Decision for dispute CAC-UDRP-107537

The Panel is not aware of any other legal proceedings which are pending or decided and which relate to the disputed domain name.

The Complainant is the owner of the following trademarks:

- CEDEO, French trademark registration No. 4361885 registered on September 8, 2017, for goods and services in classes 16, 35 and 37;

- CEDEO, French trademark registration No. 4750311 registered on March 31, 2021 for goods and services in classes 9, 16, 35, 36, 37, 38, 39, 40, 41 and 42.

The Complainant is also the owner of the domain name <cedeo.fr>, registered on February 21, 2007 and resolving to the Complainant's official website.

The Complainant is a French company, part of Saint-Gobain Distribution Bâtiment France, offering a wide range of sanitary, HVAC and plumbing products for building professionals. The Complainant has in France over 450 agencies, 200 showrooms and offers more than 100.000 products.
Additionally, the subsidiary Saint-Gobain Distribution Bâtiment France is part of the Saint-Gobain group. Saint-Gobain is a worldwide reference in sustainable habitat and construction markets.

The disputed domain name was registered on April 6, 2025 allegedly by an individual residing in Paris, France.  The disputed domain name resolves to a parking page and has been used to send at least one email in the Complainant's name requesting price catalogs and other business information.

The Complainant maintains that the disputed domain name is confusingly similar to its CEDEO mark as it fully incorporates this mark and the addition of the word "centrales" is not sufficient to escape a finding of confusing similarity of the CEDEO mark with the disputed domain name.

The Complainant further contends that the Respondent lacks rights or legitimate interests in the disputed domain name. In particular, the Complainant asserts that the Respondent does not carry out any activity for, nor has any business with the Complainant. The Complainant has no relationship with the Respondent and did not authorize the Respondent to make use of its CEDEO mark, including as part of the disputed domain name. Moreover, the Respondent is not identified in the Whois as the disputed domain name, which entails that the Respondent is not known by the disputed domain name. The disputed domain name has been used in a phishing scheme. The Complainant asserts that the Respondent uses the disputed domain name to pass itself off as one of the Complainant’s employees. Using the disputed domain name in this manner is neither a bona fide offering of goods or services, nor a non-commercial or fair use of the disputed domain name.

Lastly, the Complainant affirms that it had extensively used its trademark and enjoyed a strong presence in France in its business field well before the registration of the disputed domain name. Accordingly, the Respondent was certainly aware of the Complainant's earlier rights and wide use of its CEDEO mark and registered the disputed domain name for this very reason.

The disputed domain name has been used in connection with a phishing scheme where the Respondent attempted to pass off as one of the employees of the Complainant in order to place orders to receive undue advantages. The Complainant states that the Respondent used the disputed domain name in bad faith, as it is well-established that using a domain name for purposes of phishing or other fraudulent activity constitutes solid evidence of bad faith use.

No administratively compliant Response has been filed.

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights (within the meaning of paragraph 4(a)(i) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the Respondent to have no rights or legitimate interests in respect of the disputed domain name (within the meaning of paragraph 4(a)(ii) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name has been registered and is being used in bad faith (within the meaning of paragraph 4(a)(iii) of the Policy).

The Panel notes that the Complainant asserts that the disputed domain name has been used in a phishing email scheme to impersonate one of the Complainant’s employees to place orders to receive undue advantages. To support this statement, the Complainant provided a copy of the alleged phishing email. However, in reviewing it, the Panel noted that the email addresses of the sender and of the recipient were the same. The email was allegedly signed by an individual whose job title is indicated in the email as "Responsable Achats" (Head of Purchasing). The company name D.S.C. Distribution Sanitaire Chauffage appeared below his name. The email also included a link to a website at the address "www.cedeo.centrales-sa.fr".

On May 30, 2025 the Panel issued Procedural Order No. 1, requesting the Complainant to clarify why, in the subject email, the email addresses of the sender and of the recipient coincided, and to provide evidence of the fact that the email had indeed been sent to a third party's different address. Moreover, the Panel asked the Complainant to confirm that the name of the individual allegedly signing the email was indeed the name of one of the Complainant's employees, or of an individual having a relationship with the Complainant. The Panel also requested the Complainant to clarify whether the website at "www.cedeo.centrales-sa.fr" belonged to the Complainant or to a third party. The Panel set June 4, 2025 as the deadline for the Complainant to respond, and June 9, 2025 as the deadline for the Respondent to reply to the Complainant's submissions. Consequently, also the deadline to render the decision was postponed until June 20, 2025.

On June 4, 2025, the Complainant asked for an extension of the deadline. On June 5, 2025, the Panel issued Procedural Order No. 2, thereby extending the Complainant's deadline until June 12, 2025, and the Respondent's deadline to reply until June 19, 2025. The new date to render the decision was therefore postponed to June 25, 2025. The Panel also advised the parties that no further extensions would be granted.

On June 12, 2025, the Complainant informed the Panel as follows: "The email of the recipient has been redacted by him who then transferred the email to the Complainant. Mr. [name redacted], who's been impersonated, confirmed that this email is a phishing attempt". Moreover, there had been no further communications between the sender and the recipient. The Complainant also indicated that the name of the individual appearing at the bottom of the email is the name of the Complainant's managing director. Lastly, regarding the website at "www.cedeo.centrales-sa.fr", the Complainant affirmed that "it does not belong to the Complainant. It was used in a phishing attempt and was suspended at the Complainant's request".

The Respondent did not reply to the Complainant's further contentions. 

The Panel is satisfied that all procedural requirements under UDRP were met and there is no other reason why it would be inappropriate to provide a decision.

I. Confusing Similarity

The Panel notes that the Complainant has shown that it owns earlier registered trademark rights over the trademark CEDEO, registered in several classes of goods and services.

The disputed domain name incorporates the Complainant's mark entirely, followed by the French word "centrales". This word has various meanings in French; among the various definitions, there is one stating that "centrales" is used as an abbreviation for "centrales d'achat" (central purchasing offices), "an organization that selects product ranges, consolidates orders from member stores and is responsible for making the corresponding purchases on the best possible terms" (see https://www.larousse.fr/dictionnaires/francais/central/14124#13971). This word is therefore descriptive. The Complainant's trademark CEDEO and the descriptive word "centrales", are separated by a hyphen in the disputed domain name. The Panel finds that the Complainant's mark is well recognizable within the disputed domain name. In cases where a domain name incorporates the entirety of a trademark, the domain name will normally be considered confusingly similar to that mark for purposes of UDRP standing (section 1.7 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, the "WIPO Overview 3.0"). Moreover, the addition of the descriptive word "centrales" and the hyphen, to the Complainant's CEDEO mark, cannot prevent a finding of confusing similarity of the disputed domain name with the Complainant's mark.

In light of the above, the Panel finds that the disputed domain name is confusingly similar to the Complainant's CEDEO mark and is satisfied that the first condition under the Policy is met.

II. Rights or Legitimate Interests

As also confirmed by the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition ("WIPO Overview 3.0"), a complainant is required to make out a prima facie case that the respondent lacks rights or legitimate interests. Once such prima facie case is made, the burden of production shifts to the respondent to come forward with appropriate allegations or evidence demonstrating rights or legitimate interests in the domain name. If the respondent fails to come forward with such appropriate allegations or evidence, a complainant is generally deemed to have satisfied paragraph 4(a)(ii) of the UDRP.

Based on the available evidence, the Respondent does not appear to be known by the disputed domain name. The Respondent is not a licensee of, nor has any kind of relationship with, the Complainant. The Complainant never authorised the Respondent to make use of its trademark, nor of a confusingly similar trademark in the disputed domain name.

The Complainant maintains that the disputed domain name was used to send a phishing email reading as follows: "Dear Sir, madame, We are D.S.C. DISTRIBUTION, a company based in France. Following an official order, we would like to receive your price catalogs to inform you of our options. We thank you to provide us with your delivery terms, delivery times, and payment methods. We look forward to a prompt response from you and remain at your disposal for any additional information. (...)." According to the Complainant's evidence, the individual allegedly signing the Respondent's email is one of the directors of the Complainant's group, whose job title is defined in the email as "Responsable Achats" (Head of Purchasing) of "D.S.C. Distribution Sanitaire Chauffage". The physical address indicated in the email is that of the Complainant. The email depicts the Complainant's CEDEO mark in the same graphic stylization of the Complainant's official mark and with the exact same descriptive words adopted by the Complainant, namely "Sanitaire | Chauffage | Plomberie". The Respondent's email also includes a reference to the website "www.cedeo.centrales-sa.fr", which does not belong to the Complainant and has been blocked at its request due to its abusive nature. The Complainant provided evidence that the domain name <cedeo.centrales-sa.fr> was used to send an e-mail communication to a third party with the same content of the e-mail sent through the disputed domain name. This second e-mail is signed by an individual whose alleged job title is “Responsable Achats et Relations Fournisseurs” (Head of Purchasing and Supplier Relations) of “(CEDEO) D.S.C. DISTRIBUTION SANITAIRE CHAUFFAGE.”

As the burden of proof in UDRP proceedings always rests with the Complainant, the Panel would have preferred to receive a copy of the Respondent's email showing the real addressee of this email, or other appropriate evidence demonstrating the situation described by the Complainant, instead than an email where the two addresses, the one of the sender and the one of the recipient, coincided without further evidence. The Panel would like to remind the Complainant that within the frame of a UDRP proceeding, only the Panel's decision is published, while the documents filed in support of the Complainant or the Response are only shared among the relevant parties, namely the Complainant, the Respondent, the UDRP provider and the Panel. As the allegedly phishing email was sent by the Respondent, the Panel does not believe that there would have been any breach of confidentiality in providing a copy of the email showing the real address of the recipient.

However, as mentioned above, with respect to the requirement under Para. 4 (a)(ii) of the Policy, it is sufficient for the Complainant to make out a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain name to reverse the burden of proof. In this case, considering the overall circumstances and in the absence of any contrary argument or evidence from the Respondent, the Panel finds that it is more likely than not that the Respondent's email was indeed sent to an unrelated third party, presumably a reseller, distributor or other business partner of the Complainant. The Panel cannot say what the purpose was behind this email, but it is clear that such purpose was not legitimate: the Respondent illegally impersonated the Complainant and the email sent through the disputed domain name is quite misleading. Moreover, sending deceptive e-mails through e-mail addresses incorporating the Complainant's trademark appears to be a practice adopted more than once by the Respondent, which further aggravates its conduct. Panels have held that the use of a domain name for illegal activity, including impersonation/passing off, or other types of fraud, can never confer rights or legitimate interests on a respondent (Section 2.13.1 of the WIPO Overview 3.0).

Accordingly, the Panel is satisfied that the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent had the opportunity to rebut the Complainant's arguments and evidence but failed to do so by deciding not to file a Response.

In light of the above, the Panel concludes that the second condition under the Policy is met.

III. Bad Faith

As established by paragraph 4(a)(iii) of the Policy, in order to prevail in a UDRP proceeding, it is also necessary to prove that the disputed domain name has been registered and is being used in bad faith. 

As far as registration in bad faith is concerned, the Panel notes that various circumstances of this case show that the Respondent was aware of the Complainant's CEDEO mark when it registered the disputed domain name. First, the disputed domain name incorporates the Complainant's mark entirely and includes the word "centrales", which is strictly related to the Complainant's business.  Moreover, the disputed domain name is used in connection with an email message displaying the name and address of the Complainant, the name of one of the directors of a company of the Complainant's group, and the Complainant's mark in the same graphic stylization. Finally, the Respondent appears to be located in France, which is the country of incorporation of the Complainant and where the Complaint operates.

In view of the above, it is clear to the Panel that the Respondent was well aware of the Complainant and of its CEDEO mark when it registered the disputed domain name. The registration of a confusingly similar domain name with knowledge of the Complainant's earlier mark and without rights or legitimate interests amounts to registration in bad faith.

As far as use in bad faith is concerned, the Respondent used the disputed domain name to impersonate the Complainant and send deceptive emails for an illegal purpose. Such use amounts to use in bad faith, as through the disputed domain name the Respondent has intentionally attempted to attract Internet users, by creating a likelihood of confusion with the Complainant's mark for some undue personal advantage.

Accordingly, the Panel finds that the Complainant has successfully proved the third and last requirement under the Policy.