DECISION

 

Cencora, Inc. v. Michael Flacks

Claim Number: FA2510002183042

 

PARTIES

Complainant is Cencora, Inc. ("Complainant"), represented by Patrick C. Stephenson, Nebraska, USA. Respondent is Michael Flacks ("Respondent"), Florida, USA.

 

REGISTRAR AND DISPUTED DOMAIN NAME

The domain name at issue is <cancora.co>, registered with Register.com - Network Solutions, LLC.

 

PANEL

The undersigned certifies that they have acted independently and impartially and to the best of their knowledge have no known conflict in serving as Panelist in this proceeding.

 

Steven M. Levy as Panelist.

 

PROCEDURAL HISTORY

Complainant submitted a Complaint to Forum electronically on October 15, 2025; Forum received payment on October 15, 2025.

 

On October 16, 2025, Register.com - Network Solutions, LLC confirmed by e-mail to Forum that the <cancora.co> domain name is registered with Register.com - Network Solutions, LLC and that Respondent is the current registrant of the name. Register.com - Network Solutions, LLC has verified that Respondent is bound by the Register.com - Network Solutions, LLC registration agreement and has thereby agreed to resolve domain disputes brought by third parties in accordance with ICANN's Uniform Domain Name Dispute Resolution Policy (the "Policy").

 

On October 16, 2025, Forum served the Complaint and all Annexes, including a Written Notice of the Complaint, setting a deadline of November 5, 2025 by which Respondent could file a Response to the Complaint, via e-mail to all entities and persons listed on Respondent's registration as technical, administrative, and billing contacts, and to postmaster@cancora.co. Also on October 16, 2025, the Written Notice of the Complaint, notifying Respondent of the e-mail addresses served and the deadline for a Response, was transmitted to Respondent via post and fax, to all entities and persons listed on Respondent's registration as technical, administrative and billing contacts.

 

Having received no response from Respondent, Forum transmitted to the parties a Notification of Respondent Default.

 

On November 6, 2025, pursuant to Complainant's request to have the dispute decided by a single-member Panel, Forum appointed Steven M. Levy as Panelist.

 

Having reviewed the communications records, the Administrative Panel (the "Panel") finds that Forum has discharged its responsibility under Paragraph 2(a) of the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") "to employ reasonably available means calculated to achieve actual notice to Respondent" through submission of Electronic and Written Notices, as defined in Rule 1 and Rule 2. Therefore, the Panel may issue its decision based on the documents submitted and in accordance with the ICANN Policy, ICANN Rules, Forum's Supplemental Rules and any rules and principles of law that the Panel deems applicable, without the benefit of any response from Respondent.

 

RELIEF SOUGHT

Complainant requests that the domain name be transferred from Respondent to Complainant.

 

PARTIES' CONTENTIONS

A. Complainant

Complainant is a global healthcare solutions leader driving innovative partnerships with global manufacturers, providers, and pharmacies to improve product access and efficiency throughout the healthcare supply chain. Complainant has filed dozens of trademark applications throughout the world for the CENCORA mark, many of which have matured to registration (e.g., U.S. Reg. No. 7681254 dated February 4, 2025; European Union Reg. No. 018825817 dated November 8, 2024). It is also the owner of the domain name <cencora.com> which is used for its website and email addresses.

 

The <cancora.co> domain name, created on February 4, 2025, is confusingly similar to the CENCORA mark as it substitutes the second letter in the domain "e" with "a" and adds the generic top-level domain ".co".

 

Respondent has no rights or legitimate interests in the disputed domain name where it is not commonly known by the domain name and its use of the domain name to send phishing emails is not a bona fide offering of goods or services.

 

The disputed domain name was registered and is used in bad faith based on Respondent's prior knowledge of Complainant's mark and based on the above-mentioned phishing activity.

 

B. Respondent

Respondent failed to submit a Response in this proceeding.

 

FINDINGS

-       Complainant owns rights to the CENCORA mark and the <cancora.co> domain name is identical or confusingly similar to the mark;

-       Respondent is not commonly known by the disputed domain name and its perpetuation of a phishing scheme indicates that it is not making a bona fide offering of goods or services and that it is not making a legitimate noncommercial or fair use; and

-       The disputed domain name was registered and is used in bad faith based on Respondent's impersonation of Complainant through a phishing scheme.

 

DISCUSSION

Paragraph 15(a) of the Rules instructs this Panel to "decide a complaint on the basis of the statements and documents submitted and in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable."

 

Paragraph 4(a) of the Policy requires that Complainant must prove each of the following three elements to obtain an order that a domain name should be cancelled or transferred:

 

(1)       the domain name registered by Respondent is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and

(2)       Respondent has no rights or legitimate interests in respect of the domain name; and

(3)       the domain name has been registered and is being used in bad faith.

 

In view of Respondent's failure to submit a response, the Panel shall decide this administrative proceeding on the basis of Complainant's undisputed representations pursuant to paragraphs 5(f), 14(a) and 15(a) of the Rules and draw such inferences it considers appropriate pursuant to paragraph 14(b) of the Rules.  The Panel is entitled to accept all reasonable allegations set forth in a complaint; however, the Panel may deny relief where a complaint contains mere conclusory or unsubstantiated arguments. See WIPO Jurisprudential Overview 3.0 at ¶ 4.3; see also eGalaxy Multimedia Inc. v. ON HOLD By Owner Ready To Expire, FA 157287 (Forum June 26, 2003) ("Because Complainant did not produce clear evidence to support its subjective allegations [. . .] the Panel finds it appropriate to dismiss the Complaint").

 

Identical and/or Confusingly Similar

Complainant asserts rights in its CENCORA mark through its registrations in many jurisdictions, including the United States and the European Union. Registration of a mark in this manner is a valid showing of rights in a mark under Policy ¶ 4(a)(i). See Red Hat, Inc. v. Muhammad Shahzad, FA 1787738 (Forum June 19, 2018) ("Registration of a mark with multiple trademark agencies is sufficient to demonstrate rights to a mark per Policy ¶ 4(a)(i)."). Here, Complainant provides the details of its trademark registrations¹ and the Panel finds that Complainant has rights in the CENCORA mark under Policy ¶ 4(a)(i).

 

Next, Complainant argues that Respondent's <cancora.co> domain name is confusingly similar to the CENCORA mark. Under Policy ¶ 4(a)(i), altering letters in a trademark, along with adding a TLD, is typically insufficient to differentiate a disputed domain name from the asserted mark. See Novartis AG v. Domain Privacy LTD, UDRP-106373 (CAC May 5, 2024) ("The Panel observes that the single difference in this case is the omission of the letter 'r'. Misspellings are immaterial. Where the relevant trademark is recognizable within the disputed domain name it is sufficient to establish confusing similarity."). See also Blue Cross and Blue Shield Association v. Shi Lei aka Shilei, FA 1784643 (Forum June 18, 2018) ("A TLD (whether a gTLD, sTLD or ccTLD) is disregarded under a Policy ¶ 4(a)(i) analysis because domain name syntax requires TLDs."). The <cancora.co> domain name replaces the first letter "e" in the CENCORA mark with the letter "a" and adds the ".co" TLD. These minimal changes do not reduce confusion and the mark is clearly recognizable in the disputed domain name. As such, the Panel finds that Respondent's domain name is confusingly similar to Complainant's mark under Policy ¶ 4(a)(i).

 

Rights or Legitimate Interests

Complainant must first make a prima facie case that Respondent lacks rights and legitimate interests in the disputed domain name under Policy ¶ 4(a)(ii). Should it succeed in this effort, the burden then shifts to Respondent to show that it does have rights or legitimate interests. See Advanced International Marketing Corporation v. AA-1 Corp, FA 780200 (Forum Nov. 2, 2011) (finding that a complainant must offer some evidence to make its prima facie case and satisfy Policy ¶ 4(a)(ii)); see also Neal & Massey Holdings Limited v. Gregory Ricks, FA 1549327 (Forum Apr. 12, 2014) ("Under Policy ¶ 4(a)(ii), Complainant must first make out a prima facie case showing that Respondent lacks rights and legitimate interests in respect of an at-issue domain names and then the burden, in effect, shifts to Respondent to come forward with evidence of its rights or legitimate interests.").

 

Complainant first contends that Respondent lacks rights or legitimate interests in the disputed domain name as Respondent is not commonly known by the domain name. It is widely accepted that WHOIS information can be used to help determine whether a respondent is commonly known by a disputed domain name under Policy ¶ 4(c)(ii). See Amazon Technologies, Inc. v. Timothy Mays aka Linda Haley aka Edith Barberdi, FA 1617061 (Forum June 9, 2015) (concluding that the respondent was not commonly known by the <amazondevice.org>, <amazondevices.org>, and <buyamazondevices.com> domain names under Policy ¶ 4(c)(ii), as the pertinent WHOIS information identified "Timothy Mays", "Linda Haley", and "Edith Barberdi" as the respective registrants). Here, the WHOIS information for the disputed domain name, as verified to Forum by the concerned Registrar, identifies the Registrant Name as "Michael Flacks". As Respondent has filed no Response or made any other submission in this case, there is no evidence to suggest that it is known otherwise. In light of the evidence presented, the Panel finds no ground upon which to conclude that Respondent is commonly known by the disputed domain name per Policy ¶ 4(c)(ii).

 

Next, Complainant notes that the disputed domain name resolves to a website that displays the message "Error 1001. DNS Resolution error" and also claims that Respondent has used the disputed domain name to send emails that impersonate one of Complainant's employees in an attempt to defraud the Complainant's customers.

 

A Respondent failing to make use of a confusingly similar domain name in relation to a website typically indicates a lack of a bona fide offering of goods or services or a legitimate noncommercial or fair use per Policy ¶¶ 4(c)(i) or (iii). See Kohler Co. v xi long chen, FA 1737910 (Forum Aug. 4, 2017) ("Respondent has not made a bona fide offering of goods or services, or a legitimate non-commercial or fair use of the domain.  Respondent's <kohler-corporation.com> resolves to an inactive webpage displaying the message 'website coming soon!'"). See also Activision Blizzard, Inc. / Activision Publishing, Inc. / Blizzard Entertainment, Inc. v. Cimpress Schweiz GmbH, FA 1737429 (Forum Aug. 3, 2017) ("Complainant insists that Respondent has made no demonstrable preparations to use the disputed domain name. When Respondent is not using the disputed domain name in connection with an active website, the Panel may find that Respondent is not using the disputed domain name for a bona fide offering of goods or services… As Respondent has not provided a response to this action, Respondent has failed to meet its burden regarding proof of any rights or legitimate interest in the disputed domain."). Here, the disputed domain resolve to an "Error" page and so this provides no help to Respondent.

 

Additionally, using a confusingly similar domain name to impersonate an employee of a complainant in an attempt to defraud its customers, vendors, or other business partners is clearly not a bona fide offering of goods or services or a legitimate noncommercial or fair use per Policy ¶¶ 4(c)(i) or (iii). See Goodwin Procter LLP v. GAYLE FANDETTI, FA 1738231 (Forum Aug. 8, 2017) (Where "Respondent has used the name to pass themselves off as an employee of the Complainant in an attempt to commit fraud by redirecting a legitimate wire of funds", the Panel concluded that "it cannot have been registered for a legitimate purpose."). Here, Complainant submits copies of a series of phishing emails that the Respondent sent using an address which incorporates the disputed domain name. This was sent to one of the Complainant's customers and Respondent poses as an Accounts Receivable Clerk in Complainant's Collections Operations department. The first message states that "we have recently changed our banking relationship" and asks that "future payments be processed to our new bank via ACH to make the reconciliation process easier." The emails use a signature block that displays the impersonated employee's name and title, the CENCORA graphic logo, and certain phone numbers. The chain of email correspondence goes on for several months and Complainant notes that "Respondent successfully deceived the customer into transferring over $30,000…"

 

As Complainant has made out a prima facie case that has not been rebutted by Respondent, upon a preponderance of the available evidence the Panel finds that Respondent fails to make a bona fide offering of goods or services or a legitimate noncommercial or fair use of the disputed domain name per Policy ¶¶ 4(c)(i) or (iii).

 

Registration and Use in Bad Faith

Complainant contends that Respondent registered the <cancora.co> domain name with actual knowledge of Complainant's rights in the CENCORA mark. A respondent's actual knowledge can form a solid foundation upon which a case for bad faith may be built under Policy ¶ 4(a)(iii). See Orbitz Worldwide, LLC v. Domain Librarian, FA 1535826 (Forum Feb. 6, 2014) ("the Panel here finds actual knowledge through the name used for the domain and the use made of it"). Complainant claims that its mark is well known as supported by it being ranked 10th on the Fortune 500 list, ranked 18th on the Global Fortune 500 list, and it earning annual revenue exceeding USD $290 billion. It also submits a 2023 press release announcing its company name change and adoption of the CENCORA name. While this evidence of Complainant's brand reputation is rather thin, the Panel finds far more persuasive Respondent's use of the mark for phishing emails which clearly shows its familiarity with Complainant and its mark. Thus, the Panel finds that Respondent did have actual knowledge of Complainant's rights in its mark at the time that it registered the disputed domain name.

 

Next, bad faith is asserted based on Respondent's use of the disputed domain name in furtherance of a phishing scheme. A Respondent's use of a disputed domain name in an e-mail address to pass itself off as a complainant in a phishing scheme is persuasive evidence of bad faith registration and use under Policy ¶ 4(b)(iv). See Smiths Group plc v. Snooks, FA 1372112 (Forum Mar. 18, 2011) (finding that the respondent's attempt to impersonate an employee of the complainant was evidence of bad faith registration and use under Policy ¶ 4(a)(iii)); see also SHUAA Capital psc v. Oba Junkie / shuaa capital psc, FA 1581255 (Forum Oct. 29, 2014) ("The Panel finds that Respondent's use of the domain name's e-mail suffix for fraudulent purposes illustrates Policy ¶ 4(a)(iii) bad faith."). Here, as noted above, the submitted emails sent from the disputed domain name show an unfortunately successful attempt to impersonate one of Complainant's employees and defraud a customer of substantial funds. This evidence leads the Panel to determine that Respondent registered and uses the disputed domain name in bad faith to attract commercial gain by creating a likelihood of confusion with Complainant's mark under ¶ 4(b)(iv).

 

Complainant further argues that "[b]ad faith is also demonstrated by Respondent's failure to make an active use to the Disputed Domain Name and is engaging in typosquatting…" While the Panel notes the submitted screenshot of the <cancora.co> domain shows an error message, it finds that the disputed domain name has not been unused or held passively due to its actual use in connection with Respondent's phishing scheme.

 

However, typosquatting itself is very often an indicator of bad faith. See Cost Plus Management Services, Inc. v. xushuaiwei, FA 1800036 (Forum Sep. 7, 2018) ("Typosquatting itself is evidence of relevant bad faith registration and use."); Gap Inc. and its subsidiary, Old Navy (Apparel), LLC v. Jiri Capcuch, FA 1562139 (Forum July 2, 2014) ("Respondent adds an additional letter 'v' to Complainant's OLD NAVY mark in the <oldnavvy.com> domain name, a classic example of typosquatting. Respondent's typosquatting is, in itself, evidence of bad faith under Policy ¶ 4(a)(iii)."). The Panel notes the one-character difference between Complainant's CENCORA mark and the <cancora.co> domain name. Thus, it finds further support for the conclusion that Respondent registered and uses the disputed domain name in bad faith.

 

DECISION

Having established all three elements required under the ICANN Policy, the Panel concludes that relief shall be GRANTED.

 

Accordingly, it is Ordered that the <cancora.co> domain name be TRANSFERRED from Respondent to Complainant.

 

__________________________________________________________________

 

 

 

Steven M. Levy, Panelist

Dated: November 10, 2025