ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION LastPass US LP v. Nanci Nette, Name Management Group Case No. DCO2023-0070 1. The Parties Complainant is LastPass US LP, United States of America, represented by Day Pitney LLP, United States of America. Respondent is Nanci Nette, Name Management Group, United States of America. 2. The Domain Name and Registrar The disputed domain name (the "Domain Name") is registered with Dynadot, Inc. (the "Registrar"). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the "Center") on August 4, 2023. On August 7, 2023, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Domain Name. On August 7, 2023, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Domain Name which differed from the named Respondent (Redacted for Privacy) and contact information in the Complaint. The Center sent an email communication to Complainant on August 9, 2023 providing the registrant and contact information disclosed by the Registrar, and inviting Complainant to submit an amendment to the Complaint. Complainant filed an amended Complaint on August 9, 2023. The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the "Policy" or "UDRP"), the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules"), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the "Supplemental Rules"). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on August 10, 2023. In accordance with the Rules, paragraph 5, the due date for Response was August 30, 2023. Respondent did not submit any response. Accordingly, the Center notified Respondent's default on August 31, 2023. page 2 The Center appointed Kimberley Chen Nobles as the sole panelist in this matter on September 21, 2023. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background Complainant, founded in 2008, is a provider of password management and computer security tools, with over 33 million personal users and 100,000 business users worldwide. Complainant has used the LASTPASS trademark both in the United States and internationally, and owns trademark registrations for the LASTPASS mark in the United States and internationally, including: - United States trademark number 4514427 for LASTPASS word mark, registered on April 15, 2014; - Australian trademark number 1840784 for LASTPASS word mark, registered on January 17, 2017; - Canadian trademark number TMA1042981 for LASTPASS word mark, registered on July 19, 2019; - European Union Trade Mark number 1341702 for LASTPASS word mark, registered on January 17, 2017; and - United Kingdom trademark number UK00801341702 for LASTPASS word mark, registered on October 3, 2017. Complainant also owns and operates the domain name , which was registered on March 8, 2005, and on which Complainant's first offered its password manager products in April 2008. The Domain Name was registered on September 18, 2016. At the time of the filing of the Complaint, the Domain Name redirected Internet users to several different websites at different times - depending on the browser used - such as "www.r.zredirect.com"; "www.get.shoppermeet.net"; and "www.linkbux.com", before directing to Complainant's website at "www.lastpass.com". On a secure Firefox browser, the site on which the Domain Name reverts to is blocked as a "HIGH RISK WEBSITE" due to the threat of "Mal/HTMLGen-A malware," suggesting the use of the Domain Name to distribute malware. Accessing the website via Chrome led to a "Security threat detected" warning. The site that the Domain Name directs to is also configured for email capabilities. 5. Parties' Contentions A. Complainant Complainant contends that (i) the Domain Name is identical or confusingly similar to Complainant's trademarks; (ii) Respondent has no rights or legitimate interests in the Domain Name; and (iii) Respondent registered and is using the Domain Name in bad faith. In particular, Complainant contends that it has trademark registrations for LASTPASS and that Respondent registered and is using the Domain Name with the intention to confuse Internet users looking for bona fide and well-known LASTPASS products and services. Complainant notes that it has no affiliation with Respondent, nor authorized Respondent to register or use a domain name, which includes Complainant's trademark, and that Respondent has no rights or legitimate interests in the registration and use of the Domain Name. Rather, Complainant contends that Respondent has acted in bad faith in registering and setting up the Domain Name, when Respondent clearly knew of Complainant's rights. B. Respondent Respondent did not reply to Complainant's contentions. page 3 6. Discussion and Findings Under paragraph 4(a) of the Policy, to succeed Complainant must satisfy the Panel that: (i) the Domain Name is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and (ii) Respondent has no rights or legitimate interests in respect of the Domain Name; and (iii) the Domain Name was registered and is being used in bad faith. Section 4.3 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition ("WIPO Overview 3.0") states that failure to respond to the complainant's contentions would not by itself mean that the complainant is deemed to have prevailed; a respondent's default is not necessarily an admission that the complainant's claims are true. Thus, although in this case Respondent has failed to respond to the Complaint, the burden remains with Complainant to establish the three elements of paragraph 4(a) of the Policy by a preponderance of the evidence. See, e.g., The Knot, Inc. v. In Knot We Trust LTD, WIPO Case No. D2006-0340. A. Identical or Confusingly Similar Ownership of a trademark registration is generally sufficient evidence that a complainant has the requisite rights in a mark for purposes of paragraph 4(a)(i) of the Policy. See WIPO Overview 3.0, section 1.2.1. Complainant provided evidence of its rights in the LASTPASS trademarks, as noted above. Complainant has also submitted evidence, which supports that the LASTPASS trademarks are widely known and a source identifier of Complainant's products and services. Complainant has therefore proven that it has the requisite rights in the LASTPASS trademarks. With Complainant's rights in the LASTPASS trademarks established, the remaining question under the first element of the Policy is whether the Domain Name, typically disregarding the Top-Level Domain ("TLD") in which it is registered (in this case, ".co"), is identical or confusingly similar to Complainant's trademark. See, e.g., B & H Foto & Electronics Corp. v. Domains by Proxy, Inc. / Joseph Gross, WIPO Case No. D2010-0842. The Domain Name incorporates Complainant's LASTPASS trademark in this entirety. Hence, the Domain Name is identical to Complainant's LASTPASS trademark. Thus, the Panel finds that Complainant has satisfied the first element of the Policy. B. Rights or Legitimate Interests Under paragraph 4(a)(ii) of the Policy, a complainant must make a prima facie showing that a respondent possesses no rights or legitimate interests in a disputed domain name. See, e.g., Malayan Banking Berhad v. Beauty, Success & Truth International, WIPO Case No. D2008-1393. Once a complainant makes such a prima facie showing, the burden of production shifts to the respondent, though the burden of proof always remains on the complainant. If the respondent fails to come forward with relevant evidence showing rights or legitimate interests, the complainant will have sustained its burden under the second element of the UDRP. From the record in this case, it is evident that Respondent was, and is, aware of Complainant and its LASTPASS trademarks, and does not have any rights or legitimate interests in the Domain Name. Complainant has confirmed that Respondent is not affiliated with Complainant, or otherwise authorized or licensed to use the LASTPASS trademarks or to seek registration of any domain name incorporating the trademarks. Respondent is also not known to be associated with the LASTPASS trademarks, and there is no evidence showing that Respondent has been commonly known by the Domain Name. page 4 In addition, Respondent has not used the Domain Name in connection with a bona fide offering of goods or services or a legitimate noncommercial or fair use. Rather, at the time of the filing of the Complaint, the Domain Name redirected Internet users to several different websites at different times - depending on the browser used - such as "www.r.zredirect.com"; "www.get.shoppermeet.net"; and "www.linkbux.com", before directing to Complainant's website at "www.lastpass.com". On a secure Firefox browser, the site on which the Domain Name reverts to is blocked as a "HIGH RISK WEBSITE" due to the threat of "Mal/HTMLGen-A malware," suggesting the use of the Domain Name to distribute malware. Accessing the website via Chrome led to a "Security threat detected" warning. The site that the Domain Name directs to is also configured for email capabilities. Such use does not constitute a bona fide offering of goods or services or a legitimate noncommercial or fair use and cannot under the circumstances confer on Respondent any rights or legitimate interests in the Domain Name. See, e.g., Intesa Sanpaolo S.p.A. v. Charles Duke / Oneandone Private Registration, WIPO Case No. D2013-0875. Accordingly, Complainant has provided evidence supporting its prima facie claim that Respondent lacks any rights or legitimate interests in the Domain Name. Respondent has failed to produce countervailing evidence of any rights or legitimate interests in the Domain Name. Thus, the Panel concludes that Respondent does not have any rights or legitimate interests in the Domain Name and Complainant has met its burden under paragraph 4(a)(ii) of the Policy. C. Registered and Used in Bad Faith The Panel finds that Respondent's actions indicate that Respondent registered and is using the Domain Name in bad faith. Paragraph 4(b) of the Policy provides a non-exhaustive list of circumstances indicating bad faith registration and use on the part of a domain name registrant, namely: "(i) circumstances indicating that you have registered or you have acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trademark or service mark or to a competitor of that complainant, for valuable consideration in excess of your documented out-of-pocket costs directly related to the domain name; or (ii) you have registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that you have engaged in a pattern of such conduct; or (iii) you have registered the domain name primarily for the purpose of disrupting the business of a competitor; or (iv) by using the domain name, you have intentionally attempted to attract, for commercial gain, Internet users to your web site or other on-line location, by creating a likelihood of confusion with the complainant's mark as to the source, sponsorship, affiliation, or endorsement of your website or location or of a product or service on your web site or location." The Panel finds that Complainant has provided ample evidence to show that registration and use of the LASTPASS trademarks long predate the registration of the Domain Name. Complainant is also well established and known. Indeed, the record shows that Complainant's LASTPASS trademarks and related products and services are widely known and recognized. Therefore, Respondent was likely aware of the LASTPASS trademarks when Respondent registered the Domain Name, or knew or should have known that the Domain Name was identical to Complainant's trademarks. See WIPO Overview 3.0, section 3.2.2; see also TTT Moneycorp Limited v. Privacy Gods / Privacy Gods Limited, WIPO Case No. D2016-1973. page 5 The Panel therefore finds that Respondent's awareness of Complainant's trademark rights at the time of registration suggests bad faith. See Red Bull GmbH v. Credit du Léman SA, Jean-Denis Deletraz, WIPO Case No. D2011-2209; Nintendo of America Inc v. Marco Beijen, Beijen Consulting, Pokemon Fan Clubs Org., and Pokemon Fans Unite, WIPO Case No. D2001-1070; BellSouth Intellectual Property Corporation v. Serena, Axel, WIPO Case No. D2006-0007. Further, the registration of the Domain Name incorporating Complainant's LASTPASS trademark in its entirety suggests Respondent's actual knowledge of Complainant's rights in the LASTPASS trademarks at the time of registration of the Domain Name and its effort to opportunistically capitalize on the registration and use of the Domain Name. Moreover, at the time of the filing of the Complaint, the Domain Name redirected Internet users to several different websites at different times - depending on the browser used - such as "www.r.zredirect.com"; "www.get.shoppermeet.net"; and "www.linkbux.com", before directing to Complainant's website at "www.lastpass.com". On a secure Firefox browser, the site on which the Domain Name reverts to is blocked as a "HIGH RISK WEBSITE" due to the threat of "Mal/HTMLGen-A malware," suggesting the use of the Domain Name to distribute malware, as well as attempting to deceive unsuspecting Internet users into providing sensitive personal information. In addition, accessing the website via Chrome led to a "Security threat detected" warning. The site that the Domain Name directs to is also configured for email capabilities, which suggests that emails may be sent from an identical domain, that is, @lastpass.co, resulting in causing confusing among consumers who may mistakenly perceive such emails as originating from Complainant's own @lastpass.com email address. Such use of the Domain Name may not only cause harm to consumers, but also result in causing harm to Complainant and its reputation, disrupting Complainant's business, and tarnishing its good will. Finally, the Panel also notes the reputation of the LASTPASS trademarks, Respondent's pattern of bad faith registration and use of domain names, and the failure of Respondent to submit a response to the Complaint. Accordingly, the Panel finds that Respondent has registered and is using the Domain Name in bad faith and Complainant succeeds under the third element of paragraph 4(a) of the Policy. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Domain Name be transferred to Complainant. /Kimberley Chen Nobles/ Kimberley Chen Nobles Sole Panelist Date: October 2, 2023
Full & Egal Universal Law Academy