Decision for dispute CAC-UDRP-104316

The Panel is not aware of any other legal proceedings which are pending or decided and which relate to the disputed domain name.

The Complainant is the owner of the well-known trademark "NOVARTIS" registered as both a word and device mark in several classes worldwide, including in Bulgaria. The Complainant has adduced evidence of its extensive portfolio of registered trademarks, the vast majority of them predates the registration of the disputed domain name.

Specifically, the Complainant’s trademark registration in Bulgaria applying to this proceeding includes trademark registration no. 663765 “NOVARTIS”, granted on July 1, 1996.

The Complainant also owns numerous domain names composed of either its “NOVARTIS” alone or in combination with other terms.

For example,

- <novartis.us> created on April 19, 2002;

- <novartis.com> created on April 2, 1996;

- <novartispharma.com> created on October 27, 1999.

FACTS ASSERTED BY THE COMPLAINANT AND NOT CONTESTED BY THE RESPONDENT:

The Novartis Group is one of the biggest global pharmaceutical and healthcare groups. It provides solutions to address the evolving needs of patients worldwide by developing and delivering innovative medical treatments and drugs.

The Complainant was created in 1996 through a merger of two other companies Ciba-Geigy and Sandoz, is the holding company of the Novartis Group.

The Complainant’s products are manufactured and sold in many regions worldwide. The Complainant has especially an active presence in Bulgaria where the Respondent is located.

The Complainant has a local team of more than 250 professionals and the total turnover was around EUR 90 million.

The Complainant also uses its dedicated website https://www.novartis.bg/ to communicate with local consumers in Bulgaria.

The Complainant uses its domain names to promote the NOVARTIS mark with related products and services. It also enjoys a strong presence online via its social media platforms.

The disputed domain name <NORVATRIS.COM> was registered on January 19, 2022.

NO ADMINISTRATIVELY COMPLIANT RESPONSE HAS BEEN FILED.

The Complainant has, to the satisfaction of the Panel, shown that the disputed domain name is identical to or confusingly similar to a trademark or service mark in which the Complainant has rights within the meaning of paragraph 4(a)(i) of the Policy.

The Complainant contends that the disputed domain name is identical, or at least, confusingly similar, to the Complainant’s trademarks “NOVARTIS”.

The disputed domain name changes the order of two letters in the Complainant’s trademark “NOVARTIS”, by putting the letter “T” before the letter “R” to make it as “NOVATRIS”.

The Panel considers that by ‘messing up’ the order of the letters and placing the letter “R” between the letters “T” and “IS” is confusingly similar to the “NOVARTIS” trademark as any consumer would likely see “NOVATRIS” as “NOVARTIS” especially when a consumer is not paying close attention to the mark. This is, in the Panel’s view, highly confusing and this ground is made out.

It is also trite to state that the addition of the gTLD “.COM” does not add any distinctiveness to the disputed domain name and will be disregarded for the purposes of considering this ground.

The Complainant has, to the satisfaction of the Panel, shown the Respondent to have no rights or legitimate interests in respect of the disputed domain name within the meaning of paragraph 4(a)(ii) of the Policy.

A complainant is required to make out a prima facie case that the respondent lacks rights or legitimate interests. Once such a prima facie case is made, the respondent carries the burden of demonstrating rights or legitimate interests in the disputed domain name. If the respondent fails to do so, the complainant is deemed to have satisfied paragraph 4(a)(ii) of the Policy. See WIPO Case No. D2003-0455, Croatia Airlines d.d. v. Modern Empire Internet Ltd.

The Complainant contends that the Respondent has no rights in the disputed domain name, and that they have never had any previous relationships, nor has the Complainant ever granted the Respondent with any rights to use the “NOVARTIS” trademark in any forms, including the disputed domain name.

The Complainant asserts and has provided evidence that the Respondent has been using the disputed domain name to send phishing emails to the Complainant’s business partner.

The Complainant adduced evidence that on January 19, 2022, personnel purported to be from the Complainant, Ivanova, Galya <galya.ivanova@novatris.com>, sent an e-mail with subject “Issue Regarding Recent Payment” to the Complainant’s business partner Alta Pharmaceuticals (with e-mail @altaph.eu), recipient was Fani Tangarova <f_tangarova@altaph.eu>. This e-mail copied other personnel from the Complainant (with e-mails @novartis.com) and from the partner (with e-mails @salvisbg.com).

Alta Pharmaceuticals sent a response on January 20, 2022 urging for delivery.

The evidence shows that the sender has also copied the signature of the Complainant’s purported personnel Ivanova, Galya:

Galya Ivanova
Logistics Specialis
Phone: +359 2 4899808
Fax:+359 2 4899809
Mob:+359886312410
galya.ivanova@norvatris.com

Novartis Bulgaria EOOD
55, Nikola Vaptsarov Blvd.
Expo 2000 Office Park
Building 4, floor 4
Sofia 1407, Bulgaria


The Complainant asserts that the sender has created fake e-mail addresses for the personnel who were copied in the e-mail sent by the Complainant on January 19, 2022, for example:

- stefan.dimitrov@norvatris.com (the genuine one was stefan.dimitrov@novartis.com);

- ognyan.ognev@norvatris.com (the genuine one was ognyan.ognev@novartis.com);

- veselina.haralambieva@norvatris.com (the genuine one was veselina.haralambieva@novartis.com).


The Complainant contends that the alteration or addition of the letters to the disputed domain name to make it look confusingly similar to the Complainant’s domain name <NOVARTIS.COM> and the sending of the “invoice” using the Complainant’s contact details are clear evidence that the ‘sender’ of the phishing email intended to confuse the recipient into believing that the e-mail was sent by the Complainant, including having succeeded as the recipient had effectively made a transfer in response.

In the Panel’s view, the preponderance of evidence adduced by the Complainant support its contention that the disputed domain name was used for phishing purposes to confuse and/or defraud the Complainant’s customers. No challenge has been made by the Respondent to the Complainant’s assertion as it has not filed any administrative compliant response.

Given the evidence adduced by the Complainant of its extensive portfolio of trademarks and wide business networks which the Panel accepts as evidencing the strength of its reputation and coupled with the undisputed assertion that the Respondent is using the disputed domain name for phishing purposes, the Panel accepts and finds that it has no rights or legitimate interests to the disputed domain name.

The Complainant has, to the satisfaction of the Panel, shown the disputed domain name has been registered and is being used in bad faith within the meaning of paragraph 4(a)(iii) of the Policy.

There are two elements that must be satisfied – registration and use in bad faith.

The evidence shows, and the Panel accepts, that the Complainant’s trademark “NOVARTIS” is well known all around the world. The Complainant’s trademark was clearly registered prior to the registration of the disputed domain name.

The disputed domain name currently appears to be suspected of phishing activity. The Panel accepts and finds that the uncontradicted facts show that the disputed domain name is or was being used as a phishing website. The disputed domain name website is currently suspended by Public Domain Registry because of the suspected phishing activity as notified by the Complainant’s e-mail dated January 27, 2022 to Public Domain Registry.

As already stated by other Panels, “phishing is a form of Internet fraud that aims to steal valuable information such as credit cards, social security numbers, user Ids, passwords, etc. A fake website is created that is similar to that of a legitimate organization, typically a financial institution such as a bank or insurance company and this information is used for identity theft and other nefarious activities”. See Halifax Plc. v. Sontaja Sanduci, WIPO Case No. D2004-0237 and also CarrerBuilder LLC v. Stephen Baker, WIPO Case No. D2005-0251.

The Panel considers that for the purpose of satisfying paragraph 4(a)(iii) of the Policy, “use of a disputed domain name for the purpose of defrauding Internet users by the operation of a phishing website is perhaps the clearest evidence of registration and use of a domain name in bad faith”. See WIPO Case No. D2012-2093, The Royal Bank of Scotland Group plc v. Secret Registration Customer ID 232883 / Lauren Terrado.

The Panel has previously stated that it is now established that UDRP jurisprudence considered phishing attacks as “proof of both bad faith registration and use in bad faith”. See WIPO Case No. D2006-0614, Grupo Financiero Inbursa, S.A. de C.V. v. inbuirsa, where the finding was that: “The Respondent registered the domain name because in all probability he knew of the Complainant and the type of services offered by the Complainant and tried to attract Internet users for commercial gain by “spoofing” and “phishing”. The Panel notes that these are practices which have become a serious problem in the financial services industry worldwide. This is a compelling indication both of bad faith registration and of use under paragraph 4(b)(iv)”. See also Finter Bank Zürich v. N/A, Charles Osabor, WIPO Case No. D2005-0871 and Banca Intesa S.p.A. v. Moshe Tal, WIPO Case No. D2006-0228, that directly involves the Complainant.

In the present case, given the Complainant’s world-wide reputation, it is highly unlikely that the Respondent did not know of the Complainant’s trademarks and business when it registered the disputed domain name, and the use of the disputed domain name as a phishing website clearly amounts to use in bad faith. Indeed, the manner in which the letters were altered or added to confuse consumer suggest that the Respondent knew or ought to have known about the Complainant and its trademark when it registered the disputed domain name.

Accordingly, the Panel accepts that the disputed domain name was registered by the Respondent and used in bad faith.

Language of proceedings request

The Complainant requests that the English language should be the language of the proceeding. There is no demurrer to this contention by the Respondent.


Rule 11(a) of the UDRP rules states:

Unless otherwise agreed by the Parties, or specified otherwise in the Registration Agreement, the language of the administrative proceeding shall be the language of the Registration Agreement, subject to the authority of the Panel to determine otherwise, having regard to the circumstances of the administrative proceeding.

The Panel accepts the Complainant's request and will proceed to determine the proceeding in the English language.

In conducting the administrative proceeding, the Panel is required to ensure under Rule 10 of the UDRP rules that the Parties are treated with equality and be given a fair opportunity to present its case.

The Respondent has not filed any administratively compliant response to the Complainant’s Amended Complaint dated February 3, 2022.

In the circumstances, the Panel accepts the Complainant's request and considers that it is appropriate to proceed to determine the proceeding in the English language.


Notification of proceedings to the Respondent

When forwarding a Complaint, including any annexes, electronically to the Respondent, paragraph 2 of the Rules states that CAC shall employ reasonably available means calculated to achieve actual notice to the Respondent.

Paragraphs 2(a)(i) to (iii) set out the sort of measures to be employed to discharge CAC’s responsibility to achieve actual notice to the Respondent.


On February 25, 2022 the CAC by its non-standard communication stated as follows (omitting irrelevant parts):

- That neither the written notice of the Complaint nor the advice of delivery thereof was returned to the Czech Arbitration Court;

- As far as the e-mail notice is concerned, the CAC did not receive any confirmation about delivery if the e-mail sent to forwading01@protonmail.com which was successfully relayed was delivered or not;

- The e-mail notices sent to postmaster@norvatris.com, galya.ivanova@norvatris.com, stefan.dimitrov@norvatris.com, ognyan.ognev@norvatris.com and to veselina.haralambieva@norvatris.com were returned back undelivered as the e-mail address had permanent fatal errors.


No further e-mail address could be found on the disputed site. The Respondent never accessed the online platform.

Given the reasonable measures employed by CAC as set out in the above non-standard communication, the Panel is satisfied that all procedural requirements under UDRP were met and there is no other reason why it would be inappropriate to provide a decision.

The Complainant owns the international trademark “NOVARTIS” and the domain names <novartis.com>, <novartis.bg> and others which are used in connection with its goods or services.

The Respondent registered the disputed domain name <NOVATRIS.COM> on January 19, 2022. The disputed domain name website is currently suspended by Public Domain Registry because of the suspected phishing activity as notified by the Complainant’s e-mail dated January 27, 2022 to Public Domain Registry.

The Complainant challenges the Respondent's registration of the disputed domain name under paragraph 4(a)(i) of the Uniform Dispute Resolution Policy ("Policy") and seeks relief that the disputed domain name be transferred to the Complainant.

The Respondent failed to file any administratively compliant response.


For the reasons articulated in the Panel’s reasons above, the Complainant has satisfied the Panel of the following:

(a) The disputed domain name is confusingly similar to the Complainant’s well-known trademark “NOVARTIS”;

(b) The Respondent has no rights or legitimate interests in respect of the disputed domain name;

(c) The disputed domain name has been registered and is being used in bad faith.