The Complainant has, to the satisfaction of the Panel, shown the disputed domain name has been registered and is being used in bad faith within the meaning of paragraph 4(a)(iii) of the Policy.
There are two elements that must be satisfied – registration and use in bad faith.
The evidence shows, and the Panel accepts, that the Complainant’s trademark “NOVARTIS” is well known all around the world. The Complainant’s trademark was clearly registered prior to the registration of the disputed domain name.
The disputed domain name currently appears to be suspected of phishing activity. The Panel accepts and finds that the uncontradicted facts show that the disputed domain name is or was being used as a phishing website. The disputed domain name website is currently suspended by Public Domain Registry because of the suspected phishing activity as notified by the Complainant’s e-mail dated January 27, 2022 to Public Domain Registry.
As already stated by other Panels, “phishing is a form of Internet fraud that aims to steal valuable information such as credit cards, social security numbers, user Ids, passwords, etc. A fake website is created that is similar to that of a legitimate organization, typically a financial institution such as a bank or insurance company and this information is used for identity theft and other nefarious activities”. See Halifax Plc. v. Sontaja Sanduci, WIPO Case No. D2004-0237 and also CarrerBuilder LLC v. Stephen Baker, WIPO Case No. D2005-0251.
The Panel considers that for the purpose of satisfying paragraph 4(a)(iii) of the Policy, “use of a disputed domain name for the purpose of defrauding Internet users by the operation of a phishing website is perhaps the clearest evidence of registration and use of a domain name in bad faith”. See WIPO Case No. D2012-2093, The Royal Bank of Scotland Group plc v. Secret Registration Customer ID 232883 / Lauren Terrado.
The Panel has previously stated that it is now established that UDRP jurisprudence considered phishing attacks as “proof of both bad faith registration and use in bad faith”. See WIPO Case No. D2006-0614, Grupo Financiero Inbursa, S.A. de C.V. v. inbuirsa, where the finding was that: “The Respondent registered the domain name because in all probability he knew of the Complainant and the type of services offered by the Complainant and tried to attract Internet users for commercial gain by “spoofing” and “phishing”. The Panel notes that these are practices which have become a serious problem in the financial services industry worldwide. This is a compelling indication both of bad faith registration and of use under paragraph 4(b)(iv)”. See also Finter Bank Zürich v. N/A, Charles Osabor, WIPO Case No. D2005-0871 and Banca Intesa S.p.A. v. Moshe Tal, WIPO Case No. D2006-0228, that directly involves the Complainant.
In the present case, given the Complainant’s world-wide reputation, it is highly unlikely that the Respondent did not know of the Complainant’s trademarks and business when it registered the disputed domain name, and the use of the disputed domain name as a phishing website clearly amounts to use in bad faith. Indeed, the manner in which the letters were altered or added to confuse consumer suggest that the Respondent knew or ought to have known about the Complainant and its trademark when it registered the disputed domain name.
Accordingly, the Panel accepts that the disputed domain name was registered by the Respondent and used in bad faith.
|