Bitwarden, Inc. v. Nick Nijal
Claim Number: FA2302002031476
Complainant is Bitwarden, Inc. (“Complainant”), represented by Christine B Redfield of Redfield IP PC, United States of America. Respondent is Nick Nijal (“Respondent”), GB.
REGISTRAR AND DISPUTED DOMAIN NAME
The domain name at issue is <vault-bitwerden.com> (“Domain Name”), registered with Registrar of Domain Names REG.RU LLC.
The undersigned certifies that he has acted independently and impartially and to the best of his knowledge has no known conflict in serving as Panelist in this proceeding.
Nicholas J.T. Smith as Panelist.
Complainant submitted a Complaint to Forum electronically on February 10, 2023; Forum received payment on February 10, 2023. The Complaint was received in both Russian and English.
On February 13, 2023, Registrar of Domain Names REG.RU LLC confirmed by e-mail to Forum that the <vault-bitwerden.com> domain name is registered with Registrar of Domain Names REG.RU LLC and that Respondent is the current registrant of the name. Registrar of Domain Names REG.RU LLC has verified that Respondent is bound by the Registrar of Domain Names REG.RU LLC registration agreement and has thereby agreed to resolve domain disputes brought by third parties in accordance with ICANN’s Uniform Domain Name Dispute Resolution Policy (the “Policy”).
On February 20, 2023, Forum served the Russian language Complaint and all Annexes, including a Russian language Written Notice of the Complaint, setting a deadline of March 13, 2023 by which Respondent could file a Response to the Complaint, via e-mail to all entities and persons listed on Respondent’s registration as technical, administrative, and billing contacts, and to postmaster@vault-bitwerden.com. Also on February 20, 2023, the Russian language Written Notice of the Complaint, notifying Respondent of the e-mail addresses served and the deadline for a Response, was transmitted to Respondent via post and fax, to all entities and persons listed on Respondent’s registration as technical, administrative and billing contacts.
Having received no response from Respondent, Forum transmitted to the parties a Notification of Respondent Default.
On March 21, 2022, pursuant to Complainant's request to have the dispute decided by a single-member Panel, Forum appointed Nicholas J.T. Smith as Panelist.
Having reviewed the communications records, the Administrative Panel (the "Panel") finds that Forum has discharged its responsibility under Paragraph 2(a) of the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") "to employ reasonably available means calculated to achieve actual notice to Respondent" through submission of Electronic and Written Notices, as defined in Rule 1 and Rule 2. Therefore, the Panel may issue its decision based on the documents submitted and in accordance with the ICANN Policy, ICANN Rules, Forum's Supplemental Rules and any rules and principles of law that the Panel deems applicable, without the benefit of any response from Respondent.
The language of the Registration Agreement in this case is Russian. The Complaint has been provided in English and Russian and Complainant has indicated that pursuant to UDRP Rule 11(a) the language of the proceeding should be English.
Pursuant to Rule 11(a), the Panel determines that the language requirement has been satisfied through the Russian-language Complaint and Commencement Notification, and, absent a formal Response, determines that the remainder of the proceedings may be conducted in English.
Complainant requests that the Domain Name be transferred from Respondent to Complainant.
A. Complainant
Complainant, Bitwarden, Inc., offers password management solutions and related software. Complainant has rights in the BITWARDEN mark through registration with multiple national bodies including the United States Patent and Trademark Office (“USPTO”) (e.g. Reg. No. 5,580,631, registered on October 9, 2018). Respondent’s <vault-bitwerden.com> domain name is confusingly similar to Complainant’s mark as it consists of a minor misspelling of the mark (replacing the letter “a” in BITWARDEN with the letter “e”) while adding the term “vault”, a hyphen, and the “.com” generic top-level domain (“gTLD”).
Respondent lacks rights and legitimate interests in the <vault-bitwerden.com> domain name. Respondent is not commonly known by the di Domain Name, nor has Complainant authorized or licensed Respondent to use its BITWARDEN mark in the Domain Name. Respondent also does not use the Domain Name in connection with a bona fide offering of goods or services or legitimate noncommercial or fair use. Rather, Respondent uses the Domain Name to impersonate Complainant and phishes for user information on the website to which the Domain Name resolved prior to the commencement of the proceeding (“Respondent’s Website”).
Respondent registered and uses the <vault-bitwerden.com> domain name in bad faith. Respondent uses the Domain Name in order to pass off as Complainant by creating a log-in page featuring Complainant’s BITWARDEN Mark and logo to that closely resembles Complainant’s log-in page. Respondent uses this website in order to access Complainant’s customer account details in connection with a phishing scheme. Given the use of the Domain Name for this purpose Respondent had actual notice of Complainant’s rights in the BITWARDEN mark at the time of registration of the Domain Name.
B. Respondent
Respondent failed to submit a Response in this proceeding.
Complainant holds trademark rights for the BITWARDEN mark. The Domain Name is confusingly similar to Complainant’s BITWARDEN mark. Complainant has established that Respondent lacks rights or legitimate interests in the use of the Domain Name and that Respondent registered and has used the Domain Name in bad faith.
Paragraph 15(a) of the Rules instructs this Panel to "decide a complaint on the basis of the statements and documents submitted in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable."
Paragraph 4(a) of the Policy requires that Complainant must prove each of the following three elements to obtain an order that a domain name should be cancelled or transferred:
(1) the domain name registered by Respondent is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and
(2) Respondent has no rights or legitimate interests in respect of the domain name; and
(3) the domain name has been registered and is being used in bad faith.
In view of Respondent's failure to submit a response, the Panel shall decide this administrative proceeding on the basis of Complainant's undisputed representations pursuant to paragraphs 5(f), 14(a) and 15(a) of the Rules and draw such inferences it considers appropriate pursuant to paragraph 14(b) of the Rules. The Panel is entitled to accept all reasonable allegations set forth in a complaint; however, the Panel may deny relief where a complaint contains mere conclusory or unsubstantiated arguments. See WIPO Jurisprudential Overview 3.0 at ¶ 4.3; see also eGalaxy Multimedia Inc. v. ON HOLD By Owner Ready To Expire, FA 157287 (Forum June 26, 2003) (“Because Complainant did not produce clear evidence to support its subjective allegations [. . .] the Panel finds it appropriate to dismiss the Complaint”).
Complainant has rights in the BITWARDEN mark through its registration with the USPTO (e.g., Reg. No. 5,580,631, registered on October 9, 2018). Registration of a mark with the USPTO is sufficient to establish rights in that mark. See Liberty Global Logistics, LLC v. damilola emmanuel / tovary services limited, FA 1738536 (Forum Aug. 4, 2017) (stating, “Registration of a mark with the USPTO sufficiently establishes the required rights in the mark for purposes of the Policy.”).
The Panel finds that the <vault-bitwerden.com> domain name is confusingly similar to Complainant’s BITWARDEN mark as it consists of a minor misspelling of the BITWARDEN mark (replacing the letter “a” in BITWARDEN with the letter “e”) with the addition of a hyphen, the descriptive term “vault” and the “.com” generic top-level domain (“gTLD”). The addition of a generic term (and a hyphen) along with a gTLD to a wholly incorporated trade mark does not distinguish a disputed domain name from a mark. See Wiluna Holdings, LLC v. Edna Sherman, FA 1652781 (Forum Jan. 22, 2016) (finding the addition of a generic term and gTLD is insufficient to distinguish a disputed domain name from a mark under Policy ¶ 4(a)(i)); see also Pirelli & C. S.p.A. v. Tabriz, FA 921798 (Apr. 12, 2007) (finding that the addition of a hyphen between terms of a registered mark did not differentiate the <p-zero.org> domain name from the P ZERO mark under Policy ¶ 4(a)(i)). Neither does the purposeful misspelling of a mark distinguish a disputed domain name from a mark under Policy ¶ 4(a)(i). See Morgan Stanley v. Domain Admin / Whois Privacy Corp., FA 1783121 (Forum June 1, 2018) (“Respondent’s <morganstanle.com> domain name is confusingly similar to Complainant’s MORGAN STANLEY mark as it wholly incorporates the mark, but for the omission of the letter ‘y’ and spacing within the mark, and appends the ‘.com’ gTLD.”); see also OpenTable, Inc. v. Above.com Domain Privacy, FA 1626187 (Forum Aug. 10, 2015 (“Respondent’s <oipentable.com> domain name is confusingly similar to the OPENTABLE mark under Policy ¶ 4(a)(i) because the disputed domain merely adds the letter ‘i’ … ”)
Complainant alleges that Respondent holds no rights or legitimate interests in the Domain Name. In order for Complainant to succeed under this element, it must first make a prima facie case that Respondent lacks rights and legitimate interests in the Domain Name under Policy ¶ 4(a)(ii), and then the burden shifts to Respondent to show it does have rights or legitimate interests. See Hanna-Barbera Prods., Inc. v. Entm’t Commentaries, FA 741828 (Forum Aug. 18, 2006) and AOL LLC v. Gerberg, FA 780200 (Forum Sept. 25, 2006) (“Complainant must first make a prima facie showing that Respondent does not have rights or legitimate interest in the subject domain names, which burden is light. If Complainant satisfies its burden, then the burden shifts to Respondent to show that it does have rights or legitimate interests in the subject domain names.”). The Panel holds that Complainant has made out a prima facie case.
Complainant asserts that Respondent has no rights or legitimate interests in the Domain Name as Respondent is not commonly known by the Domain Name, nor has Complainant authorized Respondent to use the BITWARDEN mark. Respondent has no relationship, affiliation, connection, endorsement or association with Complainant. WHOIS information can help support a finding that a respondent is not commonly known by the disputed domain name, especially where a privacy service has been engaged. See State Farm Mutual Automobile Insurance Company v. Dale Anderson, FA1504001613011 (Forum May 21, 2015) (concluding that because the WHOIS record lists “Dale Anderson” as the registrant of the disputed domain name, the respondent was not commonly known by the <statefarmforum.com> domain name pursuant to Policy ¶ 4(c)(ii)); see also Kohler Co. v. Privacy Service, FA1505001621573 (Forum July 2, 2015) (holding that the respondent was not commonly known by the disputed domain name pursuant to Policy ¶ 4(c)(ii) where “Privacy Service” was listed as the registrant of the disputed domain name). The WHOIS lists “Nick Nijal” as registrant of record. Coupled with Complainant’s unrebutted assertions as to absence of any affiliation or authorization between the parties, the Panel finds that Respondent is not commonly known by the Domain Name in accordance with Policy ¶ 4(c)(ii).
The Domain Name is presently inactive but prior to the commencement of the proceeding resolved to the Respondent’s Website that impersonated the log-in page on Complainant’s official website by reproducing the BITWARDEN mark and logo. It contained a log-in page where visitors were directed to provide their e-mail address, name, and BITWARDEN master password, which if provided could potentially enable Respondent to log into their accounts with Complainant and access all passwords held and managed by Complainant for that particular individual. Such conduct is best characterized as “phishing”. Respondent’s use of the Domain Name to impersonate Complainant for the purpose of engaging in a phishing scheme to acquire personal and confidential information is not a bona fide offering of goods or services or a legitimate noncommercial or fair use per Policy ¶¶ 4(c)(i) or (iii). See Bittrex, Inc. v. Caroline Alves Maia, FA 1796113 (Forum Aug. 6, 2018) (finding the respondent lacked rights and legitimate interests in the domain name because it used the name to resolve to a website virtually identical to the complainant’s to prompt users to enter their login information so that the respondent may gain access to that customer’s cryptocurrency account); see also Caterpillar Inc. v. ruth weinstein, FA 1770352 (Forum Mar. 7, 2018) (“Use of a disputed domain name in an attempt to pass itself off as a complainant and to conduct a phishing scheme is indicative of a failure to use said domain name in connection with a bona fide offer of goods and services per Policy ¶ 4(c)(i) or a legitimate noncommercial or otherwise fair use per Policy ¶ 4(c)(iii).”)
The Panel finds Complainant has satisfied Policy ¶ 4(a)(ii).
The Panel finds that, at the time Respondent registered the Domain Name, February 7, 2023, Respondent had actual knowledge of Complainant’s BITWARDEN mark. The Respondent used the Domain Name to pass itself off as Complainant for financial gain or to disrupt Complainant’s business. In the absence of rights or legitimate interests of its own, this demonstrates registration in bad faith under Policy ¶ 4(a)(iii).
The Panel finds that Respondent registered and used the Domain Name in bad faith as Respondent used the Domain Name to impersonate Complainant in furtherance of a phishing scheme. Use of a disputed domain name to impersonate a complainant in furtherance of a phishing scheme is evidence of bad faith per Policy ¶ 4(a)(iii). See Google Inc. v. Domain Admin / Whois Privacy Corp., FA1506001622862 (Forum Aug. 10, 2015) (finding that the respondent’s apparent use of the disputed domain name in furtherance of a ‘phishing’ scheme further established its bad faith registration and use of the disputed domain name under Policy ¶ 4(a)(iii)). Accordingly, the Panel finds that Respondent registered and uses the Domain Name in bad faith pursuant to Policy ¶ 4(a)(iii).
Having established all three elements required under the ICANN Policy, the Panel concludes that relief shall be GRANTED.
Accordingly, it is Ordered that the <vault-bitwerden.com> domain name be TRANSFERRED from Respondent to Complainant.
Nicholas J.T. Smith, Panelist
Dated: March 22, 2023
Click Here to return to the main Domain Decisions Page.
Click Here to return to our Home Page