ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Enel S.p.A. v. Privacy service provided by Withheld for Privacy ehf/Paolo Frizzi Case No. D2022-2504 1. The Parties The Complainant is Enel S.p.A., Italy, represented by Società Italiana Brevetti S.p.A., Italy. The Respondent is Privacy service provided by Withheld for Privacy ehf, Iceland/ Paolo Frizzi, Italy, self represented. 2. The Domain Name and Registrar The disputed domain name is registered with NameCheap, Inc. (the "Registrar"). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the "Center") on July 4, 2022. On July 11, 2022, a revised Complaint was received by the Complainant. On July 11, 2022, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On July 11, 2022, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on July 12, 2022 providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on July 15, 2022. The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the "Policy" or "UDRP"), the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules"), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the "Supplemental Rules"). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on July 20, 2022. In accordance with the Rules, paragraph 5, the due date for Response was August 9, 2022. The Response was filed with the Center on July 28, 2022. page 2 The Center appointed Edoardo Fano as the sole panelist in this matter on August 12, 2022. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. Pursuant to the paragraphs 10 and 12 of the Rules, on August 25, 2022, the Panel issued a Procedural Order, followed by a reminder on August 31, 2022, requesting the Complainant to confirm that the Respondent is not authorized to use its trademark and to address the question of whether the Complainant is a customer of the Respondent, and requesting the Respondent to provide evidence, if any exists, that the Complainant is a customer, on or before August 31, 2022. On August 31, 2022, both the Complainant and Respondent submitted their respective reply to the Panel's Procedural Order. The language of the proceeding is English, being the language of the Registration Agreements, as per paragraph 11(a) of the Rules. 4. Factual Background The Complainant is Enel S.p.A., an Italian company operating in the field of energy supply and owning several trademark registrations for ENEL, among which the following ones: - European Union Trademark Registration No. 000756338 for ENEL and design, registered on June 25, 1999; - Italian Trademark Registration No. 0000825734 for ENEL, registered on October 4, 2000; and - Italian Trademark Registration No. 0001299011 for ENEL, registered on June 1, 2010. The Complainant also operates on the Internet, owning several domain names which include the trademark ENEL and being "www.enel.it" and "www.enel.com" its main websites. The Complainant provided evidence in support of the above. According to the WhoIs records, the disputed domain name was registered on December 1, 2021, and when the Complaint was filed the disputed domain name redirected to a webpage belonging to the Respondent's website and explaining that it is part of a simulated phishing cyber-attack. 5. Parties' Contentions A. Complainant The Complainant states that the disputed domain name is confusingly similar to its trademark ENEL. Moreover, the Complainant asserts that the Respondent has no rights or legitimate interests in respect of the disputed domain name since it has not been authorized by the Complainant to register the disputed domain name or to use its trademark within the disputed domain name, it is not commonly known by the disputed domain name and it is not making either a bona fide offering of goods or services or a legitimate noncommercial or fair use of the disputed domain name. The Complainant submits that the Respondent has registered the disputed domain name in bad faith, since the Complainant's trademark ENEL is well known in the field of energy supply. Therefore, the Respondent targeted the Complainant's trademark at the time of registration of the disputed domain name, with the page 3 purpose to intentionally attract, for commercial gain, Internet users to its website by taking advantage of the Complainant's trademark reputation. Furthermore, the Complainant suspects that the Respondent could be using the disputed domain name for phishing activities, since the MX records attached to the disputed domain name have been activated. Finally, in response to the Panel's Procedural Order, requesting the Complainant to confirm that the Respondent is not authorized to use its trademark and to address the question of whether the Complainant is a customer of the Respondent, the Complainant confirmed that the Respondent is not authorized to use its trademark and that the Complainant is not a customer of the Respondent. B. Respondent The Respondent is the CEO of Libraesva S.r.l., a company operating in the field of email security and archiving solutionsand owning a phishing awareness platform called "PhishBrain", at the website www.phishbrain.net. The "PhishBrain" service consists of simulating phishing campaigns either via email or SMS. The Respondent states that the disputed domain name is used in the context of this phishing awareness service, being one of the many domains that the companies that bought the PhishBrain service can choose to send simulated phishing campaigns to their employees. Therefore, the Respondent asserts to have a legitimate interest in respect of the disputed domain name since the latter is used for bona fide offering of its phishing awareness service to companies that are already the Respondent's customers, without the Respondent getting any commercial advantage. The Respondent submits that the disputed domain name was not registered and is not used in bad faith, but instead that it protects the Complainant, whose trademark is routinely abused by malicious actors, and it drives additional traffic to the Complainant's website. Finally, in response to the Panel's Procedural Order, requesting the Respondent to provide evidence, if any exists, that the Complainant is its customer, the Respondent confirmed that the Complainant is not its customer. 6. Discussion and Findings Paragraph 4(a) of the Policy lists three elements, which the Complainant must satisfy in order to succeed: (i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights; and (ii) the Respondent has no rights or legitimate interests in respect of the disputed domain name; and (iii) the disputed domain name has been registered and is being used in bad faith. A. Identical or Confusingly Similar The Panel finds that the Complainant is the owner of the trademark ENEL both by registration and acquired reputation and that the disputed domain name is confusingly similar to the trademark ENEL. Regarding the addition of the term "energia" (meaning "energy" in Italian), the Panel notes that it is now well established that, where the relevant trademark is recognizable within the disputed domain name, the addition of terms or letters to a domain name does not prevent a finding of confusing similarity between the disputed domain name and the trademark (see, e.g., Aventis Pharma SA., Aventis Pharma Deutschland GmbH v. Jonathan Valicenti, WIPO Case No. D2005-0037; Red Bull GmbH v. Chai Larbthanasub, WIPO Case No. page 4 D2003-0709; America Online, Inc. v. Dolphin@Heart, WIPO Case No. D2000-0713). The addition of the term "energia" does not therefore prevent the disputed domain name from being confusingly similar to the Complainant's trademark. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition ("WIPO Overview 3.0"), section 1.8. It is also well accepted that a generic Top-Level Domain ("gTLD"), in this case ".email", is typically ignored when assessing the similarity between a trademark and a domain name. See WIPO Overview 3.0, section 1.11.1. The Panel finds that the Complainant has therefore met its burden of proving that the disputed domain name is confusingly similar to the Complainant's trademark, pursuant to the Policy, paragraph 4(a)(i). B. Rights or Legitimate Interests Paragraph 4(a)(ii) of the Policy requires the Complainant to prove that the Respondent has no rights or legitimate interests in the disputed domain name. The Respondent may establish a right or legitimate interest in the disputed domain name by demonstrating in accordance with paragraph 4(c) of the Policy any of the following circumstances, in particular but without limitation: "(i) before any notice to you of the dispute, your use of, or demonstrable preparations to use, the domain name or a name corresponding to the domain name in connection with a bona fide offering of goods or services; or (ii) you (as an individual, business, or other organization) have been commonly known by the domain name, even if you have acquired no trademark or service mark rights; or (iii) you are making a legitimate noncommercial or fair use of the domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue." According to paragraph 4(a) of the Policy, the Complainant has the burden of proving the three elements of the Policy. However, satisfying the burden of proving a lack of the Respondent's rights or legitimate interests in respect of the disputed domain name according to paragraph 4(a)(ii) of the Policy is potentially difficult, since proving a negative circumstance is more complicated than establishing a positive one. As such, it is well accepted that it is sufficient for the Complainant to make a prima facie case that the Respondent has no rights or legitimate interests in the disputed domain name in order to shift the burden of production on the Respondent. If the Respondent fails to demonstrate rights or legitimate interests in the disputed domain name in accordance with paragraph 4(c) of the Policy or on any other basis, the Complainant is deemed to have satisfied paragraph 4(a)(ii) of the Policy. See WIPO Overview 3.0, section 2.1. The Complainant in its Complaint, and as set out above, has established a prima facie case that the Respondent has no rights or legitimate interests in the disputed domain name. It asserts that the Respondent is not currently associated with the Complainant in any way, is not commonly known by the disputed domain name and is not making a bona fide offering of goods or services or a legitimate noncommercial or fair use of the disputed domain name: according to the Complainant, the Respondent is intentionally attracting, for commercial gain, Internet users to its website by taking advantage of the Complainant's trademark reputation. The prima facie case presented by the Complainant is enough to shift the burden of production to the Respondent to demonstrate that it has rights or legitimate interests in the disputed domain name. page 5 The Respondent asserts to have a legitimate interest in respect of the disputed domain name since the latter is used for a claimed bona fide offering of its phishing awareness service to companies that are already the Respondent's customers, and according to the Respondent without the Respondent getting any commercial advantage. According to the WIPO Overview 3.0, sections 2.5.2, the following factors should be considered as supporting a claimed fair use: "(i) whether the domain name has been registered and is being used for legitimate purposes and not as a pretext for commercial gain or other such purposes inhering to the respondent's benefit, (ii) whether the respondent reasonably believes its use (whether referential, or for praise or criticism) to be truthful and well founded, (iii) whether it is clear to Internet users visiting the respondent's website that it is not operated by the complainant, (iv) whether the respondent has refrained from engaging in a pattern of registering domain names corresponding to marks held by the complainant or third parties, (v) where appropriate, whether a prominent link (including with explanatory text) is provided to the relevant trademark owner's website, (vi) whether senders of email intended for the complainant but (because of user confusion) directed to the respondent are alerted that their message has been misdirected, (vii) whether there is an actual connection between the complainant's trademark in the disputed domain name and the corresponding website content, and not to a competitor, or an entire industry, group, or individual, and (viii) whether the domain name registration and use by the respondent is consistent with a pattern of bona fide activity (whether online or offline)." Considering that, as confirmed by both the Complainant and the Respondent in their respective reply to the Panel's Procedural Order, there is no relationship between the Complainant and the Respondent, the Panel finds that the use of the Complainant's trademark within the disputed domain name, so that the Respondent's customers could use it in order to simulate phishing campaigns with their employees, does not provide the Respondent with rights or legitimate interests in the disputed domain name. Internet users visiting the Respondent's webpage, corresponding to the disputed domain name, would not find any link to the relevant trademark Complainant's website, unless they access another Respondent's webpage, namely "phishbrain.libraesva.com/?h=enelenergia.email", and therefore they may misunderstand that there is a relationship between the Respondent and the Complainant when there is/they are not, or that the former's actions are endorsed by the latter when they are not. As regards the Respondent stating that, by using the disputed domain name, it is not getting any commercial advantage, the Panel is of the opinion that a commercial gain, like in the present case, may include gaining a reputational advantage, although not readily quantified, since Internet users could believe that the Complainant is a Respondent's customer and that the Respondent's email security service has been successfully used by the Complainant against phishing activities. See WIPO Overview 3.0, section 2.5.3. The Panel moreover has doubts as to this claim of the Respondent as it does not claim to be a non-profit and its website bears links "get pricing" and "free trial" speaking to a commercial undertaking. The Panel cites with approval Facebook, Inc. and Instagram, LLC v. WhoisGuard Protected, WhoisGuard, Inc. / Phishing Operations, Wombat Security Technologies, WIPO Case No. D2020-3218, and notes that while the Respondent may provide a useful service and recognizing that such service may rely on an appearance of authenticity in a broad sense, it is not clear why such service would require the use of domain names confusingly similar to third party trademarks - whose owners have their own interest in monitoring and policing the use of their marks on the Internet - without authorization, as opposed e.g., to those of the Respondent's actual clients who would presumably have authorized the use of their marks for such purpose. The Panel therefore finds that paragraph 4(a)(ii) of the Policy has been satisfied. page 6 C. Registered and Used in Bad Faith Paragraph 4(b) of the Policy provides that "[.] for the purposes of paragraph 4(a)(iii) of the Policy, the following circumstances, in particular but without limitation, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith: (i) circumstances indicating that [the Respondent has] registered or has acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the Complainant who is the owner of the trademark or service mark or to a competitor of the Complainant, for valuable consideration in excess of its documented out-of-pocket costs directly related to the domain name; or (ii) that [the Respondent has] registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that [the Respondent has] engaged in a pattern of such conduct; or (iii) that [the Respondent has] registered the domain name primarily for the purpose of disrupting the business of a competitor; or (iv) that by using the domain name, [the Respondent has] intentionally attempted to attract, for commercial gain, Internet users to [the Respondent's] website or other online location, by creating a likelihood of confusion with the Complainant's mark as to the source, sponsorship, affiliation, or endorsement of [the Respondent's] website or location or of a product or service on [the Respondent's] website or location". Regarding the registration in bad faith of the disputed domain name, the reputation of the Complainant's trademark ENEL in the the field of energy supply is clearly established and the Panel finds that the Respondent likely knew of the Complainant and its trademark, and deliberately registered the disputed domain name in bad faith, especially because in its Response the Respondent is stating that the Complainant's trademark is "routinely abused by malicious actors". As regards the use in bad faith of the disputed domain name, pointing to a Respondent's webpage showing a simulated phishing cyber-attack, the Panel finds that it is likely to create confusion with the Complainant's trademark as to the source, sponsorship, affiliation, or endorsement of the Respondent's website and that the Respondent is therefore knowingly taking advantage from user confusion. See WIPO Overview 3.0, section 3.1.4. The Panel also incorporates here its findings under the second element and again notes that nothing would prevent the Respondent from undertaking its activities by reference to third party marks that have been authorized for such purpose; notably the record is devoid of any suggestion that the Respondent has sought to contact the Complainant in this regard. The above suggests to the Panel that the Respondent intentionally registered and is using the disputed domain name in order to attract, for commercial gain, Internet users (here, employees of the Respondent's clients, even if it is self-evident that those employees are not per se clients of the Respondent) to its website in or online location accordance with paragraph 4(b)(iv) of the Policy and based on taking advantage of the reputation and goodwill in the Complainant's marks for the benefit of the Respondent's client(s). Moreover, the Panel considers that the nature of the disputed domain name, which is almost identical to the Complainant's trademark with the mere addition of the term "energia" (meaning "energy" in Italian), further supports a finding of bad faith. See WIPO Overview 3.0, section 3.2.1. The Panel finds that the Complainant has presented evidence to satisfy its burden of proof with respect to the issue of whether the Respondent has registered and is using the disputed domain name in bad faith. page 7 The Panel therefore finds that paragraph 4(a)(iii) of the Policy has been satisfied. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name be transferred to the Complainant. /Edoardo Fano/ Edoardo Fano Sole Panelist Date: September 5, 2022
Full & Egal Universal Law Academy