WIPO Arbitration and Mediation Center

ADMINISTRATIVE PANEL DECISION

Instagram LLC (Instagram), WhatsApp Inc. (WhatsApp) v. Domain Admin, Whois Privacy Corp. / Sergey Popov

Case No. D2019-2809

1. The Parties

The Complainants are Instagram LLC (First Complainant), WhatsApp Inc. (Second Complainant), United States of America, represented by Hogan Lovells (Paris) LLP, France.

The Respondents are Sergey Popov, Russian Federation (First Respondent) and Domain Admin, Whois Privacy Corp., the Bahamas (Second Respondent).

2. The Domain Names and Registrar

The disputed domain names <instatracker.org> (first disputed domain name) and <whatstracker.org> (second disputed domain name) are registered with Nicenic International Group Co., Limited; the disputed domain name <instavzlom.org> (third disputed domain name) is registered with Internet Domain Service BS Corp (collectively the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on November 15, 2019. On November 18, 2019, the Center transmitted by email to the Registrars a request for registrar verification in connection with the disputed domain names. On November 19, 2019, the Registrar of the third disputed domain name and, on November 22, 2019, the Registrar of the first and second disputed domain names transmitted by email to the Center their respective verification responses:

(a) confirming it is the Registrar for the disputed domain names;

(b) confirming the registration agreements are in English;

(c) confirming the disputed domain names were registered subject to the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), and the UDRP applies to both disputed domain names;

(d) disclosing registrant and contact information for the disputed domain names which differed from the named Respondent and contact information in the Complaint; and

(e) confirming the language of the respective registration agreements is English.

The Center sent an email communication to the Complainant on November 26, 2019 providing the registrant and contact information disclosed by the Registrars, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on November 29, 2019.

The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on December 6, 2019. In accordance with the Rules, paragraph 5, the due date for Response was December 26, 2019. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on December 27, 2019.

The Center appointed Warwick A. Rothnie as the sole panelist in this matter on January 21, 2020. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The Complainants are both wholly owned subsidiaries of Facebook Inc. The First Complainant provides an online service the core of which allows users to share pictures and videos. It was founded in 2010. According to the Complaint, it had one million registered users within two months, 10 million in a year and, by September 2017, 800 million registered users. Its Instagram Direct service had 375 million active users in April 2017 and its Instagram Stories service some 250 million active users in June 2017. Its home page at <Instagram.com> is ranked 26th most visited website in the world by Alexa.

The Second Complainant was founded in 2009 when it launched its well known cross-platform messaging service. According to the Complaint, it had more than 1.5 billion users by February 2018.

The Complaint includes evidence that the Complainants own a number of registered trademarks. The trademarks registered by the First Complainant include:

- Chilean Registered Trademark No. 1213661, INSTA, which was filed on November 20, 2015 and registered in respect of relevant goods in International Class 9 on July 20, 2016; and

- Malaysian Registered Trademark No. 2015069514, INSTA, which was registered on November 19, 2015 in respect of relevant goods in International Class 9.

The trademarks registered by the Second Complainant include:

- European Union Trademark No. 009986514, WHATSAPP, which was filed on May 23, 2011 and registered on October 25, 2011 in respect of a wide range of goods and services in International Classes 9, 38, and 42;

- United States Registered Trademark No. 3939463, WHATSAPP, which was filed on April 1, 2009 and registered on April 5, 2011 in respect of relevant services in International Class 42; and

- International Registration No. 1085539, WHATSAPP, which was registered on May 24, 2011 in respect of goods and services in International Classes 9 and 38 designating numerous countries.

The first and second disputed domain names were both registered to the First Respondent on April 3, 2018. Third disputed domain name was registered in the name of the Second Respondent on January 24, 2019.

The first and third disputed domain names respectively resolve to a website which provides software and services to break into a third party’s Instagram account and download its published content without the permission of the account holder. The website to which the first disputed domain name resolves is in English, the website of the third disputed domain name is in Russian. Apart from the language difference, it otherwise appears to be very similar to the website to which the first disputed domain name resolves. One notable feature of both websites is a header or title appearing at the top of the landing page featuring the First Complainant’s “camera” logo device and the words “Instagram Tracker”.

The second disputed domain name resolves to a website in English which provides software and services to break into a third party’s WhatsApp account and download its correspondences and other content without that person’s permission. Amongst other things, it includes a header on the landing page featuring the Second Complainant’s logo device of a telephone handset inside a speech bubble and the words “WhatsApp Tracker”.

5. Discussion and Findings

No response has been filed. The Complaint has been sent, however, to the Respondents at the physical and electronic coordinates confirmed as correct by the respective Registrars in accordance with paragraph 2(a) of the Rules. The Panel notes that third disputed domain name is registered in the name of a privacy service. That privacy service includes an identification of a specific account holder. In any event, it is for the underlying/beneficial registrant to ensure that appropriate arrangements are in place to forward to him/her/it communications sent to the address provided in the WhoIS record. Accordingly, the Panel finds that both Respondents have been given a fair opportunity to present his or its case.

When a respondent has defaulted, paragraph 14(a) of the Rules requires the Panel to proceed to a decision on the Complaint in the absence of exceptional circumstances. Accordingly, paragraph 15(a) of the Rules requires the Panel to decide the dispute on the basis of the statements and documents that have been submitted and any rules and principles of law deemed applicable.

Paragraph 4(a) of the Policy provides that in order to divest a respondent of its disputed domain name, the complainant must demonstrate each of the following:

(i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; and

(ii) the respondent has no rights or legitimate interests in respect of the disputed domain name; and

(iii) the disputed domain name has been registered and is being used in bad faith.

A. Consolidation of the Complaints against both Respondents

Paragraph 4(f) of the Policy envisages that a party may petition to consolidate disputes about multiple domain names into one administrative proceeding.

Paragraph 3(c) of the Rules expressly permits a complaint to relate to more than one domain name where all the domain names are registered by the same domain name holder. Notwithstanding this express provision, panels have frequently held that the panel’s powers under paragraph 10(e) of the Rules may permit consolidation of multiple domain name disputes, subject to satisfaction of the other requirements of Policy and Rules. In particular, paragraph 10(b) of the Rules requires the panel to ensure that all parties are treated equally and each is given a fair opportunity to present his, her or its case.

In accordance with those requirements, panels have typically allowed joinder against multiple respondents who have registered different domain names where, amongst other things, the domain names in question, or the websites to which they resolve, appear to be under common control and consolidation would be fair and equitable to all parties. The onus of establishing that these requirements have been met falls on the party seeking consolidation. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), section 4.11.

As already noted, the first and second disputed domain names are registered in the name of the First Respondent, who has given an address in Russia. The third disputed domain name has been registered behind a privacy service. The website to which it resolves is in Russian and appears to be almost identical otherwise to the website to which the first disputed domain name registered by the First Respondent, a Russian, resolves. It appears, therefore, that all three disputed domain names have been registered by the same person or, at least, are under common control.

The Complainants also rely on their shared status as wholly owned subsidiaries of the same parent, Facebook Inc., to contend that they should be treated as effectively the one Complainant. See e.g., Inter-Continental Hotels Corporation, Six Continents Hotels, Inc. v. Daniel Kirchhof, WIPO Case No. D2009-1661.

As both Complainants are part of the same corporate group and their respective grievances are with the same Respondent in respect of what appears to be almost identical conduct, the Panel considers joinder of their respective Complaints is appropriate subject to the question of prejudice and fairness to the Respondents.

Apart from the different language on the websites to which the first and third disputed domain names resolve, the Complaints in respect of those disputed domain name raise identical issues. The Complaints against the first and second disputed domain names involve the same Respondent. The Complaints do raise different trademarks, but otherwise the same issues are involved. In these circumstances, the consolidation of the Complaints about the three disputed domain names into one Complaint is not so onerous as to lead to oppression of the Respondents. On the other hand, allowing consolidation promotes both time and costs efficiency which, as the Complainants note, are objectives of the Policy (provided that the parties are treated equally and given a fair opportunity to present their respective cases). Accordingly, the Panel concludes that the Complainants’ requests to consolidate the complaints should be allowed.

B. Language of the proceeding

Paragraph 11 of the Rules provides that the language of the proceeding will be the language of the registration agreement unless the parties agree otherwise or the panel determines otherwise in the circumstances of the proceeding.

As noted above, the Registrars have both confirmed that English is the language of the registration agreements. The Complainants are also both based in the United States, where the official language is English, and have filed the Complaint in English. Although the First Respondent has given an address in Russia in the WhoIs details, the websites to which the first and second disputed domain names resolve are both in English. The website to which the third disputed domain name resolves is in Russian. As already determined above, however, the record in this proceeding provides a sufficient basis to conclude that the third disputed domain name is held by the First Respondent or is otherwise under common control with the first and second disputed domain names.

In these circumstances, the Panel sees no reason to depart from the default rule provided by paragraph 11 of the Rules that English as the language of the registration agreements is the language of the proceeding.

C. Identical or Confusingly Similar

As indicated above, the first element that the Complainants must establish is that the disputed domain names are identical with, or confusingly similar to, the Complainants’ trademark rights.

There are two parts to this inquiry: the Complainants must demonstrate that they have rights in a trademark and, if so, the disputed domain names must be shown to be identical or confusingly similar to the relevant trademark.

The First Complainant has proven ownership of the registered trademarks for INSTA referred to in section 4 above. The Panel also accepts that it is likely the First Complainant has rights in that term as an unregistered trademark in certain context having regard to the scope and extent of the Complainant’s use of its INSTAGRAM trademark and the public use of the abbreviated term to refer to the Complainant or its service.

The Second Complainant has also proven ownership of the registered trademarks for WHATSAPP referred to in section 4 above. As with the First Complainant’s trademark, there can be little doubt the Second Complainant’s trademark is very well known.

The second stage of this inquiry simply requires a visual and aural comparison of the disputed domain name to the proven trademarks. In undertaking that comparison, it is permissible in the present circumstances to disregard the generic Top-Level Domain (gTLD) component as a functional aspect of the domain name system. Questions such as the scope of the trademark rights, the geographical location of the respective parties and other considerations that may be relevant to an assessment of infringement under trademark law are not relevant at this stage. Such matters, if relevant, may fall for consideration under the other elements of the Policy. e.g., WIPO Overview 3.0, sections 1.7 and 1.11.

As section 1.7 of the WIPO Overview 3.0 records:

“… in cases where a domain name incorporates the entirety of a trademark, or where at least a dominant feature of the relevant mark is recognizable in the domain name, the domain name will normally be considered confusingly similar to that mark for purposes of UDRP standing.

“In specific limited instances, while not a replacement as such for the typical side-by-side comparison, where a panel would benefit from affirmation as to confusing similarity with the complainant’s mark, the broader case context such as website content trading off the complainant’s reputation, or a pattern of multiple respondent domain names targeting the complainant’s mark within the same proceeding, may support a finding of confusing similarity. ….”

Disregarding the “.org” gTLD, the first and third disputed domain names consist of the entirety of the First Complainant’s registered trademark plus a descriptive term.¹ This would ordinarily be sufficient for a finding of confusing similarity. See e.g., WIPO Overview 3.0, section 1.8. The Panel acknowledges that “insta” can in some contexts be a generic or descriptive prefix. The very strong reputation of the First Complainant has in its name “Instagram”, which is often abbreviated in general use by the public just to “Insta” and the content of the websites to which the first and third disputed domain names resolve removes any concern that may be felt on that front. The content of a respondent’s website is not typically taken into account at this stage. Where, as here, the content confirms that the holder (or holders) of the first and third disputed domain names are targeting the First Complainant’s trademark, however, it is permissible to take the content into account at this stage of the inquiry. See WIPO Overview 3.0, section 1.15.

Similar reasoning leads to the same conclusion in respect of the second disputed domain name.

It is clear from the content of the three websites that the Respondents expect the public to recognise an association between the disputed domain names and the Complainants’ respective services.

Accordingly, the Panel finds that the Complainants have established that the first and third disputed domain names are confusingly similar to the First Complainant’s trademark. The Panel also finds that the second disputed domain name is confusingly similar to the Second Complainant’s trademark.

Therefore, requirement under the first limb of the Policy is satisfied.

D. Rights or Legitimate Interests

The second requirement the Complainants must prove is that the Respondents have no rights or legitimate interests in the disputed domain names.

Paragraph 4(c) of the Policy provides that the following circumstances can be situations in which the Respondent has rights or legitimate interests in a disputed domain name:

(i) before any notice to [the Respondent] of the dispute, [the Respondent’s] use of, or demonstrable preparations to use, the [disputed] domain name or a name corresponding to the [disputed] domain name in connection with a bona fide offering of goods or services; or

(ii) [the Respondent] (as an individual, business, or other organization) has been commonly known by the [disputed] domain name, even if [the Respondent] has acquired no trademark or service mark rights; or

(iii) [the Respondent] is making a legitimate noncommercial or fair use of the [disputed] domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue.

These are illustrative only and are not an exhaustive listing of the situations in which a respondent can show rights or legitimate interests in a domain name.

The onus of proving this requirement, like each element, falls on the Complainant. Panels have recognized the difficulties inherent in proving a negative, however, especially in circumstances where much of the relevant information is in, or likely to be in, the possession of the respondent. Accordingly, it is usually sufficient for a complainant to raise a prima facie case against the respondent under this head and an evidential burden will shift to the respondent to rebut that prima facie case. See e.g., WIPO Overview 3.0, section 2.1.

The Complainants state that they have not authorised the Respondents to register or use the disputed domain names. The Complainants also state that the Respondents are not affiliated with them or the Facebook group in any way.

The disputed domain names are plainly not derived from the First Respondent’s name or, so far as has been disclosed, the Second Respondent’s name.

In addition, the websites to which the disputed domain names resolve provide software and services to permit unauthorised hacking of third parties’ Instagram and Whatsapp accounts. As section 2.13.1 of the WIPO Overview 3.0 summarises:

“Panels have categorically held that the use of a domain name for illegal activity (e.g., the sale of counterfeit goods or illegal pharmaceuticals, phishing, distributing malware, unauthorized account access/hacking, impersonation/passing off, or other types of fraud) can never confer rights or legitimate interests on a respondent. ….”

These matters, taken together, establish a prima facie case under the Policy that the Respondents have no rights or legitimate interests in the disputed domain names.

The Respondents have not sought to rebut that prima facie case or advance any claimed entitlement.

Accordingly, the Panel finds the Complainants have established the second requirement under the Policy also.

E. Registered and Used in Bad Faith

Under the third requirement of the Policy, the Complainant must establish that the disputed domain name has been both registered and used in bad faith by the Respondent. These are conjunctive requirements; both must be satisfied for a successful complaint: see e.g., Burn World-Wide, Ltd. d/b/a BGT Partners v. Banta Global Turnkey Ltd, WIPO Case No. D2010-0470.

Generally speaking, a finding that a domain name has been registered and is being used in bad faith requires an inference to be drawn that the respondent in question has registered and is using the disputed domain name to take advantage of its significance as a trademark owned by (usually) the complainant.

Having regard to the length, extent, and renown of the Complainants’ respective trademarks, there can be little, if any, doubt that the Respondents registered the disputed domain names well aware of the Complainants’ respective trademark rights, all the more so bearing in mind the nature of the services the Respondent’s provide from their websites.

There can also be little, if any, doubt that the Respondents registered each disputed domain name for use in the way it is in fact being used.

Having regard to the use of the disputed domain names to provide software and services to hack other people’s Instagram and WhatsApp accounts without permission, therefore, the Panel finds the Respondents registered and used their respective disputed domain names in bad faith.

Accordingly, the Complainants have established all three requirements under the Policy.

6. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain names <instatracker.org>, <instavzlom.org>, and <whatstracker.org> be transferred to the Complainant.

Warwick A. Rothnie
Sole Panelist
Date: February 4, 2020

¹ “vzlom” is apparently the name of a musical artist. More directly relevant for present purposes, according to “www.wiktionary.org” it is a Russian word which translates into English as “break-in” or “breaking”.