WIPO Arbitration and Mediation Center

ADMINISTRATIVE PANEL DECISION

Meta Platforms, Inc. v. Angel Rafael Cuevas Zapata

Case No. D2021-4033

1. The Parties

Complainant is Meta Platforms, Inc., United States of America (“United States”), represented by Hogan Lovells (Paris) LLP, France.

Respondent is Angel Rafael Cuevas Zapata, Mexico.

2. The Domain Name and Registrar

The disputed domain name <facebookloginsecuritykey.com> is registered with PDR Ltd. d/b/a PublicDomainRegistry.com (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on December 2, 2021. On December 2, 2021, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On December 3, 2021, the Registrar transmitted by email to the Center its verification response confirming that Respondent is listed as the registrant and providing the contact details.

The Center verified that the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on December 9, 2021. In accordance with the Rules, paragraph 5, the due date for Response was December 29, 2021. Respondent did not submit any response. Accordingly, the Center notified Respondent’s default on January 19, 2022.

The Center appointed Fernando Triana, Esq., as the sole panelist in this matter on January 28, 2022. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

Complainant is a social technology company. Complainant’s trademark FACEBOOK identifies a social-media and social-network platform since 2004 for Harvard’s students and since 2006 for anyone with a valid email address. Currently, the social-network identified with the trademark FACEBOOK has approximately 2.90 billion monthly active users and 1.91 billion daily active users on average worldwide.

Complainant’s trademark has developed considerable reputation and goodwill worldwide in connection with a wide variety of goods and services. Complainant’s website is currently ranked as the 4th most visited website in the world according to information company Alexa.

Among others, Complainant owns the following trademarks:

- United States Trademark Registration No. 3041791 for FACEBOOK, registered on January 10, 2006;

- European Union Trade Mark No. 005722392 for FACEBOOK, registered on April 29, 2008.

The disputed domain name was registered on March 5, 2021, and it is currently inactive. However, it was previously used to point to a website mimicking Complainant’s Facebook log in page. It is therefore clear that it was used in connection with a phishing scheme for the purpose of collecting Facebook users’ account credentials.

5. Parties’ Contentions

A. Complainant

- Complainant is the owner of numerous FACEBOOK trademarks, registered in jurisdictions throughout the world, since 2006.
- The dispute domain name is confusingly similar to Complainant’s trademarks as it incorporates the FACEBOOK trademark in its entirety.
- The additional terms “login”, “security”, and “key” do not prevent a finding of confusing similarity.
- Respondent has no rights or legitimate interests in the dispute domain name.
- Respondent is unable to invoke any of the circumstances set out in paragraph 4(c) of the Policy that would demonstrate its rights or legitimate interests in the dispute domain name.
- Respondent is not using the disputed domain name in connection with a bona fide offering of goods or services.
- Respondent is not a licensee of Complainant, nor has Respondent been otherwise authorized by Complainant to make any use of its FACEBOOK trademark, in a domain name or otherwise.
- Complainant has no prior business relationship with Respondent.
- The disputed domain name has been used as part of a fraudulent phishing scheme to impersonate Facebook.
- Respondent cannot credibly claim to be commonly known by the disputed domain name.
- Respondent is not currently making a legitimate noncommercial or fair use of the disputed domain name, without intent for commercial gain to misleadingly divert consumers.
- Complainant’s social network identified with the trademark FACEBOOK, rapidly acquired considerable goodwill and renown worldwide.
- Respondent knew or should have known of Complainant’s trademarks.
- Respondent had Complainant in mind when registering the disputed domain name, as Respondent was seeking to impersonate Complainant’s Facebook platform in order to obtain personal information from unsuspecting Facebook users who were led to believe that they had arrived at Facebook’s homepage.
- Respondent has intentionally attempted to attract, for commercial gain, Internet users to its website by creating a likelihood of confusion with Complainant’s FACEBOOK trademark.

B. Respondent

Respondent did not reply to Complainant’s contentions.

6. Discussion and Findings

Paragraph 15(a) of the Rules instructs this Panel to “decide a complaint on the basis of the statements and documents submitted in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable”.

Likewise, paragraph 10(d) of the Rules, provides that “the Panel shall determine the admissibility, relevance, materiality, and weight of the evidence”.

The Panel wishes to place special emphasis on the evidence filed to prove assertions, which has been thoroughly studied in order to determine its relevance and weight in arriving at a decision. The statements that have been accompanied by evidence have been given more importance than the mere unsubstantiated assertions.

Paragraph 4(a) of the Policy requires that Complainant prove each of the following three elements to obtain an order that the disputed domain name be cancelled or transferred:

(1) the disputed domain name is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and

(2) Respondent has no rights or legitimate interests in respect of the disputed domain name; and

(3) the disputed domain name has been registered and is being used in bad faith.

This discussion, based on the evidentiary support submitted by Complainant, noting that Respondent did not reply to Complainant’s contentions, will be discussed as follows:

First of all, the Panel will determine whether or not the disputed domain name is identical or confusingly similar to the trademark in which Complainant has rights. Secondly, the Panel will verify if Respondent has any rights or legitimate interests in respect of the disputed domain name; and thirdly, the Panel will establish whether or not the disputed domain name has been registered and is being used in bad faith by Respondent.

A. Identical or Confusingly Similar

Complainant contends to be the owner of the trademark FACEBOOK in several jurisdictions, since at least 2006.

a) Existence of a trademark or service mark in which Complainant has rights

Firstly, it is important to point out that paragraph 4(a) of the Policy requires the existence of a trademark or a service mark.

When a sign is registered as a trademark, it is surrounded by a presumption of sufficient distinctiveness, and the owner is granted with an exclusive right over the mark, which entitles him to prevent any third party from using the registered sign or any other sign confusingly similar to it.

In this case, as set forth in the section 4 above, Complainant has proved its rights in the trademark FACEBOOK. Annex 10 to the Complaint.

This information appears to be incontestable and conclusive evidence of Complainant’s ownership of the cited trademark and the exclusive right to use it in connection with the stated services. The registration of a mark is prima facie evidence of validity, which creates a presumption that the mark is inherently distinctive.

Thus, Complainant established its rights in the trademark FACEBOOK.

Therefore, the Panel concludes that Complainant has demonstrated rights in the trademark FACEBOOK for purposes of Paragraph 4(a)(i) of the Policy.

b) Identity or confusing similarity between the disputed domain name and Complainant’s trademark.

Complainant alleges that the disputed domain name incorporates the trademark FACEBOOK in its entirety, adding only the terms “login”, “security”, and “key”, and the generic Top-Level Domain (“gTLD”) “.com”.

On the first place, before establishing whether or not the disputed domain name <facebookloginsecuritykey.com> is confusingly similar to Complainant’s trademark FACEBOOK, the Panel wants to point out that the addition of a gTLD, i.e., “.com”, “.biz”, “.edu”, “.org”, or “.net”, is generally disregarded when determining if the disputed domain name is identical or confusingly similar to the trademark, see WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”) at section 1.11.1.

Hence, the inclusion of the “.com” gTLD, in the disputed domain name is not a factor in analyzing whether a disputed domain name is identical or confusingly similar to the mark in which Complainant asserts rights.

Furthermore, the Panel considers that the reproduction of the trademark FACEBOOK, by the disputed domain name is sufficient ground to establish that the disputed domain name is confusingly similar to the trademark. Especially since the disputed domain name reproduces entirely Complainant’s trademark which is clearly recognizable in the disputed domain name.

In addition, the Panel agrees with Complainant on the conclusion that including the terms “login”, “security”, and “key” do not prevent a finding of confusing similarity between the disputed domain name and the trademark FACEBOOK (section 1.8 of the WIPO Overview 3.0).

In consequence, as per this reasoning, the Panel finds that, the disputed domain name is confusingly similar to Complainant’s trademarks and thus, the requirement set forth in paragraph 4(a)(i) of the Policy is duly complied with.

B. Rights or Legitimate Interests

a) Prima facie case

Regarding this second element of paragraph 4(a) of the Policy, UDRP panels have unanimously found that requiring the complainant to prove the lack of rights or legitimate interests of the respondent in the disputed domain name is often an impossible task. It is not only “proving a negative”, but also demands access to information that is mostly within the knowledge of the respondent¹ .

In Julian Barnes v. Old Barn Studios Limited., WIPO Case No. D2001-0121, the Panel stated that:

“Is the Respondent required to adduce any such evidence, if the onus is on the Complainant to prove the three elements of paragraph 4 of the Policy? While the overall burden of proof is on the Complainant, this element involves the Complainant proving matters, which are peculiarly within the knowledge of the Respondent. It involves the Complainant in the often impossible task of proving a negative. In the Panel’s view the correct approach is as follows: the Complainant makes the allegation and puts forward what he can in support (e.g., he has rights to the name, the Respondent has no rights to the name of which he is aware, he has not given any permission to the Respondent). Unless the allegation is manifestly misconceived, the Respondent has a case to answer and that is where paragraph 4(c) of the Policy comes in. If the Respondent then fails to demonstrate his rights or legitimate interests in respect of the Domain Name, the complaint succeeds under this head.”

Therefore, Complainant is required to make a prima facie case that Respondent lacks rights or legitimate interests in the disputed domain name. Once this prima facie case is made, the burden of production shifts to Respondent, who must come forward with concrete evidence of its rights or legitimate interests² . If Respondent fails to do so, Complainant is deemed to have met the second element of paragraph 4(a) of the Policy.

Complainant asserts that Respondent has no rights or legitimate interests in the disputed domain name because of the following: (i) Respondent is not using the disputed domain name in connection with a bona fide offering of goods or services; (ii) Respondent is not a licensee of Complainant, nor has Respondent been otherwise authorized by Complainant to make any use of its FACEBOOK trademark, in a domain name or otherwise; (iii) Complainant has no prior business relationship with Respondent; (iv) The disputed domain name has been used as part of a fraudulent phishing scheme to impersonate Facebook; (v) Respondent cannot credibly claim to be commonly known by the disputed domain name; and (vi) Respondent is not currently making a legitimate noncommercial or fair use of the disputed domain name, without intent for commercial gain to misleadingly divert consumers.

The Panel accepts these assertions as a prima facie case made by Complainant that shifts the burden of production to Respondent.

b) Respondent’s rights or legitimate interests in the disputed domain name.

Paragraph 4(c) of the Policy includes a non-limited listing of circumstances that serve to prove Respondent’s rights or legitimate interests in the disputed domain name:

(i) before any notice of the dispute, Respondent’s use of, or demonstrable preparations to use, the disputed domain name or a name corresponding to the disputed domain name in connection with a bona fide offering of goods or services; or

(ii) Respondent (as an individual, business, or other organization) has been commonly known by the disputed domain name, even if Respondent has acquired no trademark or service mark rights; or

(iii) Respondent is making a legitimate noncommercial or fair use of the disputed domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue.

Respondent did not file any Response, thus, failed to rebut Complainant’s prima facie case, and to show his rights or legitimate interests in the disputed domain name. Hence, as per paragraph 14 of the Rules, the Panel shall draw such inferences therefrom as it considers appropriate:

- Respondent’s use of the disputed domain name is not in connection with a bona fide offering of goods or services, as it uses a third party’s trademark to obtain the users login information. Consequently, Respondent’s use is directed to capitalize Complainant’s trademark FACEBOOK goodwill by attracting Internet users to its website.

- There is no evidence within the file proving that Respondent is commonly known by the disputed domain name.

- There is no evidence within the file proving that Complainant licensed or otherwise permitted any use by Respondent of its trademarks.

- There is no evidence within the file justifying the choice of the trademark FACEBOOK to create the disputed domain name for a bona fide purpose.

- There is no evidence within the file proving Respondent’s rights over the trademark FACEBOOK anywhere in the world.

- The disputed domain name is confusingly similar to the trademark FACEBOOK. The nature of the disputed domain name creates a risk of implied affiliation or association with Complainant (section 2.5.1 of the WIPO Overview 3.0).

- There is evidence within the file proving that Respondent was making use of the disputed domain name, with the intention of commercial gain by misleadingly divert consumers and obtaining their login information.

The Panel thus concludes that Respondent lacks rights and legitimate interests in the disputed domain name.

Therefore, the second element of paragraph 4(a) of the Policy is met.

C. Registered and Used in Bad Faith

According to paragraph 4(b) of the Policy, the following circumstances, in particular but without limitation, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith:

(i) Circumstances indicating that respondent has registered or has acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trademark or service mark or to a competitor of that complainant, for valuable consideration in excess of respondent’s documented out-of-pocket costs directly related to the domain name; or

(ii) Respondent has registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that Respondent has engaged in a pattern of such conduct; or

(iii) Respondent has registered the domain name primarily for the purpose of disrupting the business of a competitor; or

(iv) By using the domain name, respondent has intentionally attempted to attract, for commercial gain, Internet users to his/her website or other online location, by creating a likelihood of confusion with the complainant’s mark as to the source, sponsorship, affiliation, or endorsement of his/her website or location or of a product or service on his/her website or location.

For the Panel it is evident that Respondent knew of the existence and importance of Complainant’s trademarks when registering the disputed domain name. It is not a coincidence to include a well-known trademark within a domain name. Thus, the Panel finds Respondent deliberately took Complainant’s trademark to register a domain name and to create a business around it. Indeed, FACEBOOK is a well-known and famous trademark as has been established before:

“Complainant has enjoyed a high degree of recognition as a result of its fame and notoriety throughout the world for its online social networking services. The longstanding and public use of the FACEBOOK and FB Marks would make it disingenuous for the Respondent to claim that it was unaware that the registration of the Disputed Domain Names would violate the Complainant’s rights”³ .

Moreover, on Annex 12 to the Complaint, Complainant proved the content of the website at the disputed domain name. This Annex shows Respondent’s use of the disputed domain name which is defrauding Complainant’s users.

These facts are enough to conclude that Respondent registered the disputed domain name to disrupt Complainant’s business and to attract, for commercial gain, Internet users to its website, by creating a likelihood of confusion with Complainant’s trademarks as to the source, sponsorship, affiliation, or endorsement.

The current non-use of the disputed domain name does not prevent a finding of bad faith under the doctrine of passive holding (section 3.3 of the WIPO Overview 3.0).

Therefore, the third element of paragraph 4(a) of the Policy is satisfied in the present case.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <facebookloginsecuritykey.com> be transferred to Complainant.

Fernando Triana
Sole Panelist
Date: February 11, 2022

¹ See Arla Foods amba v. Bel Arbor / Domain Admin, PrivacyProtect.org, WIPO Case No. D2012-0875; see also F. Hoffmann-La Roche AG v. Bargin Register, Inc. - Client Services, WIPO Case No. D2012-0474.

² See Do The Hustle, LLC v. Tropic Web, WIPO Case No. D2000-0624.

³ Facebook, Inc. v. Domain Administrator, PrivacyGuardian.org / Hernando Sierra, WIPO Case No. D2018-1145