Decision for dispute CAC-UDRP-108430

The Panel is not aware of any other legal proceedings which are pending or decided and relate to the disputed domain name.

The Complainant has adduced documentary evidence showing that it is the owner of the following registered marks, which satisfy the requirements of the Policy:

- US service mark No. 2909931, registered on 14 December 2004;

- US service mark No. 4012377, registered on 16 August 2011 in Nice Classification List class 42;

- US trademark No. 4226418, registered on 16 October 2012 in Nice Classification List class 9;

- US service mark No. 5849000, registered on 3 September 2019 in Nice Classification List class 36;

- US service mark and trademark No. 6058405, registered on 19 May 2020 in Nice Classification List classes 9 and 42;

- US service mark and trademark No. 6058783, registered on 19 May 2020 in Nice Classification List classes 9, 36 and 42.

The Complainant furthermore submitted a list of its registered marks around the world for its XOOM brand, containing details of 140 registrations. The list is sufficiently detailed to allow the Panel to verify the asserted registrations. In exercise of its general powers, the Panel did so and determined the random sample it employed to be accurately recorded in the list. The Panel therefore accepts the Complainant's assertion to be substantiated that it has an extensive international portfolio of registered marks.

The Complainant explained how it had acquired Xoom corporation and incorporated the latter's <xoom.com> domain name into the Complainant's PayPal platform. It also submitted evidence from the <paypal.com> website but did not provide documentary evidence of the registration of the <xoom.com> and <paypal.com> domain names. Nevertheless, the Panel is prepared in the circumstances of this case to take notice of the Complainant's association to both domain names on the basis of the Complainant's assertions made in their regard along with the screen capture and screenshot evidence it did provide from the <paypal.com> website.

The disputed domain name <paypal.legal> was registered by the Respondent on 27 January 2026, according to the Registrar Verification obtained by the CAC Case Administrator.

The Complainant was founded in 1998 and is a leading provider of online payment services internationally. It has used its PAYPAL brand continuously since it launched its payments platform in 1999. The platform is available in over 150 countries and territories and the Complainant in recent years has had a turnover of over $20 billion.

The Complainant acquired Xoom corporation in 2015 and has employed the branded Xoom service as a sub-brand of its PayPal services to provide electronic funds transfer and remittance services in particular. It does so via its dedicated <xoom.com> website and similarly branded mobile applications which have been downloaded more than five million times. The Complainant's XOOM brand features in dedicated social media activities; these have attracted a significant number of followers.

Screen capture evidence adduced by the Complainant shows that internet users visiting the website to which the disputed domain name <xoom.legal> resolves are redirected to terms of service presented on the Complainant's <paypal.com> website.

The Complainant also claims, but without substantiation evident to the Panel from the Case File, that MX (i.e. e-mail) records have been configured on the disputed domain name's servers.

During its routine scrutiny of the Case File, the Panel determined that the registrant details that were provided by the Respondent on registration of the disputed domain name employed the Complainant's corporate name and headquarters postal address in San Jose, California. They also gave Kampala and Uganda as the province and country (i.e. instead of the United States). An e-mail address was furthermore given for an individual that clearly has no connection with the Complainant or indeed the disputed domain name. 

COMPLAINANT:

The Complainant's XOOM brand has won a large base of users worldwide and its continuous use and success make it a well-known brand around the world.

1. Rights and comparison with the disputed domain name

The Complainant has registered trade marks for XOOM which have at all material times been in force, valid, and subsisting, and which substantially pre-date the registration of the disputed domain name. The Complainant requests that the extension in the disputed domain name <.legal> gTLD be overlooked for confusing similarity as it is a merely technical requirement, so making the disputed domain name an exact match to the Complainant's protected brand. The Complainant therefore requests that the Panel agrees that the disputed domain name is confusingly similar to the Complainant’s demonstrated registered marks.

2. Absence of rights or legitimate interest on the Respondent's part

The Respondent is not authorized to engage in any activities on behalf of the Complainant.

The Complainant submits that the Respondent has never been known by the name Xoom while nothing about the disputed domain name suggests that the Respondent is making a legitimate non-commercial or fair use of it. Hence, the Respondent does not satisfy any of the grounds under Policy that would indicate he had a right or legitimate interest in the disputed domain name.

Moreover, a redirection that is in place on the website to which the disputed domain name resolves (see 3, below) serves illegitimately to deceive unsuspecting users, or indeed diligent users checking whether the disputed domain name is official. Since the disputed domain name has MX records configured, it can be inferred that this is for the purpose of conducting phishing, made the more effective by the redirection that is in place, as it masks the Respondent's malfeasance should users attempt to verify the source of the phishing email by navigating to the disputed domain name.

3. Bad faith registration and use

The Complainant believes that the Respondent’s activities are a sophisticated impersonation campaign fraudulently targeting the Complainant and its protected marks. To begin with, the Complainant submits that, in view of the well-known status its XOOM mark possesses, it is inconceivable that the Respondent could have registered the disputed domain name without knowledge of the Complainant’s brand. Next, the Respondent has shown that he was unequivocally aware of the XOOM brand given use of the disputed domain name to redirect to the Complainant’s website and in particular to the legal terms of service, which the Complainant believes can only be for the purpose of conducting a phishing scam, as witnessed by configuring MX records. The Complainant therefore submits that the disputed domain name has been registered and is being used in bad faith in the sense of the Policy.

On the basis of the foregoing, the Complainant contends that the requirements of the Policy have been met and requests that the disputed domain name be transferred to it.

RESPONDENT:

No administratively compliant Response was filed.

The Complainant has, to the satisfaction of the Panel, shown that the disputed domain name is identical or confusingly similar to service and trademarks in which the Complainant has rights (within the meaning of paragraph 4(a)(i) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the Respondent to have no rights or legitimate interest in respect of the disputed domain name (within the meaning of paragraph 4(a)(ii) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown that the disputed domain name has been registered and is being used in bad faith (within the meaning of paragraph 4(a)(iii) of the Policy).

The Panel is satisfied that all procedural requirements under the UDRP were met and that there is no other reason why it would be inappropriate to provide a decision.

The Panel notes that its résumé of the Parties' contentions includes for the Complainant only its main arguments pertinent to reaching a decision in this proceeding; it omits in particular several references to past ADR Panels' Decisions.

The Panel, in relation to the UDRP's cumulative three-part test, finds as follows:

(1) The Complainant has established its ownership of multiple service marks and trademarks in respect of its XOOM brand. In comparison to the disputed domain name, the Panel recognizes that its stem is identical to the Complainant's XOOM brand and further FINDS -- contrary to the Complainant's invitation to the Panel -- that the Respondent's choice of gTLD extension is not merely for technical purposes, i.e. for technical facilitation of access to Domain Name System resources. Rather, the <.legal> extension is in the circumstances of this case intimately linked to rendering the disputed domain name confusingly similar to internet users who may see it and be induced to act upon it so as to determine legal modalities related to the Complainant's XOOM services. It is the very combination in the disputed domain name <xoom.legal> of both its (dominant) stem and (descriptive) extension that is capable of producing such an inducement and thus cannot be overlooked by the Panel. On these grounds the Panel finds the disputed domain name as a whole to be confusingly similar to the Complainant's XOOM mark, so fulfilling the first requirement of the UDRP test.

(2) It is clear that no factors foreseen under the Policy apply in the Respondent's favour in the circumstances of this case, that no authorization has been granted by the Complainant to the Respondent to employ the former's protected brand in any way, and that, as the Registrar Verification shows, the Respondent submitted fabricated details at registration which confirm an abuse of the registration procedure itself. The details themselves simply impersonate the Complainant, albeit in a flimsy manner. The Panel therefore on these grounds FINDS the second requirement of the UDRP test to be met. The Panel, by contrast, prefers to address the Complainant's contention as to phishing not under this limb of the Policy but under the next.

(3) The circumstances of registration of the disputed domain name including the abuse of registration procedure just mentioned leave no doubt that it was conducted in knowledge of the Complainant and its brand and thus in bad faith. As to use of the disputed domain name, evidence has been submitted by the Complainant of a redirection to the Complainant's own terms of service. This does not, seen simply on its own, reveal the purpose of the redirection. The Complainant's contention then of phishing in this regard is argued on the basis that MX records have been configured. This contention is notsupported by proof so far as the Panel could detect from the Case File. The contention must thus be treated as a supposition based on likelihood. But the unequivocal evidence at registration of impersonation and deliberate composition of such a specific domain name by the Respondent, taken in conjunction with proven use of the website to which the disputed domain name resolves (redirection to the Complainant's terms of service), provide ample grounds for concluding that active impersonation is being pursued in some way by reference to the kind of financial activity in which the Complainant's Xoom service operates. The Complainant has thereby shown to the Panel's satisfaction that a scam of some kind is being undertaken by the Respondent, almost certainly for the Respondent's intended financial gain, by use of the disputed domain name. The Panel acknowledges in this connection that phishing is not always easy to prove, even forensically, and that it is an abuse which takes various forms. It hence regards the Complainant's contention of phishing as credible but not to the exclusion of other scenarios for abuse. What is certain is that, whatever the precise type of use involved here, it cannot be explained other than through imputing bad faith. For these reasons, the Panel FINDS that the Respondent both registered and is using the disputed domain name in bad faith, so fulfilling the third and final requirement of the UDRP test.

In light of the above, the Panel ORDERS the transfer of the disputed domain name to the Complainant.