WIPO Arbitration and Mediation Center

ADMINISTRATIVE PANEL DECISION

International Business Machines Corporation v. Laohu Liu

Case No. D2020-1650

1. The Parties

Complainant is International Business Machines Corporation, United States of America (“United States”), represented internally.

Respondent is Laohu Liu, Hong Kong, China.

2. The Domain Name and Registrar

The disputed domain name <ibmassist.com> is registered with GoDaddy.com, LLC (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on June 23, 2020. On June 24, 2020, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On June 25, 2020, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to Complainant on June 25, 2020 providing the registrant and contact information disclosed by the Registrar, and inviting Complainant to submit an amendment to the Complaint. Complainant filed an amendment to the Complaint on June 29, 2020.

The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on July 16, 2020. In accordance with the Rules, paragraph 5, the due date for Response was August 5, 2020. Respondent did not submit any response. Accordingly, the Center notified Respondent’s default on August 10, 2020.

The Center appointed Roberto Bianchi as the sole panelist in this matter on August 20, 2020. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

In 1911, Complainant was incorporated as an amalgamation of three existing companies. In 1924, Complainant officially became International Business Machines.

Complainant owns numerous registrations for the mark IBM in many countries. In particular, Complainant owns the following United States registrations:

Registration No. 4,181,289, registered on July 31, 2012, filed on December 21, 2010, in International Classes 9, 16, 18, 20, 21, 22, 24, 25, 28, 35 ,and 41.

Registration No. 3,002,164, registered on September 27, 2005, filed on December 14, 1999, in International Class 9.

Registration No. 1,696,454, registered on June 23, 1992, filed on August 30, 1990, in International Class 36.

Registration No. 1,694,814, registered on June 16, 1992, filed on August 31, 1990, in International Class 36.

Registration No. 1,243,930, registered on June 28, 1983, filed on May 10, 1982, in International Class 42.

Registration No. 1,205,090, registered on August 17, 1982, filed on April 30, 1980, in International Classes 1, 7, 9, 16, 37, and 41.

Registration No. 1,058,803, registered on February 15, 1977, filed on October 29, 1974, in International Classes 1, 9, 16, 37, 41, and 42.

Registration No. 640,606, registered on January 29, 1957, filed on March 12, 1956, in International Class 9.

According to the relevant WhoIs data, the disputed domain name was registered on July 2, 2018.

At the time of rendering the Decision, the disputed domain name resolved to a web page displaying a list of “related links”. On September 1, 2020, the list included the following links: “Cloud Technology”, “Mongodb Management Tool”, “Sage Accounting Software Small Business”, “Enterprise”, “Notebook”, and “Laptop”.

At the top of the web page, there was a legend stating, “Interested in ibmassist.com? Our Domain Broker Service may be able to get it for you. Find out how”.

5. Parties’ Contentions

A. Complainant

Complainant contends as follows:

The disputed domain name is identical or confusingly similar to Complainant's IBM registered trademark. The disputed domain name consists of the letters “ibm” (not case sensitive), followed by the term “assist” (not case sensitive) and the generic suffix “.com”. The letters “ibm” in the disputed domain name are exactly the same as the IBM trademark. The only difference is the addition of the term “assist”.

Respondent has no rights or legitimate interests in respect of the disputed domain name. Respondent has not been licensed, contracted, or otherwise permitted by Complainant in any way to use the IBM trademark, or to apply for any domain name incorporating such trademark, nor has Complainant acquiesced in any way to such use or application of the IBM trademark by Respondent.

There is no evidence that “ibmassist” is the name of Respondent’s corporate entity, nor is there any evidence of fair use. Furthermore, there is no evidence that Respondent is using or plans to use the IBM trademark or the disputed domain name incorporating the IBM trademark for a bona fide offering of goods or services.

Respondent has used the disputed domain name to perform cybercriminal activities. Respondent is a member of, or is acting in the interest of, the Advanced Persistent Threat (APT) group “Bronze Union”. For the last decade, Bronze Union and four other APT groups have successfully targeted corporations in crossplatform attacks for the purposes of espionage and intellectual property theft. Respondent used the disputed domain name to advance Bronze Union’s cyberattacks. Bronze Union used “backdoors” as part of its cyberattack toolset. Backdoors are malware types that negate normal authentication procedures to access a system. As a result, remote access is granted to resources in an application, such as databases and file servers, giving attackers the ability to remotely issue system commands and update malware. In other words, backdoors are used to connect to “command-and-control” servers.

The disputed domain name was a component of Bronze Union’s command-and-control infrastructure and was most likely used to maintain communications with compromised systems within a target network.

Respondent’s unauthorized use of the IBM trademark in the disputed domain name is likely to cause Internet users into erroneously believing that Complainant is somehow affiliated with Respondent, while in fact no such relationship exists.

The disputed domain name was registered and is being used in bad faith. Respondent was well aware of Complainant’s trademark at the time Respondent registered the disputed domain name. Complainant’s trademarks are well-known around the world. This is proof of bad faith at the time of registration. Respondent registered the disputed domain name through a privacy shield service, Domains By Proxy.

In the present case, the disputed domain name is confusingly similar to Complainant’s IBM mark, and Respondent has no relationship to Complainant or the IBM mark. Therefore, Respondent has registered the disputed domain name in bad faith.

On April 13, 2020, Complainant sent a cease and desist letter to Respondent at the email address listed in the WhoIs records, asking Respondent to disable and transfer the disputed domain name back to IBM. However, Complainant did not receive a response from Respondent.

As stated above, Respondent has been actively using the disputed domain name to advance Bronze Union’s cybercriminal activities. It is plausible that the disputed domain name at some point had active email servers and was used to transmit phishing emails to recipients within target networks who trusted the sender was affiliated with Complainant. It is also plausible that target hosts, erroneously believing that the disputed domain name is owned and operated by Complainant, attempted to open a link from the disputed domain name, thereby infecting their systems with malware.

Respondent’s use of the disputed domain name to advance its per se illegitimate activities is evidence of bad faith. The WhoIs records indicate that the disputed domain name is currently associated with the IP addresses 184.168.221.44 and 184.168.221.54. Since its registration date, the disputed domain name’s associated IP address has changed 26 times amongst 14 different IP addresses. In addition, the following IP addresses have been associated with the disputed domain name: 50.63.202.32, 50.63.202.47, 50.63.202.57, 50.63.202.60, 50.63.202.62, 184.168.221.33, 184.168.221.35, 184.168.221.37, 184.168.221.40, 184.168.221.41, 184.168.221.47, and 184.168.221.48. All of these IP addresses have been associated with the dissemination of malware and/or botnet command-and-control servers since as early as 2013. “A ‘botnet’ is a network of compromised computers infected by a program that communicates with its command-and-control infrastructure in order to attack websites, send unsolicited emails, etc. These carefully coordinated botnets are often used to gather sensitive information from the infected hosts such as financial data as the main drivers for botnets are for recognition and financial gain.” See Confederation Nationale du Credit Mutuel v. Hardsoft, Inc. / Hilary Kneber, WIPO Case No. D2010-1352.

Such illegitimate activities can be detrimental not only to Complainant, but to third parties who may entrust what appears to be Complainant with sensitive information.

Moreover, bad faith exists here pursuant to the doctrine of passive holding, as the disputed domain name is not being used in connection with an active website.

Respondent has failed to respond to Complainant’s letter of April 13, 2020. Respondent has masked its identity on the WhoIs records by using a privacy shield service. Lastly, it is implausible that there would be any good faith use to which the disputed domain name may be put.

B. Respondent

Respondent did not reply to Complainant’s contentions.

6. Discussion and Findings

A. Identical or Confusingly Similar

Considering the printouts submitted with the Complaint, taken from the United States Patent and Trademark Office database, the Panel is satisfied that Complainant has rights in the IBM trademark. See section 4 above.

The Panel notes that the disputed domain name consists of the IBM mark plus the common verb “assist” and the “.com” Top-Level Domain. It is well established that such kind of additions would not prevent a finding of confusing similarity between a domain name and a mark. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), section 1.8.

For these reasons, the Panel concludes that the disputed domain name is confusingly similar to Complainant´s mark IBM.

B. Rights or Legitimate Interests

Complainant alleges that Respondent has not been licensed, contracted, or otherwise permitted by Complainant in any way to use the IBM trademark, or to apply for any domain name incorporating such trademark, nor has Complainant acquiesced in any way to such use or application of the IBM trademark by Respondent. In this regard, the Panel sees nothing on the casefile indicating otherwise. Nor is there any evidence that “Laohu Liu”, the registrant of the disputed domain name according to the relevant WhoIs data, is known by the disputed domain name, which discards the application of Policy paragraph 4(c)(ii).

In fact, there is no evidence of any active use of the disputed domain name except for a web page displaying “related links”. On September 1, 2020, the Panel, in use of its general powers under Rules paragraph 10(a), connected its browser to the disputed domain name, which resolved to a web page displaying the following links: “Cloud Technology”, “Mongodb Management Tool”, “Sage Accounting Software Small Business”, “Enterprise”, “Notebook”, and “Laptop”. In turn, these links resolved to websites of IT businesses presumably unrelated to Complainant. At the top of the web page, there was a legend stating, “Interested in ibmassist.com? Our Domain Broker Service may be able to get it for you. Find out how”. In the view of the Panel, this shows at a minimum that Complainant’s IBM mark is being used to attract Internet users presumably looking for Complainant’s assistance services, to generate click-through income.

The Panel agrees with Complainant that there is no evidence of any fair use of the disputed domain name under Policy paragraph 4(c)(iii), or of a bona fide offering of goods or services under Policy paragraph 4(c)(i). These facts and circumstances are sufficient for Complainant to raise a prima facie case that Respondent lacks rights or legitimate interests in the disputed domain name.

For its part, Respondent failed to reply to Complainant’s cease and desist letter of April 13, 2020 asking Respondent to disable and transfer the disputed domain name back to Complainant. Nor has Respondent provided in this proceeding the slightest explanation or hint of its purposes in registering and using the disputed domain name. Moreover, a search for the disputed domain name conducted on August 31, 2020 by the Panel in the Wayback Machine records on the “www.archive.org” website returned a message stating, “Hrm. Wayback Machine has not archived that URL”.

Complainant also contends that Respondent has used the disputed domain name to perform cybercriminal activities as a member of, or acting in the interest of, the Advanced Persistent Threat (APT) group “Bronze Union”. Bronze Union and four other APT groups have successfully targeted corporations in crossplatform attacks for the purposes of espionage and intellectual property theft. According to Complainant, Respondent used the disputed domain name to advance Bronze Union’s cyberattacks, by using “backdoors”, i.e., malware types that negate normal authentication procedures to access a system.

In this regard, the Panel notes that an administrative panel must within 14 days simply determine whether a Complainant has succeeded or not in proving the requirements set out in Policy paragraph 4(a). To reach such a determination, a panel will normally assess the evidence provided by the parties according to the “balance of probabilities” standard of evidence. A panel lacks any powers or mission to reach a determination as would a judicial authority competent for criminal cases by using the “beyond reasonable doubt” standard of evidence. See e.g., Valero Energy Corporation and Valero Marketing and Supply Company v. Registration Private, Domains By Proxy LLC / Rene Rozadosk, WIPO Case No. D2020-0021 (while observing a potential connection between an unlawful action and the respondent’s address and name, the panel declined to draw any conclusion on this basis and found that the evidence was not sufficient to support a finding of criminal activity.) See also Clinical Resources Group, Inc. v. Anna Bednářová, NEROSO Inst., s.r.o., WIPO Case No. D2017-0169 (“The Complainant has alleged (in the matter of bad faith as well as in the context of rights and legitimate interests) that the Respondent's website has been used in connection with criminal activity. Notwithstanding that decisions under the Policy are made on the balance of probabilities, any such allegation of criminal activity, in order to be substantiated, would require an appropriately high standard of evidence.”)

In any case, the Panel is of the opinion that allegations of criminal conduct may indicate lack of rights if they go uncontested by the respondent. Here, Complainant made serious allegations that the disputed domain name was used to deliver cyberattacks, by using malware that negates normal authentication procedures to access a system, i.e., for criminal activities. In the view of the Panel, Respondent’s silence in respect of such allegations strongly suggests that Respondent does not have any rights or legitimate interests in the disputed domain name. See e.g. ProPark, Inc. v. Gabriella Caltagirone, WIPO Case No. D2018-2584 (finding that the use of the domain name at issue could no establish rights or legitimate interests because the respondent had not attempted to rebut the allegation that the disputed domain name had been used in connection with criminal activity.)

For these reasons, the Panel concludes that Respondent does not have any rights or legitimate interests in the disputed domain name.

C. Registered and Used in Bad Faith

The Panel notes that Complainant is a company almost a century old. The Panel also agrees with previous UDRP panels that the IBM mark is valuable and famous worldwide. See e.g., International Business Machines Corporation v. John Doe / Translation Failed, WIPO Case No. D2019-3059 (“The Complainant’s IBM trade mark is such a well-known mark that the Respondent could not by pure coincidence and without knowledge of the IBM mark have selected the disputed domain name without the Complainant and/or its mark in mind.”); see also International Business Machines Corporation v. Dana Mitchell, IBM Computer Supply, WIPO Case No. D2019-0522 (“Complainant …(is) the owner of the famous registered IBM trademark and service mark, which has been used and associated with computer products and services for decades.”) Complainant also has proven that its numerous registrations for the IBM mark predate the registration of the disputed domain name by decades. See section 4 above. Accordingly, the Panel concludes that at the time of registering the disputed domain name, Respondent knew quite well of, and targeted Complainant and its IBM mark. In the circumstances of this case, this means that the disputed domain name was registered in bad faith.

The Panel further notes that there are no elements on the casefile indicating that the registrant of record, “Laohu Liu”, is personally linked to criminal activity allegedly committed by using the disputed domain name. However, this is not the only ground for the Panel to conclude that the disputed domain name is being used in bad faith.

First, there is no evidence of any active use of the disputed domain name apart from displaying “related links” on a standard webpage provided by the registrar, presumably generating click-through income. See section 4 above, in fine. Second, Complainant is a famous company, well-known worldwide as a provider of products and services in the field of information technology. Third, since Respondent was never authorized or licensed to use Complainant’s IBM famous mark, there is no conceivable use of the disputed domain name that would not be in bad faith. Fourth, Respondent failed to reply to Complainant’s cease and desist letter dated April 13, 2020. Fifth, Respondent failed to respond to the Complaint or to provide any explanation whatsoever in this proceeding. Sixth, at the moment of registering the disputed domain name, Respondent presumably provided a false or incomplete address, in violation of its duties under the domain name registration agreement. See KPMG International Cooperative v. Carl Nguyen, KPMG, WIPO Case No. D2010-2169 (finding the allegation of fraudulent and criminal conduct to be noteworthy, although by itself inadequate to establish bad faith registration and use of the domain name at issue because there was no clear evidence that linked the respondent to said criminal conduct. The complainant also argued (i) that the domain name at issue automatically redirected Internet users to one of the complainant’s websites; (ii) the respondent breached its domain name registration agreement by providing false contact details; and (iii) the respondent passively held the Disputed Domain Name. Considering these additional arguments, the panel found that the respondent registered and used the domain name at issue in bad faith.)

Given all these facts and circumstances, the Panel finds that the disputed domain name was registered and is being used in bad faith.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <ibmassist.com> be transferred to Complainant.

Roberto Bianchi
Sole Panelist
Date: September 3, 2020