Decision for dispute CAC-UDRP-102687

The Panel is not aware of any other pending or decided legal proceedings that relate to the disputed domain name.

The Complainant Universal Music Group Holdings, Inc. ("UMG Holdings") submitted evidence that it is the registered owner of the following trademark registrations:

(i) U.S. trademark registration No. 5,165,973 for UMG in standard characters covering a wide range of music-and-entertainment related services in class 41, registered on 21 March 2017 and used as a mark since 1996.

The Complainant UMG Recordings, Inc. ("UMG") submitted evidence that it is the registered owner of the following trademark registrations:

(i) U.S. trademark registration No. 2,589,720 for UMG SOUNDTRACKS (illustration drawing) covering a wide range of music-and-entertainment related goods and services in classes 9 and 41, registered on 2 July 2002 and used as a mark since 2001; and

(ii) U.S. trademark registration No. 4452500 for UMUSICHD (illustration drawing) covering music-and-entertainment related services in class 41, registered on 17 December 2013 and used as a mark since 2012.

In addition to the registered trademarks, the Complainant further submits that it owns common law rights in UMUSIC EXPERIENCE covering its goods and services related to bringing today's hottest artists and industry execs to college students.

The Complainant UMG Holdings is the parent company of the Complainant UMG. Both belong to the same common corporate structure, the Universal Music Group, which trades under the "UMG" name. Both Complainants have a common interest that is affected by the Respondent's conduct. Furthermore, UMG Holdings and UMG each own the relevant rights, and for many years its respective predecessors-in-interest and licensees have continuously used and are currently using the UMUSIC and UMG marks relied on for purposes of standing in this proceeding. Both Complainants are further referred to as the "Complainant".

The Complainant is the world leader in music-based entertainment, with a broad array of businesses engaged in recorded music, music publishing, merchandising and audio-visual content in more than 60 countries. Featuring the most comprehensive catalogue of recordings and songs across every musical genre, UMG identifies and develops artists and produces and distributes the most critically acclaimed and commercially successful music in the world. Committed to artistry, innovation and entrepreneurship, UMG fosters the development of services, platforms and business models to broaden artistic and commercial opportunities for its artists and creates new experiences for fans.

The Complainant states that there are about one hundred and eighty-three thousand Google search results for "umusic experience" and all of the results on the first page relate to the services of Complainant. There are thousands of references to Complainant's UMUSIC EXPERIENCE goods and services on websites other than Complainant's UMUSIC Experience Site. By 2018, the Complainant alleges to have already supported over four hundred artists across the U.S., promoted more than three thousand five-hundred tour dates and reached students on more than three hundred college and university campuses.

For many years, Complainant has continuously used, and is currently using UMG and UMUSIC, both standing alone and as the dominant element in composite marks such as UMUSICHD and UMUSIC EXPERIENCE. Complainant's UMG and UMUSIC Marks have become associated exclusively with the Complainant and its goods and services. Consumers have come to rely on these marks to identify Complainant's goods and services and to distinguish them from the goods and services of others.

Complainant maintains a digital "sign-in" page for its authorised users on its <umgconnect.umusic.com> domain name, which was first registered in 1997 ("SSO Domain").

The disputed domain name was created on 8 January 2019. In February 2019, the Complainant notified an abuse point of contact (POC) responsible for hosting some of the cyber infrastructure connected to the disputed domain name that there were specific indicators that the infrastructure was set up specifically to support harmful cyber activity (i.e., exfiltration of personal data and sensitive credentials). The Complainant requested an investigation. A few days later, the disputed domain name no longer existed in the Domain Name System (DNS), and the abuse POC stated that the customer disconnected the disputed domain name. The Respondent still has control over the disputed domain name to re-connect it to the DNS, and the Complainant has to continuously monitor its status given the harm that may result from the Respondent attempting to spoof the Complainant's SSO Domain to exfiltrate personal data and sensitive credentials of its authorised users. The Complainant further states that the disputed domain name was being used before it was disconnected from the DNS to set up hostnames on a malicious IP (e.g., auth.umgconnect-umusic.com) for harmful cyber operations as part of activity that depends on social engineering and technical subterfuge to spoof single sign-on (SSO) access or a Security Token Service (STS) key component to exfiltrate personal data and sensitive credentials.

On 3 October 2019, the Registrar of the disputed domain name (PUBLIDOMAINREGISTRY.COM) confirmed the Respondent as the current holder of the disputed domain name and also confirmed that the language of the registration agreement is English.

NO ADMINISTRATIVELY COMPLIANT RESPONSE HAS BEEN FILED.

The Complainant made the following contentions:

With respect to identical or similar domain name, the Complainant asserts that the disputed domain name incorporates the entirety or a dominant feature of both Complainant's UMG and UMUSIC Marks. Each is recognizable within the disputed domain name. The Respondent added the descriptive word "connect" to the UMG Mark (the "UMG Component") and separated the UMG Component from the UMUSIC Mark with a hyphen. The legacy gTLD "COM" is immaterial to the analysis as it has no distinguishing capabilities under the first element of the Policy. The disputed domain name is substantially indistinguishable from the Complainant's SSO Domain. Adding a second trademark belonging to Complainant to one of Complainant's marks does not negate the confusing similarity between the disputed domain name and each of the marks standing alone, but only reinforces the association with Complainant.

Regarding Respondent's rights or legitimate interests, the Complainant argues that not only is the Respondent not commonly known by the disputed domain name (as evidenced by the registrar verification response), but the Complainant has not authorized, licensed, or otherwise permitted the Respondent to use any of its marks. The Respondent has no legitimate interest in creating a domain name that is substantially indistinguishable from the Complainant's sign-in page. It capitalizes on the reputation and goodwill of the UMG and UMUSIC Marks to mislead Internet users. The Respondent also has no legitimate interest in re-connecting the disputed domain name to the DNS or passively holding on to it once it was disconnected. The Respondent has no legitimate interest in having used or in attempting to re-use the disputed domain name for cyber infrastructure, including as hostnames, needed to carry out harmful cyber activity, specifically that relies on such social engineering and technical subterfuge to spoof single sign-on (SSO) access or a Security Token Service (STS) key component to exfiltrate personal data and sensitive credentials.

Turning to the bad faith argument, the Complainant asserts that the disputed domain name was registered in bad-faith for Web SSO phishing activity on 18 January 2019 — well after the UMG and UMUSIC Marks became associated with the Complainant's goods and services. The disputed domain name was used as part of setting up harmful cyber infrastructure, specifically creating various hostnames on the disputed domain, which was then connected in the DNS to a server along with other maliciously registered domains to be used for Web SSO phishing. By using the disputed domain name as part of its cyber infrastructure to support SSO-phishing activity in this way, the Respondent intentionally attempted to attract, for commercial gain, Internet users to the Respondent's server used for SSO-phishing, by creating a likelihood of mistake as to the source of the Respondent's hostnames created on the disputed domain name and connected to its server. Based on the evidence that the Respondent used the disputed domain name as part of its cyber infrastructure to support SSO-phishing activity, the Respondent has registered and used the disputed domain name in bad faith. The Complainant contends that it is well-established that none-use currently of the disputed domain name does not prevent a finding of bad faith under the doctrine of passive holding. Finally, the fact that the Respondent has not to the Complainant's knowledge attempted to re-connect the disputed domain name to the DNS, and that it is presently inactive, suggests that the Respondent, who was certainly aware of the Complainant's rights as evidenced by the combination of both the UMG and UMUSIC Marks belonging to the Complainant in one domain name that is substantially indistinguishable from the Complainant's SSO Domain, could not think of any use of the disputed domain name that would not be an attempt to profit from the deliberate attempt to confuse the Complainant's authorized users.

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights (within the meaning of paragraph 4(a)(i) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the Respondent to have no rights or legitimate interests in respect of the disputed domain name (within the meaning of paragraph 4(a)(ii) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name has been registered and is being used in bad faith (within the meaning of paragraph 4(a)(iii) of the Policy).

It has been established that the Rules for Uniform Domain Name Dispute Resolution Policy allow consolidation of multiple domain name disputes and that it is generally possible for multiple complainants to bring a complaint against a single respondent. Circumstances that typically allow for such consolidation are (i) that the multiple complainants have a specific common grievance against the respondent, or the respondent has engaged in common conduct that has affected the complainants in a similar fashion, and (ii) that it would be equitable and procedurally efficient to permit the consolidation (see 4.11.1 of WIPO Overview 3.0). The Panel finds that both the Complainant UMG Holdings and the Complainant UMG have common grievance against the Respondent, that the Respondent engaged in common conduct that has affected both Complainants in a similar fashion, and that it would be equitable and procedurally efficient to permit the consolidation.

The Panel is therefore satisfied that all procedural requirements under UDRP were met and there is no other reason why it would be inappropriate to provide a decision.

This is a proceeding pursuant to Paragraph 4 of the Uniform Domain Name Dispute Resolution Policy ("Policy" or "UDRP"), the Rules for Uniform Domain Name Dispute Resolution Policy ("Rules") and the CAC Supplemental Rules.

Paragraph 15 of the Rules provides that the Panel shall decide the complaint on the basis of the statements and documents submitted and in accordance with the Policy, the Rules and any rules and principles of law that it deems applicable.

According to Paragraph 4 (a) of the Policy, the Complainant must prove each of the following: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights; (ii) the Respondent has no rights or legitimate interests in respect of the disputed domain name; (iii) the disputed domain name has been registered and is being used in bad faith.

A. Identical or confusingly similar domain name

The Complainant demonstrated that it owns trademark registrations for the marks "UMG", "UMG SOUNDTRACKS" and "UMUSICHD" in the United States of America. It has been well established in UDRP proceedings that a nationally registered trademark confers on its owner sufficient rights to satisfy the requirement of having trademark rights for the purposes of standing to file a UDRP case.

The Complainant further asserted unregistered (common law) rights in the mark "UMUSIC EXPERIENCE" in connection with goods and services related to bringing today's hottest artists and industry execs to college students. It has been consistently decided in UDRP cases that in order to establish unregistered or common law trademark rights pursuant to Paragraph 4 (a) (i) of the Policy, the complainant must show that its mark has become a distinctive identifier which consumers associate with the complainant's goods and/or services. The Complainant demonstrated evidence that: (a) there are about one hundred and eighty-three thousand Google search results for "umusic experience" and all of the results on the first page relate to the services of the Complainant; and (b) there are thousands of references to the Complainant's UMUSIC EXPERIENCE goods and services on websites other than the Complainant's UMUSIC Experience website. The Complainant also claimed, and the Panel has verified, that its umusic.com domain name was registered already in 1997. Consequently, the Panel has been satisfied that the Complainant's unregistered (common law) mark satisfies the requirements for the purposes of standing to file a UDRP case.

Therefore, the Panel finds that the Complainant has established such (registered as well as unregistered) rights.

It is also well established that the generic top-level suffix .com may be disregarded when considering whether a disputed domain name is confusingly similar to a trademark in which the Complainant has rights.

The disputed domain name is made by a combination of the words "umgconnect" and "umusic" that are connected by a hyphen. The first three letters of the word "umgconnect" are identical to the Complainant’s UMG trademark whereas the word “connect” has, in general, very low distinctiveness for services provided on the Internet. The word "umusic" is contained in its entirety in the Complainant's UMUSICHD trademark and forms a very distinctive element of the UMUSIC EXPERIENCE unregistered mark. The Panel has therefore concluded that the disputed domain name contains both the UMG and the UMUSIC elements which are both distinctive features of the Complainant’s UMG, UMG SOUNDTRACKS and UMUSICHD registered trademarks as well as UMUSIC EXPERIENCE unregistered mark. The Panel does not believe that the word "connect" would sufficiently differentiate the disputed domain name from the rights asserted by the Complainant. The Panel has also concurred with the Complainant in its argument that adding a second trademark belonging to Complainant to one of Complainant's trademarks does not negate the confusing similarity between the disputed domain name and each of the trademarks standing alone, but only reinforces the association with the Complainant.

The Panel took note of the fact that the disputed domain name <umgconnect-umusic.com> is almost identical to the domain name used by the Complainant <umgconnect.umusic.com>.

The Panel, therefore, finds that the disputed domain name is confusingly similar to the trademark(s) or service mark(s) in which the Complainant has rights.

B. Lack of rights or legitimate interests

The Complainant argues that the Respondent is not commonly known by the disputed domain name and that the Complainant has not authorized, licensed, or otherwise permitted the Respondent to use any of its marks. Furthermore, the Complainant submits that the Respondent has also no legitimate interest in creating a domain name that is substantially indistinguishable from its domain name <umgconnect.umusic.com> used as a sign-in page to its online service and that capitalizes on the reputation and goodwill of the UMG and UMUSIC Marks to mislead Internet users. Lastly, the Complainant alleges that the Respondent has no legitimate interest in having used or in attempting to re-use the disputed domain name for cyber infrastructure, including as hostnames, needed to carry out harmful cyber activity.

The Respondent has not filed a Response and there is no evidence that the Respondent has used or has been preparing to use the disputed domain name in connection with a bona fide offering of goods or services, that the Respondent would be commonly known by the disputed domain name, nor that the Respondent has made any legitimate non-commercial or fair use of the disputed domain name, without intent for commercial gain.

Therefore, the Panel is satisfied that the Complainant has made out a prima facie case and finds that the Respondent has no rights or legitimate interest in the disputed domain name.

C. Registration and use of the disputed domain name in bad faith

With respect to the bad faith argument, the Complainant mainly states that the disputed domain name was registered for Web SSO phishing activity on 18 January 2019, well after the Complainant's registered and unregistered trademarks became associated with its goods and services. The Complainant further argues that the disputed domain name was used as part of setting up harmful cyber infrastructure, specifically creating various hostnames on the disputed domain, which was then connected in the DNS to a server along with other maliciously registered domains to be used for Web SSO phishing. The Complainant further contends that it is well-established the none-use of the disputed domain name does not prevent a finding of bad faith under the doctrine of passive holding.

It is well established that mere registration of a domain name that is confusingly similar to a widely-known trademark by an unaffiliated entity can lead to the presumption of bad faith. Furthermore, typical circumstances demonstrating respondent's bad faith include a situation where the respondent has registered the domain name primarily of the purpose of disrupting the business of a competitor and where the respondent has intentionally attempted to attract, for commercial gain, Internet users to its website or other on-line location by creating a likelihood of confusion with the complainant's mark or its products or services on the respondent's website or location.

The Panel has found that the disputed domain name is confusingly similar to the Complainant's UMG, UMG SOUNDTRACKS and UMUSICHD registered trademarks as well as UMUSIC EXPERIENCE unregistered mark. The Panel has also taken note of the fact that the disputed domain name <umgconnect-umusic.com> is almost identical to the domain name used by the Complainant <umgconnect.umusic.com> as a digital "sign-in" page for its authorized users. Lastly, according to general knowledge as well as evidence submitted by the Complainant, the Universal Music Group is a world-leading music company and its marks are therefore widely known. Therefore, the Panel has come to the conclusion that the Respondent knew or should have known that its registration of the disputed domain name will interfere with the Complainant’s rights and legitimate interests.

Upon review of the submitted evidence, the Panel is convinced that the Respondent used the disputed domain name as part of its cyber infrastructure to support SSO-phishing activity. The Panel is also convinced that the fact that the disputed domain name is currently inactive cannot change the overall finding of this Panel due to the doctrine of "passive holding" (see eg. CAC Case No. 102312).

In the absence of any Response by the Respondent, there seems to be no reasonable explanation whatsoever as to why the Respondent would register and use the disputed domain name other than in bad faith. The arguments laid out by the Complainant clearly suggest ill-motivated behavior of the Respondent who has failed to explain any plausible good faith use of the disputed domain name.

Therefore, the Panel finds that the disputed domain name has been registered and has been used by the Respondent in bad faith.