Decision for dispute CAC-UDRP-108839

The Panel is not aware of any other legal proceedings which are pending or decided and which relate to the disputed domain names.

The Complainant is the owner of, inter alia, the following trademark registrations for the word GRÜNECKER:

EUIPO Reg. No. 011495207 dated13-06-2013 in Classes 16, 41, 45;

United Kingdom Reg. No. UK00911495207 dated 17-01-2013 in Classes 16, 41, 45;

China Reg. No. 12914132 dated 21-12-2014 in Class 16;

China Reg. No. 12914130 dated 21-12-2014 in Class 45; and

China Reg. No. 12914131 dated 14-12-2014 in Class 41.

The Complainant is a German intellectual property law firm with offices in Germany and France, and a long-established international practice representing clients in industry, technology, life sciences, and creative sectors, with a particular focus on patent prosecution and litigation, trade trademark and design law, and strategic IP portfolio management. The Complainant has used the trademark GRÜNECKER in connection with its legal and IP services for many years and is the owner of registrations for the trademark in various countries.

The disputed domain names <grunecker-de.lat> and <grunecker-de.sbs> were both registered on June 21, 2026, through the same registrar and both display identical privacy-shielded registrant address data.

The disputed domain name <grunecker-de.lat> was configured with the email address <kong@grunecker-de.lat> from which an individual identifying themself as an employee of the Complainant corresponded with a client of the Complainant regarding what is claimed to be an outstanding invoice that had been issued by the Complainant. In the course of that correspondence, the sender represented that the Complainant's bank account was undergoing an audit and requested that payment instead be sent to substitute bank details.

The disputed domain name <grunecker-de.sbs> does not presently resolve to any active website and the Complainant has not identified any active email use of that domain name.

THE COMPLAINANT:

The disputed domain names are confusingly similar to the Complainant's GRÜNECKER trademark because each reproduces the trademark in its entirety, merely substituting the umlaut “ü” with the letter “u”, and appending a hyphen and the non-distinctive geographic term “DE” (signifying Germany) together with a gTLD.

The Respondent has no rights or legitimate interests in the disputed domain names because it has never been authorized by the Complainant to use the GRÜNECKER trademark, it is not commonly known by the disputed domain names, and it has used <grunecker-de.lat> to impersonate the Complainant's employee and perpetrate an invoice-payment fraud on the Complainant's client. While the <grunecker-de.sbs> domain name has not yet been actively used, it was registered under identical registrant data and most likely for the same illegitimate purpose.

The disputed domain names were registered and are being used in bad faith, as evidenced by the fraudulent email scheme conducted through the <grunecker-de.lat> domain name and the pattern of registering multiple confusingly similar domain names, including the passively held <grunecker-de.sbs> domain name under identical registrant information.

THE RESPONDENT:

No administratively compliant Response has been filed.

The Complainant has, to the satisfaction of the Panel, shown the disputed domain names are identical or confusingly similar to a trademark or service mark in which the Complainant has rights (within the meaning of paragraph 4(a)(i) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the Respondent to have no rights or legitimate interests in respect of the disputed domain names (within the meaning of paragraph 4(a)(ii) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the disputed domain names have been registered and are being used in bad faith (within the meaning of paragraph 4(a)(iii) of the Policy).

The Panel is satisfied that all procedural requirements under UDRP were met and there is no other reason why it would be inappropriate to provide a decision.

The applicable standard of proof in UDRP proceedings is the “balance of probabilities” or “preponderance of the evidence.” WIPO Overview of WIPO Panel Views on Select UDRP Questions (“WIPO Overview 3.1”) at paragraph 4.2. The Panel is entitled to accept reasonable and supported allegations set out in the Complaint as true where, as here, they are undisputed, but may deny relief where a complaint contains wholly unsupported and conclusory allegations. WIPO Overview 3.1 at paragraph 4.3.

1. The disputed domain names are confusingly similar to a trademark or service trademark in which the Complainant has rights

Paragraph 4(a)(i) of the Policy is a standing requirement, satisfied where the disputed domain name is identical or confusingly similar to a trademark in which the Complainant has rights. This test is narrower than the “likelihood of confusion” standard applied in trademark infringement litigation and is typically assessed through a side-by-side comparison of the trademark and the domain name. See Administradora de Marcas RD, S. de R.L. de C.V. v. DNS Manager / Profile Group, 101341 (CAC January 5, 2017) (“under the Policy confusing similarity is commonly tested by comparing the complainant’s trademark and the disputed domain name in appearance, sound, meaning, and overall impression.”).

The Complainant has submitted screenshots from the EUIPO, United Kingdom, and China trademark office databases establishing its ownership of the GRÜNECKER trademark. Registration of a trademark with a national or regional trademark authority is sufficient to establish rights in that trademark for purposes of paragraph 4(a)(i) of the Policy. Teleflex Incorporated v. Leisa Idalski, FA 1794131 (FORUM July 31, 2018). As such, the Panel finds that the Complainant has proven its ownership of the asserted trademark rights.

Next, each disputed domain name reproduces the GRÜNECKER trademark in its entirety, substituting the umlaut “ü” with the plain letter “u” and appending a hyphen and the term “DE” together with a gTLD. The substitution of an umlaut with its unmodified base letter is a common and readily foreseeable transliteration that does not alter the trademark's visual, phonetic, or conceptual impression, and the GRÜNECKER trademark remains clearly recognizable within each disputed domain name. The addition of the term “DE,” understood as the country-code for Germany, is a non-distinctive geographic term that does not prevent a finding of confusing similarity and, given that the Complainant is itself a German firm, arguably heightens rather than dispels the likelihood of confusion. See Union des Associations Europeenes de Football (UEFA) v. Nemykin Dmitriy Aleksandrovich, 107283 (CAC March 3, 2025) (descriptive term added to a trademark did not eliminate confusing similarity and, given the complainant's business, “actually increase[d] confusion”). Further, the “.lat” and “.sbs” gTLDs are standard registration requirements that are most often disregarded for purposes of the confusing similarity analysis. Novartis AG v. Wei Zhang, 103365 (CAC December 9, 2020).

Accordingly, the Panel finds that the Complainant has rights in the GRÜNECKER trademarks and that each of the disputed domain names is confusingly similar thereto. The Complainant has satisfied paragraph 4(a)(i) of the Policy as to both disputed domain names.

2. The Respondent has no rights or legitimate interests in the disputed domain names

Paragraph 4(a)(ii) of the Policy requires the Complainant to make a prima facie showing that the Respondent lacks rights or legitimate interests in the disputed domain names, after which the burden of production shifts to the Respondent to rebut that showing. Cephalon, Inc. v. Domain Administrator c/o PrivacyGuardian.org, 100834 (CAC September 12, 2014). Paragraph 4(c) of the Policy identifies certain circumstances that, if proven, may demonstrate such rights or legitimate interests.

As a threshold matter common to both disputed domain names, the Complainant states, and the Respondent (in default) does not dispute, that the parties have no prior relationship and that the Respondent has never been licensed or otherwise authorized to use the GRÜNECKER trademarks. Further, as the Whois records for the disputed domain names identifies the Registrant as “Frank Montero“ and whereas the Respondent has submitted no Response nor made any other submission in this case, there is no evidence before this Panel to suggest that the Respondent is commonly known by the disputed domain names or that it has any trademark rights associated with the name "Grünecker" under paragraph 4(c)(ii) of the Policy. The Panel thus accepts the Complainant’s assertion that there is no evidence that the Respondent is or has ever been commonly known by either disputed domain names within the meaning of paragraph 4(c)(ii) of the Policy.

Next, with respect to the <grunecker-de.lat> domain name, the evidence shows that it was configured with the email address kong@grunecker-de.lat and used by a person identifying themself as an “Assistant” of the Complainant to correspond with one of its clients about outstanding fees due, ultimately transmitting a fake invoice with the Complainant’s name in the header and including substitute bank payment details. The email reads, in part, “I have just been informed by my bank that our account is undergoing an audit review. As a result, we may not be able to receive incoming payments through the account during this period. If it is acceptable to you, we would like to provide updated bank details to ensure the payment is receive without any issues.” This activity appears to be a phishing attempt and is thus not a bona fide offering of goods or services or a legitimate noncommercial or fair use under paragraphs 4(c)(i) or (iii) of the Policy. Rather, it is impersonation of the Complainant for fraudulent purposes. Panels have consistently held that such use of a domain name in furtherance of an email-based invoice or payment phishing scam can never confer rights or legitimate interests. See, e.g., Flora Food Group B.V. v. Rubina Bon, UDRP-108377 (CAC March 4, 2026) (no rights or legitimate interests found where the disputed domain name is “used to send emails to various recipients, purporting to represent Flora Food Sales UK Limited, referring to a purported invoice for a sum that the sender claims is owed by the recipient and which is a phishing email attempting to impersonate the Complainant to obtain, inter alia, the payment details of the Complainant’s customers.“). On this record, the Panel finds that the Respondent has failed to make a bona fide offering of goods or services or a legitimate noncommercial or fair use of the <grunecker-de.lat> domain name.

As for the <grunecker-de.sbs> domain name, the Complainant has not identified any active website or email use. However, the Whois record discloses registrant, administrative, and technical contact data that is, in all material respects, identical to that used for the <grunecker-de.lat> domain name and both domain names were registered on the same day. Non-use of a domain name does not support a finding under paragraph 4(a)(ii) and, here, the surrounding circumstances such as the domain name's evident registration as part of a common scheme with a domain name shown to have been used for fraudulent impersonation, negates any suggestion of a legitimate purpose. See DIGITAL CLASSIFIEDS FRANCE v. Cralos Ramirez Fuentes, 105639 (CAC August 17, 2023) (no bona fide use found where “the Complainant has demonstrated that the disputed domain name did not in the past, and still does not, connect to any relevant content on the Internet, but is passively held by the Respondent instead."). The Respondent has offered no alternate explanation for its actions, as it has not participated in this proceeding, and nothing in the record suggests that the <grunecker-de.sbs> domain name was registered for any reason other than the same illegitimate purpose evident from the contemporaneous, identically-registered <grunecker-de.lat> domain name. Accordingly, the Panel finds that the Respondent has also failed to demonstrate rights or legitimate interests in the <grunecker-de.sbs> domain name.

As the Complainant has made out a prima facie case as to both disputed domain names that the Respondent, in default, has not rebutted, the Panel finds that the Complainant has satisfied paragraph 4(a)(ii) of the Policy as to both disputed domain names.

3. The disputed domain names were registered and are being used in bad faith

Paragraph 4(a)(iii) of the Policy requires the Complainant to prove, by a preponderance of the evidence, that the disputed domain names have both been registered and are being used in bad faith. The circumstances identified in paragraph 4(b) of the Policy are illustrative rather than exhaustive, and other circumstances may equally support a finding of bad faith registration and use. Circus Belgium SA v. Kateryna Kuliak / Ffion Walters ltd, 108704 (CAC August 2, 2026) (“Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith.”).

With respect to the <grunecker-de.lat> domain name, conduct of a deceptive phishing scheme is well-recognized as bad faith registration and use under the Policy. Flora Food Group B.V. v. Rubina Bon, 108377 (CAC March 4, 2026) (bad faith found where “[t]he Respondent has then caused the Disputed Domain Name to resolve to a website promoting unrelated goods and services and used to send emails to various recipients, purporting to represent Flora Food Sales UK Limited, referring to a purported invoice for a sum that the sender claims is owed by the recipient and which is a phishing email attempting to impersonate the Complainant to obtain, inter alia, the payment details of the Complainant’s customers.”). This is so even where, as with the <grunecker-de.lat> domain name, there is no associated active website. The Panel accordingly finds that the <grunecker-de.lat> domain name was registered and is being used in bad faith.

As for the <grunecker-de.sbs> domain name, although the Complainant notes that this is not actively being used, passive holding of a domain name can itself constitute bad faith use where the totality of the circumstances so indicates. bioMérieux v. Zao admin, UDRP-106329 (CAC April 17, 2024) (bad faith found where "[t]he disputed domain name is not used for an active website but resolves to an error page."). Here, the <grunecker-de.sbs> domain name was registered on the very same day as, and shares identical registrant, administrative, and technical Whois data with, the <grunecker-de.lat> domain name which was shown to have been used for a fraudulent email invoice scheme targeting the Complainant's client. Further, the registration of multiple domain names incorporating a complainant's trademark can itself constitute a pattern of conduct evidencing bad faith under paragraph 4(b)(ii) of the Policy and serve as further evidence of an effort to capitalize on the complainant's goodwill. TECNICA GROUP S.P.A. v.  黄保传 (Huang Baochuan) (CAC July 3, 2026) (“the registration of three disputed domain names incorporating the Complainant’s MOON BOOT mark and following the same naming pattern, namely the addition of a geographical name or abbreviation, indicates a pattern of conduct targeted at the Complainant’s trade mark.”). On the present record, the identical registration data and contemporaneous registration of the <grunecker-de.sbs> domain name with the fraud-linked <grunecker-de.lat> domain name together indicate a high likelihood that <grunecker-de.sbs> domain name was registered for the same illegitimate purpose of conducting an email phishing scheme and is being passively held in bad faith pending future use. The Panel accordingly finds that this domain name was also registered and is being used in bad faith.

For the foregoing reasons, the Panel finds that the Complainant has satisfied paragraph 4(a)(iii) of the Policy as to both disputed domain names.