DECISION

 

Morgan Stanley v. Domain Privacy / Domain Name Privacy Inc.

Claim Number: FA2505002158183

 

PARTIES

Complainant is Morgan Stanley ("Complainant"), United States, represented by Eric J. Shimanoff of Cowan, Liebowitz & Latman, P.C., United States. Respondent is Domain Privacy / Domain Name Privacy Inc. ("Respondent"), Cyprus.

 

REGISTRAR AND DISPUTED DOMAIN NAME

The domain name at issue is <morganstanleydatasecuritysettlement.com>, registered with Tucows Domains Inc.

 

PANEL

The undersigned certifies that he has acted independently and impartially and to the best of his knowledge has no known conflict in serving as Panelist in this proceeding.

 

David E. Sorkin as Panelist.

 

PROCEDURAL HISTORY

Complainant submitted a Complaint to Forum electronically on May 29, 2025; Forum received payment on May 29, 2025.

 

On May 30, 2025, Tucows Domains Inc. confirmed by email to Forum that the <morganstanleydatasecuritysettlement.com> domain name is registered with Tucows Domains Inc. and that Respondent is the current registrant of the name. Tucows Domains Inc. has verified that Respondent is bound by the Tucows Domains Inc. registration agreement and has thereby agreed to resolve domain disputes brought by third parties in accordance with ICANN's Uniform Domain Name Dispute Resolution Policy (the "Policy").

 

On May 30, 2025, Forum served the Complaint and all Annexes, including a Written Notice of the Complaint, setting a deadline of June 20, 2025 by which Respondent could file a Response to the Complaint, via email to all entities and persons listed on Respondent's registration as technical, administrative, and billing contacts, and to postmaster@morganstanleydatasecuritysettlement.com. Also on May 30, 2025, the Written Notice of the Complaint, notifying Respondent of the email addresses served and the deadline for a Response, was transmitted to Respondent via post and fax, to all entities and persons listed on Respondent's registration as technical, administrative, and billing contacts.

 

Having received no response from Respondent, Forum transmitted to the parties a Notification of Respondent Default.

 

On June 23, 2025, pursuant to Complainant's request to have the dispute decided by a single-member Panel, Forum appointed David E. Sorkin as Panelist.

 

Having reviewed the communications records, the Administrative Panel (the "Panel") finds that Forum has discharged its responsibility under Paragraph 2(a) of the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") "to employ reasonably available means calculated to achieve actual notice to Respondent" through submission of Electronic and Written Notices, as defined in Rule 1 and Rule 2. Therefore, the Panel may issue its decision based on the documents submitted and in accordance with the ICANN Policy, ICANN Rules, Forum's Supplemental Rules, and any rules and principles of law that the Panel deems applicable, without the benefit of any response from Respondent.

 

RELIEF SOUGHT

Complainant requests that the domain name be transferred from Respondent to Complainant.

 

PARTIES' CONTENTIONS

A. Complainant

Complainant is a global financial, investment, and wealth management services company with offices in more than 40 countries and more than 80,000 employees worldwide. Complainant has used MORGAN STANLEY and related marks in connection with this business since at least as early as 1935. Complainant's MORGAN STANLEY mark is registered in countries around the world, including the United States. Complainant asserts that MORGAN STANLEY mark is famous and has become well known to consumers globally as a result of its extensive use and promotion. Complainant states that it previously settled a class action lawsuit related to data security breach allegations, and that the disputed domain name was used by Complainant or its agents in connection with that settlement prior to its registration by Respondent.

 

The disputed domain name <morganstanleydatasecuritysettlement.com> was registered by Respondent in April 2025. The name is registered in the name of a privacy registration service on behalf of Respondent. The domain name is being used to redirect users to a website that prompts the user to download what is likely malicious software. Complainant states that Respondent is not commonly known by the domain name, has no relationship with Complainant, and is not authorized to use Complainant's mark.

 

Complainant contends on the above grounds that the disputed domain name <morganstanleydatasecuritysettlement.com> is confusingly similar to its MORGAN STANLEY mark; that Respondent lacks rights or legitimate interests in the disputed domain name; and that the disputed domain name was registered and is being used in bad faith.

 

B. Respondent

Respondent failed to submit a Response in this proceeding.

 

FINDINGS

The Panel finds that the disputed domain name is confusingly similar to a mark in which Complainant has rights; that Respondent lacks rights or legitimate interests in respect of the disputed domain name; and that the disputed domain name was registered and is being used in bad faith.

 

DISCUSSION

Paragraph 15(a) of the Rules instructs this Panel to "decide a complaint on the basis of the statements and documents submitted and in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable."

 

Paragraph 4(a) of the Policy requires that Complainant must prove each of the following three elements to obtain an order that a domain name should be cancelled or transferred:

 

(1)       the domain name registered by Respondent is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and

(2)       Respondent has no rights or legitimate interests in respect of the domain name; and

(3)       the domain name has been registered and is being used in bad faith.

 

In view of Respondent's failure to submit a response, the Panel shall decide this administrative proceeding on the basis of Complainant's undisputed representations pursuant to paragraphs 5(f), 14(a), and 15(a) of the Rules and draw such inferences it considers appropriate pursuant to paragraph 14(b) of the Rules. The Panel is entitled to accept all reasonable allegations set forth in a complaint; however, the Panel may deny relief where a complaint contains mere conclusory or unsubstantiated arguments. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, § 4.3 (3d ed. 2017), available at http://www.wipo.int/amc/en/domains/search/overview3.0/; UDRP Perspectives on Recent Jurisprudence, §§ 0.2, 0.8 (updated June 2, 2025), available at https://udrpperspectives.org/; see also eGalaxy Multimedia Inc. v. ON HOLD By Owner Ready To Expire, FA 157287 (Forum June 26, 2003) (dismissing complaint where complainant failed to "produce clear evidence to support its subjective allegations").

 

Identical and/or Confusingly Similar

The disputed domain name <morganstanleydatasecuritysettlement.com> incorporates Complainant's registered MORGAN STANLEY trademark (omitting the space), adding the generic terms "data, "security," and "settlement" and the ".com" top-level domain. These alterations do not substantially diminish the similarity between the domain name and Complainant's mark. See, e.g., Morgan Stanley v. DNS Admin / Buntai LTD / shilei / shi lei, FA 2003019 (Forum Aug. 9, 2022) (finding <morganstanleydadasecuritysettlement.com> and similar domain names confusingly similar to MORGAN STANLEY); Morgan Stanley v. Zhi Qiang Yang / Domain Administrator / 杨智超 / Host Master / Transure Enterprise Ltd, FA 1991414 (Forum June 26, 2022) (finding <morganstableydatasecuritysettlement.com> and similar domain names confusingly similar to MORGAN STANLEY); Morgan Stanley v. Zhi Qiang Yang / Domain Administrator, FA 1990336 (Forum May 18, 2022) (finding <morganstsnleydatasecuritysettlement.com> and similar domain names confusingly similar to MORGAN STANLEY);

Morgan Stanley v. Qian Meng Dan / Zhi Qiang Yang / Domain Administrator / shi lei, FA 1989084 (Forum Apr. 27, 2022) (finding <morganstandleydatasecuritysettlement.com> and similar domain names confusingly similar to MORGAN STANLEY); Morgan Stanley v. Lei Shi / huade wang / Yanli Li / Zhi Qiang Yang / Domain Administrator, FA 1982501 (Forum Mar. 14, 2022) (finding <morganstanleydatasecuritsettlement.com> and similar domain names confusingly similar to MORGAN STANLEY). The Panel considers the disputed domain name to be confusingly similar to a mark in which Complainant has rights.

 

Rights or Legitimate Interests

Under the Policy, the Complainant must first make a prima facie case that the Respondent lacks rights and legitimate interests in the disputed domain name, and then the burden shifts to the Respondent to come forward with concrete evidence of such rights or legitimate interests. See Hanna-Barbera Productions, Inc. v. Entertainment Commentaries, FA 741828 (Forum Aug. 18, 2006).

 

The disputed domain name incorporates Complainant's registered mark without authorization. Its sole apparent use has been to redirect users to a website that attempts to download malware to the user's device. Such use does not give rise to rights or legitimate interests under the Policy. See, e.g., Transamerica Corp. v. Domain Privacy / Domain Name Privacy Inc., FA 2152169 (Forum May 20, 2025) (finding lack of rights or interests in similar circumstances); O'Reilly Automotive, Inc. v. zhang wei / zhangwei, FA 2074508 (Forum Jan. 4, 2024) (same); Morgan Stanley v. Balticsea LLC, FA 1691190 (Forum Oct. 6, 2016) (same).

 

Complainant has made a prima facie case that Respondent lacks rights and legitimate interests in the domain name, and Respondent has failed to come forward with any evidence of such rights or interests. Accordingly, the Panel finds that Complainant has sustained its burden of proving that Respondent lacks rights or legitimate interests in respect of the disputed domain name.

 

Registration and Use in Bad Faith

Finally, Complainant must show that the disputed domain name was registered and is being used in bad faith. Under paragraph 4(b)(iii) of the Policy, bad faith may be shown by evidence that Respondent registered the disputed domain name "primarily for the purpose of disrupting the business of a competitor." Under paragraph 4(b)(iv), bad faith may be shown by evidence that "by using the domain name, [Respondent] intentionally attempted to attract, for commercial gain, Internet users to [Respondent's] web site or other on-line location, by creating a likelihood of confusion with the complainant's mark as to the source, sponsorship, affiliation, or endorsement of [Respondent's] web site or location or of a product or service on [Respondent's] web site or location."

 

Respondent used a privacy service to register a domain name incorporating Complainant's well-known mark, supplying the name and contact information for what the Panel infers to be another privacy registration service for the underlying registration information. The sole apparent use of the domain name has been to redirect users to a website that attempts to download malware to the user's device. Such circumstances are indicative of bad faith registration and use under the Policy. See, e.g., Transamerica Corp. v. Domain Privacy / Domain Name Privacy Inc., supra (Forum May 20, 2025) (malware distribution); Carnival Corp. v. Domain Privacy / Domain Name Privacy Inc., FA 2127387 (Forum Dec. 26, 2024) (use of multiple privacy services); O'Reilly Automotive, Inc. v. zhang wei / zhangwei, FA 2074508 (Forum Jan. 4, 2024) (malware distribution); Morgan Stanley v. Balticsea LLC, FA 1691190 (Forum Oct. 6, 2016) (malware distribution and use of privacy service). The Panel finds that the disputed domain name was registered and is being used in bad faith.

 

DECISION

Having considered the three elements required under the ICANN Policy, the Panel concludes that relief shall be GRANTED.

 

Accordingly, it is Ordered that the <morganstanleydatasecuritysettlement.com> domain name be TRANSFERRED from Respondent to Complainant.

 

 

 

David E. Sorkin, Panelist

Dated: June 23, 2025