Decision for dispute CAC-UDRP-103220

The Panel is not aware of any other pending or decided legal proceedings which relate to the disputed domain name.

The Complainant is the owner of a trademark for the sign BITMEX in Class 36, registered November 8, 2017 Reg. No. 016462327 (the “BITMEX trademark”) in the European Union Intellectual Property Office. Complainant also owns other BITMEX trademarks registered in Japan, Singapore, and South Korea. Copies of these registrations are attached to the Complaint and establish Complainant's right.

FACTS ASSERTED BY THE COMPLAINANT AND NOT CONTESTED BY THE RESPONDENT:

Complainant owns and operates a leading and prominent cryptocurrency-based virtual trading platform. It alleges that Respondent registered and uses the subject domain name <bitmex-wh.com> in bad faith in that it attempts to pass itself off as Complainant and confuse Internet users into thinking Respondent is Complainant or affiliated with Complainant to exfiltrate data, including phishing for usernames and credentials. It alleges further that Respondent had actual knowledge of Complainant's rights in the BITMEX trademark at the time of registering the domain name. These allegations are supported by evidence of Respondent's use of <bitmex-wh.com> which clearly targets both the trademark and Internet users into believing they have landed on Complainant's website.

The record indicates that the subject domain name incorporates the BITMEX trademark in its entirety. Complainant asserts further that Respondent replicated Complainant's logo on the landing page to impersonate Complainant in furtherance of a plan to exfiltrate proprietary data via an Android mobile operating system package (APK), a set of advanced algorithms imbedded in QR codes to direct users to the subject website. Complainant shows that Respondent hosts materials on the website to which the domain name resolves redirecting mobile users to phishing materials, and is attempting to gather usernames and sensitive login credentials using the BITMEX registered mark and logo. By such conduct, Respondent attempts to confuse and deceive Android users into entering their credentials under the mistaken belief it is being collected by Complainant or with its permission or approval.

Although not alleged in the Complaint but necessary to bring to the Panel’s attention is the registration date of the subject domain name which can be easily ascertained. Panels “may undertake limited factual research into matters of public record if it would consider such information useful to assessing the case merits and reaching a decision.” WIPO Overview, 3.0, paragraph 4.8. The timing in registering a domain name relative to a trademark is a critical factor. Here, the subject domain name was registered June 5, 2020. As noted above the trademark registration dates from November 8, 2017. .

NO ADMINISTRATIVELY COMPLIANT RESPONSE HAS BEEN FILED.

PARTIES' CONTENTIONS:

COMPLAINANT:

Complainant submits that <bitmex-wh.com> is confusingly similar to the BITMEK trademark because it incorporates the mark in its the entirety with the inconsequential addition of a dash and the letters "wh" to form the suffix "-wh". Although a niche business, Complainant has established a reputation such that it is implausible that Respondent could have independently coined the same term.

According to the Complainant, the Respondent has no rights or legitimate interests in respect of the disputed domain name, because it has not been authorized by the Complainant to use the BITMEX trademark, and the disputed domain name does not correspond to the name of the Respondent. The Complainant adds that the Respondent does not carry out a fair or non-commercial use of the disputed domain name.

The Complainant contends further that the disputed domain name was registered and is being used in bad faith. According to the Complainant, the BITMEX trademark is distinctive and well-known around the world, and the Respondent registered the disputed domain name with knowledge of the BITMEX trademark which is evident from the design and content of the landing page. By using the disputed domain name, the Respondent has intentionally attempted to attract, for commercial gain, Internet users to its website, by creating a likelihood of confusion with the Complainant's BITMEX trademark as to the source, sponsorship, affiliation, or endorsement of his website. The disputed domain name is not used for any bona fide purpose, but resolves to a website that is designed to exfiltrate propriety data and deceive Internet visitors to disclose personal information.

RESPONDENT:

The Respondent did not reply to the Complainant's contentions and did not submit any arguments or evidence in its defence. In such event, UDRP Rule 14 provides that “the Panel shall draw such inferences therefrom as it considers appropriate.”

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights (within the meaning of paragraph 4(a)(i) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the Respondent to have no rights or legitimate interests in respect of the disputed domain name (within the meaning of paragraph 4(a)(ii) of the Policy).

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name has been registered and is being used in bad faith (within the meaning of paragraph 4(a)(iii) of the Policy).

In this case, the Provider has employed the required measures to achieve actual notice of the Complaint to the Respondent, and the Respondent was given a fair opportunity to present its case and defend its registration of the subject domain name.

The Panel is satisfied that all procedural requirements under UDRP were met and there is no other reason why it would be inappropriate to provide a decision.

Pursuant to the Policy, paragraph 4(a), a complainant must prove each of the following to justify the transfer of a domain name:

(i) the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;

(ii) the respondent has no rights or legitimate interests in respect of the domain name; and

(iii) the respondent has registered and is using the domain name in bad faith.

By the Rules, paragraph 5(c)(i), it is expected of a respondent to: “[r]espond specifically to the statements and allegations contained in the complaint and include any and all bases for the Respondent (domain name holder) to retain registration and use of the disputed domain name …”

In this proceeding, the Respondent has not used the opportunity provided to it under the Rules and has not submitted a substantive Response addressing the contentions of the Complainant and the evidence submitted by it.

Notwithstanding Respondent’s default Complainant is not relieved from the burden of establishing its claim. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, 3.0, § 4.3: “Noting the burden of proof on the complainant, a respondent’s default (i.e., failure to submit a formal response) would not by itself mean that the complainant is deemed to have prevailed; a respondent’s default is not necessarily an admission that the complainant’s claims are true.

A. Identical or confusingly similar

A side-by-side comparison of the domain name and the BITMEX trademark indicates that <bitmex-wh.com> is confusingly similar to the mark because it incorporates the mark in its entirety with the inconsequential addition of a dash and the letters "wh" to form the suffix "-wh" within the second level domain. Neither the inclusion of a generic suffix nor the applicable top-level domain creates a separate or distinctive term. See Bloomberg Finance L.P. v. Nexperian Holding Limited, FA 1782013 (Forum June 4, 2018) (<bloombertvoice.com>); and WIPO Overview, § 1.8: "Where the relevant trademark is recognizable within the disputed domain name, the addition of other terms (whether descriptive...meaningless or otherwise) would not prevent a finding of confusing similarity under the first element."

Having demonstrated that the subject domain name is confusingly similar to Complainant’s BITMEX trademark the Panel finds Complainant has satisfied paragraph 4(a)(i) of the Policy.

B. Rights and legitimate interests

Under paragraph 4(a)(ii) of the Policy, a complainant has the burden of establishing that a respondent lacks rights or legitimate interests in respect of the disputed domain name, but this burden is light. It is sufficient in the first instance for Complainant to allege a prima facie case, and if it does so, the burden shifts to respondent to rebut the allegations. Croatia Airlines d.d. v. Modern Empire Internet Ltd., D2003-0455 (WIPO August 21, 2003) (holding that “[s]ince it is difficult to prove a negative ... especially where the Respondent, rather than complainant, would be best placed to have specific knowledge of such rights or interests–and since Paragraph 4(c) describes how a Respondent can demonstrate rights and legitimate interests, a Complainant’s burden of proof on this element is light.”

Complainant contends that the Respondent has no rights or legitimate interests in the disputed domain name, because the Respondent has no permission to use the BITMEX trademark and is not commonly known under the disputed domain name. The Complainant also points out that the disputed domain name is connected to a website that is both confusing and designedly deceptive as further set forth in Part C below.

The Panel finds that Complainant has satisfied its prima facie burden. It would ordinarily then be open to the Respondent to establish its right or legitimate interest in a domain name by showing any of the following nonexclusive circumstances:

(i) before any notice to you [respondent] of the dispute, your use of, or demonstrable preparations to use, the domain name or a name corresponding to the domain name in connection with a bona fide offering of goods or services; or
(ii) you [respondent] (as an individual, business, or other organization) have been commonly known by the domain name, even if you have acquired no trademark or service mark rights; or
(iii) you [respondent] are making a legitimate noncommercial or fair use of the domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue.
If a respondent proves any of these circumstances or indeed anything else that shows it has a right or legitimate interest in the domain name, the complainant will have failed to discharge its onus and the complaint will fail. See Deutsche Telekom AG v. Britt Cordon, D2004-0487 (WIPO September 13, 2004) (holding that “once a complainant establishes a prima facie case that none of the three circumstances establishing legitimate interests or rights applies, the burden of production on this factor shifts to the Respondent. If the respondent cannot do so, a complainant is deemed to have satisfied paragraph 4(a)(ii) of the UDRP.)

However, no rebuttal proof having been offered, the Panel finds that the Respondent does not have rights or legitimate interests in the disputed domain name. Thus, Complainant has also satisfied paragraph 4(a)(ii) of the Policy.

C. Registered and Used in Bad Faith

The Complainant must then prove on the balance of probabilities both that the disputed domain name was registered in bad faith and that it is being used in bad faith. The consensus expressed in WIPO Overview 3.0, section 3.1.4. is that “the mere registration of a domain name that is identical or confusingly similar (particularly domain names comprising typos or incorporating the mark plus a descriptive term) to a famous or widely-known trademark by an unaffiliated entity can by itself create a presumption of bad faith.”

The Panel finds that the present case is one in which the presumption of bad faith is satisfied. The presumption is further strengthened where the proof supports the conclusion that respondent also targets Internet users. Such conduct verges on the criminal.

Paragraph 4(b) of the Policy sets out four nonexclusive circumstances, any one of which is evidence of the registration and use of a domain name in bad faith, although other circumstances may also be relied on, as the four circumstances are not exclusive. The four specified circumstances are:

(i) circumstances indicating that the respondent has registered or acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trademark or service mark or to a competitor of that complainant, for valuable consideration in excess of the respondent’s documented out-of-pocket costs directly related to the domain name; or
(ii) the respondent has registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that the respondent has engaged in a pattern of such conduct; or
(iii) the respondent has registered the domain name primarily for the purpose of disrupting the business of a competitor; or
(iv) by using the domain name, the respondent has intentionally attempted to attract, for commercial gain, Internet users to the respondent’s website or other on-line location, by creating a likelihood of confusion with the complainant’s mark as to the source, sponsorship, affiliation, or endorsement of the respondent’s website or location or of a product or service on the site or location.

The domain name in this case resolves to an active website designed to imitate Complainant’s landing page. Complainant has adduced sufficient evidence to prove Respondent’s bad faith, which is to exfiltrate proprietary data and to attract and entrap Internet users to disclose personal information. Taking all these circumstances into account the evidence is beyond rebuttal that Respondent intentionally targeted the BITMEX trademark to accomplish its nefarious end which if carried out gravely harms Internet users believing they had landed on Complainant’s website . See Zoetis Inc. and Zoetis Services LLC v. VistaPrint Technologies Ltd, FA1506001623601 (FORUM July 14, 2015) (“Respondent’s attempt to use the <zoietis.com> domain name to phish for personal information . . . constitutes bad faith pursuant to Policy paragraph 4(a)(iii).”); see also Morgan Stanley v. Bruce Pu, FA 1764120 (FORUM Feb. 2, 2018) (“[T]he screenshot of the resolving webpage allows users to input their name and email address, which Complainant claims Respondent uses that to fraudulently phish for information. Thus, the Panel agrees that Respondent phishes for information and finds that Respondent does so in bad faith under Policy paragraph 4(a)(iii).”).

Finally, the Complainant has cited several prior UDRP decisions which it correctly submits support all of the foregoing contentions. HDR Global Trading Limited v. Hacer YILMAz / Ciftligim Nette, FA 2002001886272 (Forum Mar. 26, 2020) (citing Amazon Technologies, Inc. v. jaskima smith, FA 1750160 (Forum Oct. 26, 2017) (finding the respondent registered and used the disputed domain name in bad faith to pass off as the complainant in an attempt to gain personal information from users who mistakenly access the website).

The Panel finds that the Complainant has shown that the Respondent registered and used the disputed domain name in bad faith both in general and in particular because the Respondent’s conduct puts the case squarely within paragraph 4(b)(iv) as well as within the larger notion of abusive conduct. In other words, this is a case in which Respondent is both a cybersquatter -- which may connote a lower level of mischief -- and abusive registration of the domain name which not only targets Complainant but also consumers.

Accordingly, the Respondent has registered and used the disputed domain name in bad faith and that its conduct firmly supports the conclusion the registration of <bitmex-wh.com> was an abusive act. Thus, Complainant has also satisfied paragraph 4(a)(iii) of the Policy.