WIPO Arbitration and Mediation Center

ADMINISTRATIVE PANEL DECISION

WhatsApp Inc. v. Domain Admin, WhoIs IDC Privacy Service c/o IDC (BVI) Limited / Jose Pedroza

Case No. D2019-1035

1. The Parties

Complainant is WhatsApp Inc., United States of America (“United States”), represented by Hogan Lovells (Paris) LLP, France.

Respondent is Domain Admin, WhoIs IDC Privacy Service c/o IDC (BVI) Limited, United Kingdom / Jose Pedroza, United States.

2. The Domain Name and Registrar

The disputed domain name <whatsapphackonline.net> (the “Disputed Domain Name”) is registered with NetEarth One Inc. d/b/a NetEarth (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on May 6, 2019. On May 6, 2019, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Disputed Domain Name. On May 6, 2019, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Disputed Domain Name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to Complainant on May 10, 2019 providing the registrant and contact information disclosed by the Registrar, and inviting Complainant to submit an amendment to the Complaint. Complainant filed an amended Complaint on May 13, 20191 .

The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified Respondent of the Complaint, and the proceedings commenced on May 14, 2019. In accordance with the Rules, paragraph 5, the due date for Response was June 3, 2019. Three informal email communications from Respondent were received by the Center. The first two were received by the Center on May 11, 2019 and the third one on May 16, 2019. No further Response was submitted. The Center notified the Parties that it would proceed to panel appointment on June 4, 2019.

The Center appointed Richard W. Page as the sole panelist in this matter on June 7, 2019. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

Complainant, WhatsApp Inc., is a provider of one of the world’s most popular mobile messaging applications (or “apps”). Founded in 2009 and acquired by Facebook, Inc. in 2014, Complainant’s messaging application (“WhatsApp”) allows users across the globe to exchange message for free via smartphones, including iPhone, BlackBerry and Android. Its main website available at “www.whatsapp.com” also allows Internet users to access its messaging platform. Since its launch in 2009, WhatsApp has become one of the fastest growing and one of the most popular mobile applications in the world, with over 1.5 billion monthly active users worldwide (as of October 2018). Consistently being ranked amongst Apple iTunes’ 25 most popular free mobile applications and Tech Radar’s Best Android Apps, WhatsApp was the fourth most downloaded application worldwide as per App Annie’s Top Apps Worldwide Rankings in 2018.

Complainant has secured ownership of trademark registrations for the WHATSAPP mark (“WHATSAPP Mark”) in many jurisdictions throughout the world, including United States Trademark Registration No. 3939463, WHATSAPP, registered on April 5, 2011; European Union Trademark No. 009986514, WHATSAPP, registered on October 25, 2011; and International Registration No. 1085539, WHATSAPP, registered on May 24, 2011.

Reflecting its global reach, Complainant is the owner of numerous domain names, containing the WHATSAPP Mark, under various generic Top-Level Domains (“gTLDs”) as well as under many country code Top-Level Domains (ccTLDs).

Complainant has also made substantial investments to develop a strong presence online by being active on various social media fora. For instance, Complainant’s official page on Facebook has over 29 million “likes”. In addition, Complainant has 2.64 million followers on Twitter.

Complainant was recently alerted to the fact that its trademark and company name had been reproduced together with the descriptive terms “hack online” under the gTLD “.net”. The Disputed Domain Name <whatsapphackonline.net> was registered on January 25, 2018.

The Disputed Domain Name previously resolved to a website in Spanish that purported to offer a hacking tool that allowed users to access messages, videos and photos of third parties, shared via Complainant’s WhatsApp application.

In order to “hack” a WhatsApp user’s account, Internet users were requested to enter the WhatsApp user’s phone number, select the desired data (messages, videos, photos or all) and select the desired time range (from seven days to six years).

Upon clicking the “Hack WhatsApp” button, Internet users were led to a web page with further instructions on how to obtain the “hacked” data. First, one needed to click on a link to download conversations, then the Internet user was asked to subscribe to an application adding their personal mobile phone number, then the Internet user was asked to enter an activation code sent by sms, and finally the requested “hacked” data was supposedly sent to the Internet user on Respondent’s website.

When clicking on the link to download the conversation, Internet users were redirected to the IP address 217.13.124.96, which had been flagged by Google as being an unsafe website. It should be noted that it is not technically possible to gain access to WhatsApp users’ data without access to the phone in question, and hence Respondent’s website was merely a trap designed to spread malware or conduct phishing.

Respondent’s website prominently displayed the WHATSAPP Mark and Complainant’s logos together with extensive mention of Complainant.

5. Parties’ Contentions

A. Complainant

Complainant contends that it is the owner of various registrations of the WHATSAPP Mark and that the Disputed Domain Name is confusingly similar to the WHATSAPP Mark. Complainant notes that section 1.2.1 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”) states that registration of a trademark is prima facie evidence of Complainant having enforceable rights in the WHATSAPP Mark.

Complainant further contends that the entirety of the WHATSAPP Mark is contained in the Disputed Domain Name and that the phrase “hack online” and the gTLD suffix “.net” are not distinctive. See section 1.7 of the WIPO Overview 3.0 , says that inclusion of the entire trademark in a domain name will be considered confusingly similar. Also see section 1.8 of the WIPO Overview 3.0 instructs that the addition of other terms (whether descriptive, geographical, pejorative, meaningless or otherwise) does not prevent a finding of confusing similarity. Also, see section 1.11.1 of the WIPO Overview 3.0 instructs that gTLDs such as (.net) may be disregarded for purposes of assessing confusing similarity.

Complainant alleges that Respondent has no rights or legitimate interests in the Disputed Domain Name. Complainant further alleges that Respondent can show none of the elements of paragraph 4(c) of the Policy which would prove Respondent’s rights or legitimate interests. Respondent is not a licensee of Complainant, nor has Respondent been otherwise authorized by Complainant to make any use of its WHATSAPP Mark in a domain name of otherwise.

Complainant submits that Respondent is not using the Disputed Domain Name in connection with any bona fide offering of goods or services, within the meaning or paragraph 4(c)(i) of the Policy.

Complainant further submits that Respondent’s registration and use of the Disputed Domain Name does not conform to Complainant’s Brand Guidelines. Complainant further submits that Respondent’s activities are not authorized by Complainant. While Respondent’s website purported to offer services that allow Internet users to gain access to WhatsApp users’ accounts, it was in fact a malicious website designed to hack the computer or phones of Internet users attempting to use the services purportedly offered by Respondent.

Complainant avers that such use of the Disputed Domain Name is not only detrimental to its business, reputation and goodwill, but also puts the privacy and security of WhatsApp users at risk.

Respondent previously made use of Complainant’s WHATSAPP Mark and logos on its website in order to promote services that purported to hack WhatsApp users’ accounts. Complainant contends that such Illegal activity cannot confer rights or legitimate interests. See section 2.13.1 of the WIPO Overview 3.0.

Respondent is not commonly known by the Disputed Domain Name within the meaning of paragraph 4(c)(ii) of the Policy. Respondent registered the Disputed Domain Name using a privacy service and the identity of the underlying registrant, Jose Pedroza, does not resemble the Disputed Domain Name in any way.

Complainant asserts that Respondent is not currently making a legitimate noncommercial or fair use of the Disputed Domain Name within the meaning of paragraph 4(c)(iii) of the Policy. Respondent’s use is fraudulent and used to induce Internet users into disclosing personal information allowing Respondent to access the Internet users’ computers, phones and other online accounts. This use cannot be considered a legitimate noncommercial or fair use under the Policy.

Complainant contends that Respondent has registered and used the Disputed Domain Name in bad faith.

Complainant further contends that the WHATSAPP Mark is inherently distinctive and well known throughout the world in connection with its messaging application. Furthermore, the WHATSAPP Mark has been continuously and extensively used since the launch of its services and has rapidly acquired considerable reputation and goodwill worldwide.

Complainant submits that the content of Respondent’s website demonstrates actual knowledge of the WHATSAPP Mark, as it made multiple reference to Complainant, its messaging services and made prominent use of Complainant’s logo on its website. Complainant further submits that Respondent registered the Disputed Domain Name with full knowledge of Complainant’s rights, without authorization to do so. Prior UDRP panels have held that actual and constructive knowledge of Complainant’s rights at the time of registration of a domain name constitutes strong evidence of bad faith.

Complainant asserts that the Disputed Domain Name has been used in connection with a website that purported to offer a tool that allowed Internet users to “hack” WhatsApp users’ accounts, which in turn may have been used to hack the phones, computers or other online accounts of the visitors to Respondent’s website.

Complainant further asserts that by registering and using the Disputed Domain Name, Respondent has intentionally attempted to attract, for commercial gain, Internet users to its website or other online location, by creating a likelihood of confusion with the WHATSAPP Mark as to the source, sponsorship, affiliation or endorsement of its website, pursuant to paragraph 4(b)(iv) of the Policy.

B. Respondent

Three informal email communications from Respondent were received by the Center. The first two were received by the Center on May 11, 2019 and the third one on May 16, 2019. No further Response was submitted.

Respondent in his email communications of May 11, 2019 stated that he thought he would not have any problem with the Disputed Domain Name and he would “eliminate it completely”. The final May 16, 2019 communication from Respondent was in Spanish (which the Panel understands) and expressed confusion regarding the process, but offered no defenses to the contentions of Complainant. For purposes of this proceeding, the Panel finds that Respondent has made no Response to Complainant’s contentions.

6. Discussion and Findings

Paragraph 15(a) of the Rules instructs the Panel as to the principles the Panel is to use in determining the dispute: “[a] Panel shall decide a complaint on the basis of the statements and documents submitted in accordance with the Policy, these Rules, and any rules and principles of law that it deems applicable.”

Respondent is not obliged to participate in this domain name dispute proceeding, but when he fails to do so, asserted facts that are not unreasonable will be taken as true and Respondent will be subject to the inferences that flow naturally from the information provided by Complainant. See Reuters Limited v. Global Net 2000, Inc., WIPO Case No. D2000-0441.

Even though Respondent has failed to file a Response or to contest Complainant’s assertions, the Panel will review the evidence proffered by Complainant to verify that the essential elements of the claims are met. See section 4.3 of the WIPO Overview 3.0.

Paragraph 4(a) of the Policy directs that Complainant must prove each of the following:

i) that the Disputed Domain Name registered by Respondent is identical or confusingly similar to the WHATSAPP Mark which Complainant has rights; and,

ii) that Respondent has no rights or legitimate interests in respect of the Disputed Domain Name; and,

iii) that the Disputed Domain Name has been registered and is being used in bad faith.

A. Identical or Confusingly Similar

Complainant contends that it has numerous registrations of the WHATSAPP Mark. Section 1.2.1 of the WIPO Overview 3.0 states that registration of a trademark is prima facie evidence of Complainant having enforceable rights in the WHATSAPP Mark. Respondent has the burden of refuting this assumption. Respondent has not contested the cited registrations. Therefore, the Panel finds that Complainant has enforceable rights in the WHATSAPP Mark for purposes of this proceeding.

Complainant further contends that the Disputed Domain Name is identical with and confusingly similar to the WHATSAPP Mark pursuant to paragraph 4(a)(i) of the Policy. Complainant asserts that the entirety of the WHATSAPP Mark is contained in the Disputed Domain Name and that the phrase “hack online” and the gTLD suffix “.net” are not distinctive.

The Panel agrees that the Disputed Domain Name is confusingly similar to the WHATSAPP Mark. See section 1.7 of the WIPO Overview 3.0 (inclusion of the entire trademark in a domain name will be considered confusingly similar); section 1.8 of the WIPO Overview 3.0 (the addition of other descriptive terms does not prevent a finding of confusing similarity); and section 1.11.1 of the WIPO Overview 3.0 (gTLD suffixes may be disregarded for purposes of assessing confusing similarity).

Therefore, Complainant has satisfied the requirements of paragraph 4(a)(i) of the Policy.

B. Rights or Legitimate Interests

Complainant contends that Respondent has no rights or legitimate interests in the Disputed Domain Name pursuant to paragraph 4(a)(ii) of the Policy.

Paragraph 4(a)(ii) requires Complainant to prove that Respondent has no rights or legitimate interests in the Disputed Domain Name. Section 2.1 of the WIPO Overview 3.0 states that once Complainant makes a prima facie case in respect of the lack of rights or legitimate interests of a Respondent, Respondent carries the burden of demonstrating it has rights or legitimate interests in the Disputed Domain Name. Where Respondent fails to do so, Complainant is deemed to have satisfied paragraph 4(a)(ii) of the Policy.

Paragraph 4(c) of the Policy allows three nonexclusive methods for the Panel to conclude that Respondent has rights or a legitimate interest in the Disputed Domain Name:

(i) before any notice to you [Respondent] of the dispute, your use of, or demonstrable preparations to use, the Disputed Domain Name or a name corresponding to the Disputed Domain Name in connection with a bona fide offering of goods or services; or

(ii) you [Respondent] (as an individual, business, or other organization) have been commonly known by the Disputed Domain Name, even if you have acquired no trademark or service mark rights; or

(iii) you [Respondent] are making a legitimate noncommercial or fair use of the Disputed Domain Name, without intent for commercial gain to misleadingly divert consumers or to tarnish the WHATSSAPP Mark.

Complainant contends that Respondent made illegal use of the WHATSAPP Mark and Complainant’s company logos and that such Illegal activity cannot confer rights or legitimate interests. See section 2.13.1 of the WIPO Overview 3.0.

Complainant further contends that Respondent is not commonly known by the Disputed Domain Name within the meaning of paragraph 4(c)(ii) of the Policy. Respondent registered the Disputed Domain Name using a privacy service and the identity of the underlying registrant, Jose Pedroza, does not resemble the Disputed Domain Name in any way.

Respondent has not countered these allegations.

Therefore, the Panel finds that Complainant has met the requirements of paragraph 4(a)(ii) of the Policy.

C. Registered and Used in Bad Faith

Complainant contends that Respondent registered and is using the Disputed Domain Name in bad faith in violation of the Policy, paragraph 4(a)(iii).

Paragraph 4(b) of the Policy sets forth four nonexclusive criteria for Complainant to show bad faith registration and use of the Disputed Domain Name:

(i) circumstances indicating that you [Respondent] have registered or you have acquired the Disputed Domain Name primarily for the purpose of selling, renting, or otherwise transferring the Disputed Domain Name registration to Complainant who is the owner of the WHATSAPP Mark or to a competitor of Complainant, for valuable consideration in excess of your documented out-of-pocket costs directly related to the Disputed Domain Name; or

(ii) you [Respondent] have registered the Disputed Domain Name in order to prevent the owner of the WHATSAPP Mark from reflecting the mark in a corresponding domain name, provided that you have engaged in a pattern of such conduct; or

(iii) you [Respondent] have registered the Disputed Domain Name primarily for the purpose of disrupting the business of a competitor; or

(iv) by using the Disputed Domain Name, you [Respondent] have intentionally attempted to attract, for commercial gain, Internet users to your web site or other on-line location, by creating a likelihood of confusion with WHATSAPP Mark as to the source, sponsorship, affiliation, or endorsement of your website or location or of a product

Complainant asserts that the Disputed Domain Name has been used in connection with a website that purported to offer a tool that allowed Internet users to “hack” WhatsApp users’ accounts, which in turn may have been used to hack the phones, computers or other online accounts of the visitors to Respondent’s website.

Complainant further asserts that by registering and using the Disputed Domain Name, Respondent has intentionally attempted to attract, for commercial gain, Internet users to its website or other online location, by creating a likelihood of confusion with the WHATSAPP Mark as to the source, sponsorship, affiliation or endorsement of its website, pursuant to paragraph 4(b)(iv) of the Policy.

Respondent has not contested Complainant’s allegations of bad faith.

The Panel finds that Complainant has established the elements of paragraph 4(b)(iv) of the Policy and had demonstrated bad faith under paragraph 4(a)(iii) of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Disputed Domain Name <whatsapphackonline.net> be transferred to Complainant.

Richard W. Page
Sole Panelist
Date: June 18, 2019

1 The invitation from the Center to Complainant to file an amended Complaint based on the fact that the underlying registrant of the Disputed Domain Name had used a privacy service. In this case, the Panel treats the underlying registrant, Jose Pedroza, as Respondent.