currently pointing to a webpage indicating that the website is deceptive with a corresponding message which seems to result from the suspension of the Disputed Domain Name that was requested by the Complainant. The Disputed Domain Name was previously used to point to a webpage having the same “look and feel” as the Complainant’s official login page (available at “www.instagram.com/accounts/login/?source=auth_switcher”).
A link to “www.instagram.tel” was displayed in an English-language message reading as follows:
“Due to the large number of unused accounts, inactive accounts will be deleted to provide more space for new users. Please make sure the account is active or the account will be deleted. Click the link and then log out and access the link below to check your Instagram account activity,
http://instagram.tel
Team Support
Instagram corporation
Redmond, WA 98052”5. Parties’ Contentions
A. ComplainantThe Complainant alleges that the Disputed Domain Name consists of the Complainant’s well-known and distinctive Trademark and that it is generally accepted that the suffix, such as “.tel”, is irrelevant when assessing whether a domain name is identical or confusingly similar to a trademark as it is a functional element. As a result, the Disputed Domain Name is identical to the Complainant’s Trademark.
The Complainant submits that the Respondent has no rights or legitimate interests in the Disputed Domain Name and that in essence the Respondent is unable to invoke any of the circumstances set out in paragraph 4(c) of the Policy, in order to demonstrate rights or legitimate interests in the Disputed Domain Name. The Respondent cannot assert that, prior to any notice of this dispute, he was using, or had made demonstrable preparations to use, the Disputed Domain Name in connection with a bona fide offering of goods or services, in accordance with paragraph 4(c)(i) of the Policy. The Disputed Domain Name was indeed previously used by the Respondent to point to a webpage mimicking the Complainant’s official login page in connection with a phishing scheme that sought to illegitimately collect the account information of Instagram users which obviously cannot constitute a bona fide offering of goods or services. See Instagram, LLC v. Joker Bey, Jokerdayi / Omer Ulku, Takipcizevki, WIPO Case No. D2018-2710.
Given the Complainant’s renown and goodwill worldwide, it would be inconceivable for the Respondent to argue that he did not have knowledge of the Complainant’s Trademark at the time of registration of the Disputed Domain Name in 2019. Furthermore, knowing the previous use made by the Respondent with the website to which the Disputed Domain Name was pointing which had the same “look and feel” as the Complainant’s official login page, the Complainant submits that the Respondent could simply not have chosen the Disputed Domain Name for any reason other than to deliberately cause confusion amongst Instagram users as to the source of the website in order to facilitate his phishing scheme for commercial gain, which clearly constitutes bad faith.
On this basis, the Complainant submits that the Respondent has used the Disputed Domain Name to intentionally attract, for commercial gain, Internet users to its website by creating a likelihood of confusion with the Complainant’s Trademark as to the source, sponsorship, affiliation or endorsement of the website, in accordance with paragraph 4(b)(iv) of the Policy.
B. Respondent
The Respondent did not reply to the Complainant’s contentions.
6. Discussion and Findings
Paragraph 4(a) of the Policy provides that the complainant must prove each of the following three elements in order to succeed in a UDRP proceeding:
(i) the respondent’s domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; and
(ii) the respondent has no rights or legitimate interests in respect of the domain name; and
(iii) the respondent’s domain name has been registered and is being used in bad faith.
A. Identical or Confusingly SimilarThe Panel is satisfied that the Complainant has rights to a trademark or service mark as reflected in the Trademark.
A comparison between the Disputed Domain Name and the Trademark shows that the Disputed Domain Name is identical to the Trademark, whereby the applicable generic Top Level Domain (here “.tel”) shall be disregarded. See WIPO Overview 3.0, section 1.11.1.
As a result, based on the rights of the Complainant in the Trademark and on the identity between the Trademark and the Disputed Domain Name, the Panel finds that the condition of paragraph 4(a)(i) of the Policy is met.
B. Rights or Legitimate Interests
Pursuant to paragraph 4(c) of the Policy, the Respondent may establish rights to or legitimate interests in the Disputed Domain Name by demonstrating any of the following:
(i) before any notice to it of the dispute, the Respondent’s use of, or demonstrable preparations to use, the Disputed Domain Name or a name corresponding to the Disputed Domain Name in connection with a bona fide offering of goods or services; or
(ii) the Respondent has been commonly known by the Disputed Domain Name, even if it has acquired no trademark or service mark rights; or
(iii) the Respondent is making a legitimate noncommercial or fair use of the Disputed Domain Name, without intent for commercial gain, to misleadingly divert consumers or to tarnish the trademark or service mark at issue.
Although the complainant bears the ultimate burden of establishing all three elements of paragraph 4(a) of the Policy, a complainant is required to make out a prima facie case that the respondent lacks rights or legitimate interests, and once such prima facie case is made the burden of production shifts to the respondent to come forward with relevant evidence of rights or legitimate interests in the domain name. WIPO Overview 3.0, section 2.1.
In the Panel’s opinion, the Complainant has made a prima facie case against the Respondent. The Respondent indeed registered the Disputed Domain Name that reflects the Trademark owned by the Complainant without the authorization of the Complainant, in a way that can only reasonably be explained as a reference to the Complainant’s Trademark. The Panel notes that the Disputed Domain Name merely replicates the Trademark which carries a high risk of implied affiliation. WIPO Overview 3.0, section 2.5.1.
The Disputed Domain Name was furthermore previously used by the Respondent to point to a webpage mimicking the Complainant’s official login page in connection with a phishing scheme that sought to illegitimately collect the account information of Instagram users which obviously cannot constitute a bona fide offering of goods or services. See Instagram, LLC v. Joker Bey, Jokerdayi / Omer Ulku, Takipcizevki, WIPO Case No. D2018-2710. See also WIPO Overview 3.0, section 2.5.2.
The Complainant has thus established prima facie that the Respondent has no rights or legitimate interests in the Disputed Domain Name which has not been challenged by the Respondent (even assuming that it could be challenged) who has not participated in the proceedings.
The fact that the Disputed Domain Name has been suspended at the Complainant’s request does not create any rights or legitimate interests in the Disputed Domain Name for the benefit of the Respondent. See by analogy FXCM Global Services LLC v. WhoisGuard Protected, Whoisguard Inc. / Jenny Sohia, WIPO Case No. D2018-1111 (holding that the respondent’s later passive holding of the disputed domain name subsequent to the apparent suspension of the domain name by the Registrar for failure to verify contact details also fails to confer upon respondent any rights or legitimate interests in the disputed domain name).
On this basis, the Panel finds that the Respondent has no rights or legitimate interests in the Disputed Domain Name and that paragraph 4(a)(ii) of the Policy is met.
C. Registered and Used in Bad Faith
Paragraph 4(b) of the Policy states that any of the following circumstances, in particular but without limitation, shall be considered evidence of registration and use of a domain name in bad faith:
(i) circumstances indicating that the respondent registered or acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant (the owner of the trademark or service mark) or to a competitor of the complainant, for valuable consideration in excess of documented out-of-pocket costs directly related to the domain name;
(ii) circumstances indicating that the respondent registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that the respondent has engaged in a pattern of such conduct;
(iii) circumstances indicating that the respondent registered the domain name primarily for the purpose of disrupting the business of a competitor; or
(iv) circumstances indicating that the respondent intentionally is using the domain name in an attempt to attract, for commercial gain, Internet users to its website or other online location, by creating a likelihood of confusion with the complainant’s mark as to the source, sponsorship, affiliation, or endorsement of the respondent’s website or location or of a product or service on its website or location.
The examples of bad faith registration and use set forth in paragraph 4(b) of the Policy are not meant to be exhaustive of all circumstances from which such bad faith may be found. See Telstra Corporation Limited v. Nuclear Marshmallows, WIPO Case No. D2000-0003. The overriding objective of the Policy is to curb the abusive registration of domain names in circumstances where the registrant is seeking to profit from and exploit the trademark of another. See Match.com, LP v. Bill Zag and NWLAWS.ORG, WIPO Case No. D2004-0230.
In this case, the Panel holds that the Respondent registered the Disputed Domain Name in bad faith because the Disputed Domain Name clearly targets the Complainant’s Trademark. Consequently, the choice of the Disputed Domain Name cannot be reasonably explained otherwise than as a reference to the Complainant’s Trademark. The previous use of the Disputed Domain Name for phishing personal information of users of the Complainant by mimicking the appearance of the Complainant’s official website confirms that the Respondent intentionally targeted the Complainant and the Complainant’s Trademark by registering and using the Disputed Domain Name.
This amounts to bad faith registration and use of the Disputed Domain Name. See WIPO Overview 3.0, section 3.1.4 (“[U]se of a domain name for per se illegitimate activity such as the sale of counterfeit goods or phishing can never confer rights or legitimate interests on a respondent, such behavior is manifestly considered evidence of bad faith”). In this respect, the fact that the Disputed Domain Name has been suspended at the Complainant’s request shall not prevent the finding of a bad faith use of the Disputed Domain Name given the implausibility of any good faith use to which the Disputed Domain Name may be put in view of its identity with the Complainant’s Trademark. See by analogy WIPO Overview 3.0, section 3.3 (passive holding supporting bad faith in case of – among various factors – the implausibility of any good faith use to which the domain name may be put).
On this basis, the Panel finds that the Respondent registered and uses the Disputed Domain Name in bad faith pursuant to paragraph 4(b) of the Policy, so that the conditions of paragraph 4(a)(iii) of the Policy are met.
7. Decision
For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Disputed Domain Name <instagram.tel> be transferred to the Complainant.
Jacques de Werra
Sole Panelist
Date: June 27, 2019
