WIPO Arbitration and Mediation Center

ADMINISTRATIVE PANEL DECISION

Salesforce.com, Inc. v. Registration Private, Domains By Proxy LLC/ Richard Marvin

Case No. D2021-1399

1. The Parties

The Complainant is Salesforce.com, Inc., United States of America (“United States”), represented by Winterfeldt IP Group PLLC, United States.

The Respondent is Registration Private, Domains By Proxy LLC/ Richard Marvin, United States.

2. The Domain Name and Registrar

The disputed domain name <saiseforce.com> (“Domain Name”) is registered with Wild West Domains, LLC (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on May 5, 2021. On May 6, 2021, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Domain Name. On May 6, 2021, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Domain Name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on May 11, 2021 providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on May 11, 2021.

The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on May 26, 2021. In accordance with the Rules, paragraph 5, the due date for Response was June 15, 2021. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on July 7, 2021.

The Center appointed Ellen B Shankman as the sole panelist in this matter on July 12, 2021. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The date of the Domain Name registration is February 9, 2021.

The Complainant provided evidence of multiple trademark registrations for the SALESFORCE mark, including, inter alia: United States Reg. No. 2,964,712, in Classes 35 and 42, used in commerce since September 27, 1999 and registered on July 5, 2005; and United States Reg. No. 3,138,749, in Class 9, used in commerce since and registered on September 5, 2006.

The Complainant also owns numerous domain names that include the SALESFORCE Marks (the SALESFORCE Domains”), which include, but are not limited to, the following:

- <salesforce.com> (registered on December 1, 1998);
- <salesforce.org> (registered on April 30, 2004);
- <salesforce.mobi> (registered on June 12, 2006); and
- <salesforce.cloud> (registered on January 26, 2016).

The Complainant provided evidence that the Domain Name has been used to support and send an email seeking payment of money under an apparent “phishing” attempt.

The Panel also conducted an independent search to determine that the Domain Name currently resolves to a page with pay-per-click (“PPC”) links and advertising.

5. Parties’ Contentions

A. Complainant

The Complainant is salesforce.com, inc. (“Salesforce”), a corporation with its global headquarters in San Francisco, California, United States. The complaint contends that the Complainant was founded in 1999, is the world’s leading customer relationship management (CRM) platform, and provides CRM and a variety of other cloud-based software-as-a-service products to over 150,000 companies worldwide. In addition to its San Francisco global headquarters, the Complainant has regional headquarters in Morges, Switzerland, Hyderabad, India, and Tokyo, Japan. Other major offices are located in Toronto, Chicago, New York City, London, Sydney, and Dublin. The Complainant has its services translated into over a dozen different languages. As of Fiscal Year 2020, the Complainant had USD 17.1 billion in revenue and over 49,000 employees. The SALESFORCE brand was ranked as the 41st most valuable global brand by BrandZ in 2020, which valued the brand at around USD 30.5 billion. The SALESFORCE brand was ranked the 58th best global brand by Interbrand in 2020, with an estimated value over USD 10.7 billion.

The Complaint is based upon the Complainant’s trademark/service marks SALESFORCE and SALESFORCE.COM. The SALESFORCE mark has been used by the Complainant in the United States since at least as early as 1999, and it has been registered in the United States since 2005. The SALESFORCE.COM mark has been used by the Complainant in the United States since at least as early as 1999, and it has been registered in the United States since 2003.

The <salesforce.com> domain name has been used in the Complainant’s business since its inception in 1999 and has been continuously used and associated with the Complainant’s business since that time. For example, <salesforce.com> directs Internet users to the Complainant’s website located at “www.salesforce.com”, which makes substantial use of the SALESFORCE Marks.

The SALESFORCE Marks are used in connection with the Complainant’s product offerings that provide for customer relationship management (CRM), marketing automation, sales automation, sales performance management, field services management, customer service and support, customizable marketing and advertising, managing online content, predictive analytics, big data and business data analysis and visualization, complex event processing, machine learning, artificial intelligence, mining the most relevant information from disparate data sources, creating searchable databases of information and data, security and authentication, monitoring employee efficiency, social media management and publication, collaboration, e-commerce, and software and application development, programming, and implementation, among other items.

The Complainant states that it has promoted the SALESFORCE Marks globally, and the SALESFORCE goods and services are well publicized in the media. The SALESFORCE Marks have widespread recognition in the United States and worldwide. The goodwill generated by the Complainant’s marks and business practices has earned it praise from organizations and news outlets worldwide for being one of the most admired and innovative companies in the world.

The Complaint contends that the Domain Name has been used to conduct a phishing attack directed to a customer of the Complainant, which resulted in the fraudulent transfer of money from the customer to the Respondent, through the Respondent’s use of a masked email address using the “@saiseforce.com” extension to imitate a legitimate email communication from the Complainant regarding the overdue payment of an invoice. The Complainant attached a copy of the email as evidence.

The Complaint argues that the Domain Name is identical or confusingly similar to the trademark in which the Complainant has well established rights. The only difference between the Complainant’s SALESFORCE mark and the <saiseforce.com> domain name is that the latter replaces the letter “L” in the Complainant’s mark with the letter “I” (which in many fonts is an identical or nearly-identical homoglyph, particularly when capitalized), the reversed order of the letters “S” and “E” following this substituted letter, and the addition of the “.COM” gTLD extension. Thus, the Domain Name contains the SALESFORCE and SALESFORCE.COM marks in their entireties or an obvious typographical variation thereof, which is sufficient to show that the Domain Name is identical or confusingly similar to these marks.

The Respondent has no legitimate interests in the Domain Name given that it was registered well after the Complainant had registered and/or used the SALESFORCE Marks and had established extensive goodwill. On information and belief, the Respondent willfully adopted the Complainant’s trademark within the Domain Name in an attempt to unfairly capitalize on the valuable goodwill the Complainant has built in its SALESFORCE Marks in order to perpetrate phishing attacks.

The Respondent has registered and used the Domain Name in bad faith and the Respondent is acting in opposition to the Complainant and disrupting the Complainant’s business through the Respondent’s use of the Domain Name in connection with an email phishing scheme. This fraudulent activity is calculated to enable the Respondent to enrich itself at the expense of unsuspecting consumers and/or the Complainant, thereby harming consumers and the goodwill associated with the Complainant’s SALESFORCE Marks, and disrupting Complainant’s business. Further, the Respondent has registered and used the Domain Name for per se illegitimate activity, namely phishing and fraud, which is manifestly considered evidence of bad faith.

Furthermore, the Complainant’s rights in the SALESFORCE Marks are so well established, and its SALESFORCE and SALESFORCE.COM brands have achieved a certain level of recognition such that the Respondent has no colorable argument that he is unaware of these brands. The Domain Name is only valuable because of its association with the Complainant’s trademark. In addition, the Respondent’s use of a proxy service to obscure any publicly identifying information in the WhoIs database is further evidence of the Respondent’s bad faith.

To summarize the Complaint, the Complainant is the owner of registrations for the trademark SALESFORCE, in respect of software goods and services. The Domain Name is confusingly similar to the trademark owned by the Complainant. By registering the Domain Name that comprises the Complainant’s trademark by replacing the letter “L” in the Complainant’s mark with the letter “I” (which in many fonts is an identical or nearly-identical homoglyph, particularly when capitalized), the reversed order of the letters “S” and “E” following this substituted letter, and the addition of the “.COM” gTLD extension, the Respondent has created a domain name that is confusingly similar to the Complainant’s trademark. The addition of these does not prevent a finding of confusing similarity. Therefore, the Domain Name could be considered virtually identical and/or confusingly similar to the Complainant’s trademark. The Complainant contends that the Respondent has no rights or legitimate interests in respect of the Domain Name. The Respondent has used the Domain Name to conduct a ‘phishing’ scheme which is evidence of opportunistic bad faith. The Domain Name was registered and is being used in bad faith. Thus, the Respondent’s registration and use of the Domain Name constitutes bad faith registration and use under the Policy, and the Complainant requests transfer of the Domain Name.

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

6. Discussion and Findings

The burden for the Complainant under paragraph 4(a) of the Policy is to prove:

(i) that the Domain Name registered by the Respondent is identical or confusingly similar to a trademark or service mark in which the Complainant has rights;

(ii) that the Respondent has no rights or legitimate interests in respect of the Domain Name; and

(iii) that the Domain Name has been registered and used in bad faith

The Complainant must prove in this administrative proceeding that each of the aforementioned three elements is present in order to obtain the transfer of the Domain Name.

In accordance with paragraph 14(a) of the Rules, if the Respondent does not submit a Response, in the absence of exceptional circumstances, the Panel shall decide the dispute based upon the Complaint. Since the Respondent did not respond to this Complaint, the facts regarding the use and reputation of the Complainant’s mark are taken from the Complaint and are generally accepted as true in the circumstances of this case.

A. Identical or Confusingly Similar

The Panel finds that the Complainant has proven that it has (registered) trademark rights for SALESFORCE.

Further, the Panel finds that the Domain Name sufficiently integrates the Complainant’s mark and that the Domain Name is confusingly similar to the Complainant’s trademark. Further, the Panel finds that the replacement the letter “L” in the Complainant’s mark with the letter “I”, a nearly-identical homoglyph, together with the reversed order of the letters “S” and “E” following this substituted to the Domain Name does not change the overall impression of the Domain Name being connected to the trademark of the Complainant, being the latter recognizable even if as a typo. It does not in any event prevent a finding of confusing similarity between the Domain Name and the Complainant’s trademark. See Pfizer Inc. v. Asia Ventures, Inc., WIPO Case No. D2005-0256. See also Ansell Healthcare Products Inc. v. Australian Therapeutics Supplies Pty, Ltd., WIPO Case No. D2001-0110, stating “The incorporation of a Complainant’s well-known trademark in the registered Domain Name is considered sufficient to find the Domain Name confusingly similar to the Complainant’s trademark.”

Accordingly, the Panel finds that the Complainant has satisfied the first requirement that the Domain Name is identical or confusingly similar to a trademark in this the Complainant has rights, under paragraph 4(a)(i) of the Policy.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy in turn identifies three means through which a respondent may establish rights or legitimate interests in a domain name. Although the complainant bears the ultimate burden of establishing all three elements of paragraph 4(a) of the Policy, panels have recognized that this could result in the often-impossible task of proving a negative, requiring information that is primarily, if not exclusively, within the knowledge of the respondent. Thus, the consensus view is that paragraph 4(c) shifts the burden of production to the respondent to come forward with evidence of rights or legitimate interests in the disputed domain name, once the complainant has made a prima facie showing. See, e.g., Document Technologies, Inc. v. International Electronic Communications Inc., WIPO Case No. D2000-0270.

The Complainant asserts that the Respondent has no rights or legitimate interests in respect of the Domain Name and that it is not related to or affiliated in any way with the Complainant, nor has the Complainant authorized the Respondent to use its trademarks. The Respondent is not known by the Domain Name, does not have permission to use the Complainant’s mark, and is not using the Domain Name for a bona fide offering of goods or services nor making a legitimate noncommercial or fair use of the Domain Name. The Respondent has also used the Domain Name to support a phishing scheme, almost certainly for the Respondent’s commercial gain, which is not a legitimate let alone noncommercial purpose.

The Panel finds no legitimate use by the Respondent in the Domain Name. The Panel’s finding is consistent with other UDRP panels that have categorically held that the use of a domain name for illegal activity (e.g., phishing, distributing malware, unauthorized account access/hacking, impersonation/passing off, or other types of fraud) can never confer rights or legitimate interests on a respondent. See e.g. WIPO Overview 3.0” (2017), Section 2.13.1 (“Panels have categorically held that the use of a domain name for illegal activity (e.g., the sale of counterfeit goods or illegal pharmaceuticals, phishing, distributing malware, unauthorized account access/hacking, impersonation/passing off, or other types of fraud) can never confer rights or legitimate interests on a respondent.”); see also, e.g., Wikimedia Foundation, Inc. v. Nanci Nette, Name Management Group, WIPO Case No. D2018-0717, (June 13, 2018).

Based on the available record, the Panel finds that the Complainant has established a prima facie case, which was not refuted, and that the Respondent lacks rights or legitimate interests in the Domain Name.

Therefore, the Complainant has satisfied the second requirement of showing that the Respondent has no rights or legitimate interests in the Domain Name, under paragraph 4(a)(ii) of the Policy.

C. Registered and Used in Bad Faith

The Panel is convinced that the Respondent knew about the Complainant in choosing the Domain Name. See Inter IKEA Systems B.V. v. Targetclix / Anh Vo, WIPO Case No. D2011-1087 (“It is not conceivable that Respondent would not have had actual notice of Complainant’s trademark rights at the time of the registration of the Domain Names…. [Therefore] the Domain Names are not one that one could legitimately adopt other than for the purpose of creating an impression of an association with Complainant.”).

The Panel is persuaded that the Respondent has demonstrated a knowledge of and familiarity with the Complainant’s brand. In light of the facts set forth within the Complaint (and set out above), the Panel finds that it is “not possible to conceive of a plausible situation in which the Respondent would have been unaware of” the Complainant’s brand at the time the Domain Name was registered. See Telstra Corp. Ltd. v. Nuclear Marshmallows, WIPO Case No. D2000-0003.

The Panel agrees with the Complainant’s contention that indeed, the Respondent’s purpose in registering the Domain Name was to capitalize on the reputation of the Complainant’s trademark and was opportunistic so as to support illegitimate purposes. See Hoffmann-La Roche Inc. v. Doroven, WIPO Case No. D2010-1196.

A respondent’s use of a complainant’s mark—for said respondent’s commercial benefit—to attract Internet users otherwise seeking said complainant evinces a finding of bad faith is also consistent with the Policy paragraph 4(b)(iv). See WIPO Overview 3.0, section 3.1.4 (“Panels have moreover found the following types of evidence to support a finding that a respondent has registered a domain name to attract, for commercial gain, Internet users to its website by creating a likelihood of confusion with the complainant’s mark: (i) actual confusion, (ii) seeking to cause confusion (including by technical means beyond the domain name itself) for the respondent’s commercial benefit, even if unsuccessful, (iii) the lack of a respondent’s own rights to or legitimate interests in a domain name, (iv) redirecting the domain name to a different respondent-owned website, even where such website contains a disclaimer, (v) redirecting the domain name to the complainant’s (or a competitor’s) website, and (vi) absence of any conceivable good faith use.”). These criteria apply in the present case, which supports the Panel’s finding that the Respondent registered and is using the Domain Name in bad faith.

It is the Panel’s view that when considering the balance of probabilities, it is more likely than not that the Respondent not only had actual or constructive knowledge of the Complainant’s trademarks and that registration of the Domain Name would be confusingly similar to the Complainant’s trademarks, but that the use was intended to unfairly free-ride on the reputation of the Complainant.

The Panel is persuaded that the Respondent deliberately registered the Domain Name to create a misleading and fraudulent impression of association and confusion with the Complainant and intended opportunistically to benefit on the goodwill of the Complainant‘s trademarks and to profit from consumer confusion, and to obtain sensitive and valuable data in bad faith. Given the distinctiveness of the Complainant’s trademark and reputation, together with the evidence of the email sent imitating the Complainant the Panel agrees with the Complainant’s claims that the Respondent has registered the Domain Name with full knowledge of the Complainant’s trademark and uses it for the purpose of defrauding people based on the likelihood of confusion and imitation of the Complainant and its brand.

Furthermore, the Panel finds that the emails sent utilizing the Domain Name constitutes a real risk of phishing scheme, aiming to deceive Internet users to believe they are dealing with the Complainant. See WIPO Case No. D2017-1225, Accor SA v. Domain Admin, C/O ID#10760, Privacy Protection Service INC d/b/a PrivacyProtect.org / Yogesh Bhardwaj.

The Panel finds that this is a classic example of the unfortunate abusive and opportunistic registration to create confusion that the UDRP is intended to address, and finds that the Respondent is using the Domain Name opportunistically to benefit financially from the Complainant’s trademark, to make targeted fraudulent requests involving personal data and financial transfers, in bad faith use and registration.

The Respondent, at the time of initial filing of the Complaint, had employed a privacy service to hide its identity, which past Panels have held serves as further evidence of bad faith registration and use. See Dr. Ing. H.C. F. Porsche AG v. Domains by Proxy, Inc., WIPO Case No. D2003-0230. See also WIPO Overview 3.0, section 3.6 (“Panels have also viewed a respondent’s use of a privacy or proxy service which is known to block or intentionally delay disclosure of the identity of the actual underlying registrant as an indication of bad faith.”).

Given the evidence of the Complainant’s (prior) rights in the trademark, the timing of the registration of the Domain Name with apparent full knowledge of the Complainant, and the use of the Domain Name to support fraudulent emails, the Panel finds that the Complainant has satisfied the third requirement that the Respondent has registered and is using the Domain Names in bad faith, under paragraph 4(a)(iii) of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Domain Name <saiseforce.com> be transferred to the Complainant.

Ellen B Shankman
Sole Panelist
Date: July 14, 2021