Asurion, LLC v Ryan Donlin

WIPO Case No. D2023-4693

ARBITRATION

AND

MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

Asurion, LLC v. Ryan Donlin

Case No. D2023-4693

1. The Parties

The Complainant is Asurion, LLC, United States of America (“United States”), represented by Adams and

Reese LLP, United States.

The Respondent is Ryan Donlin, United States.

2. The Domain Names and Registrar

The disputed domain names <assurionsso.net> and <asurionsso.com> are registered with NameCheap, Inc.

(the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on November 11, 2023. On November 13, 2023, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain names. On November 13, 2023, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain names which differed from the named Respondent (Redacted for Privacy, Privacy Service Provided by Withheld for Privacy ehf) and contact information in the Complaint. The Center sent an email communication to the Complainant on November 15, 2023, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on November 17, 2023.

The Center verified that the Complaint together with the amended Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for
Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on November 27, 2023. In accordance with the Rules, paragraph 5, the due date for Response was December 17, 2023. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on December 18, 2023.

page 2

The Center appointed Angela Fox as the sole panelist in this matter on January 16, 2024. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The Complainant is a company based in Nashville, Tennessee, which has been trading since at least as early as 1994. The Complainant’s business area is in insurance, technology, mobile phone replacement, configuration, technical support, IT consultation, and related products and services. Since at least as early

as 2001, it has offered all these goods and services under the trademark ASURION.

The Complainant’s business is substantial. It has served over 280 million consumers worldwide, and its
services are made available by retailers worldwide, including some of the largest retailers in the United
States. The Complainant has fourteen locations in North and South America, two locations in Europe, two in
Australia, and ten in Asia, including in China, Japan, Israel, Malaysia, the Philippines, Singapore, Taiwan
Province of China, and Thailand. The Complainant spends millions of dollars annually promoting its
ASURION brand, and its principal website at “ receives over 7.9 million visits annually.

The Complainant owns multiple trademark registrations for the ASURION mark in countries around the world, including the following United States registrations, details of which were annexed to the Complaint:

- United States Trademark Registration No. 2698459 for ASURION, registered on March 18, 2003;

- United States Trademark Registration No. 4179272 for ASURION, registered on July 24, 2012;

- United States Trademark Registration No. 4314110 for ASURION, registered on April 2, 2013;

- United States Trademark Registration No. 4997781 for ASURION, registered on July 12, 2016;

- United States Trademark Registration No. 6010609 for ASURION, registered on March 17, 2020.

The disputed domain names were both registered on November 10, 2023. On the same day, they were both linked to false employee login pages bearing the Complainant’s ASURION trademark in the same stylized font in which it is used by the Complainant and were used in a smishing and phishing attack targeting employees of the Complainant. The victims were invited to access the websites at the disputed domain names and to enter their employee login details, following which the Respondent would then have access to that sensitive information and to the Complainant’s secure systems. The Complainant learned of this activity on the same day and reported the Respondent’s use of the disputed domain names, as part of a smishing scheme to the Registrar of the dispute domain names. The disputed domain names no longer link to any active websites.

5. Parties’ Contentions

A. Complainant

The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain names.

In particular, the Complainant submits that the disputed domain names are confusingly similar to its
ASURION trademark. It argues that the slight misspelling of ASURION in disputed domain name
<assurionsso.net> is insufficient to distinguish this disputed domain name from the Complainant’s ASURION
mark, and the disputed domain name <asurionsso.com> contains the Complainant’s trademark in its entirety.

page 3

The addition of “sso” (the abbreviation for the generic phrase “single sign-on”) does not prevent the disputed domain names from being confusingly similar to the Complainant’s ASURION mark.

The Complainant further submits that the Respondent has no rights or legitimate interests in the disputed domain names. The Respondent is not and never has been commonly known by reference to the disputed domain names, and is not and never has been a licensee or franchisee of the Complainant, nor has it been authorized by the Complainant to register or use the Complainant’s ASURION mark. The Respondent is not using the disputed domain names in connection with a bona fide offering of goods or services, or in a legitimate noncommercial or fair manner. On the contrary, the Respondent has been using the disputed domain names in connection with a smishing and phishing scam, which cannot confer a right or legitimate interest.

Finally, the Complainant submits that the disputed domain names were registered and have been used in bad faith. It is implausible that the Respondent did not know of the Complainant when it registered the disputed domain names, given its use of them in connection with a smishing and phishing scam involving the use of the Complainant’s own logo form of its mark and its targeting of the Complainant’s employees in an effort to fraudulently obtain their employee login credentials.

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

6. Discussion and Findings

Under paragraph 4(a) of the Policy, a complainant can only succeed in an administrative proceeding under the Policy if the panel finds that:

(i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the
complainant has rights;
(ii) the respondent has no rights or legitimate interests in the disputed domain name; and
(iii) the disputed domain name has been registered and is being used in bad faith.

All three elements must be present before a complainant can succeed in an administrative proceeding under the Policy.

6.1 Procedural Issue: Consolidation: Multiple Respondents

The Complaint was filed in relation to two disputed domain names and the Complaint provided arguments concerning the common control of the disputed domain names. The Complainant alleges that the disputed domain name registrants are the same entity or mere alter egos of each other, or under common control. The Complainant requests the consolidation of the Complaint against the multiple disputed domain name registrants pursuant to paragraph 10(e) of the Rules.

The disputed domain name registrants did not comment on the Complainant’s request.

Paragraph 3(c) of the Rules states that a complaint may relate to more than one domain name, provided that the domain names are registered by the same domain name holder.

In addressing the Complainant’s request, the Panel will consider whether (i) the disputed domain names or
corresponding websites are subject to common control; and (ii) the consolidation would be fair and equitable
to all Parties. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition
(“WIPO Overview 3.0”), section 4.11.2.

page 4

As regards common control, the Panel notes the following facts asserted by the Complainant, which the

Respondent has not responded:

- Both of the disputed domain names were registered on the same date, within an hour of each other.

- According to the WhoIs records, both use the same privacy service.

- Both are registered at the same Registrar, namely, Namecheap Inc.

- According to the current WhoIs records, both use the same name servers, namely, dns1.registrar-

servers.com and dns2.registrar-servers.com.

- Both have been used for phishing purposes, in which the domains were used to direct to a fake employee login portal impersonating the Complainant, to harvest login information of employees of the Complainant, within a 24-hour period prior to the filing of the original Complaint.

- The registrar has now confirmed that both disputed domain names are registered to the same

registrant.

Taking all of the above into account, the Panel sees no reason why consolidation of the disputes would be unfair or inequitable to any party.

Accordingly, the Panel decides to consolidate the disputes regarding the nominally different disputed domain name registrants (referred to below as “the Respondent”) in a single proceeding.

6.2 Substantive Issues:

A. Identical or Confusingly Similar

It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain names. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, (“WIPO Overview 3.0”), section 1.7.

The Complainant has shown rights in respect of the trademark ASURION for the purposes of the Policy (WIPO Overview 3.0, section 1.2.1). The entirety of that mark is reproduced within the disputed domain name <asurionsso.com>. Accordingly, the disputed domain name <asurionsso.com> is confusingly similar

to the mark for the purposes of the Policy (WIPO Overview 3.0, section 1.7).

In respect of the disputed domain name <assurionsso.net>, the Panel finds that the disputed domain name includes an obvious typographical misspelling of ASURION which is likely to be mistaken for ASURION by Internet users. Accordingly, the disputed domain name <assurionsso.net> is confusingly similar to the

Complainant’s mark for the purposes of the Policy (WIPO Overview 3.0, sections 1.7 and 1.9).

Although the addition of the letters “sso” may bear on the assessment of the second and third elements, the disputed domain names and the mark for the purposes of the Policy (WIPO Overview 3.0, section 1.8).

The Panel finds the first element of the Policy has been established.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name.

page 5

Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element (WIPO Overview 3.0, section 2.1).

Having reviewed the available record, the Panel finds the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain names. The Respondent has not rebutted the Complainant’s prima facie showing and has not come forward with any relevant evidence demonstrating rights or legitimate interests in the disputed domain names such as those enumerated in the Policy or otherwise.

As explained further below under the section on bad faith, panels have held that the use of a domain name
for illegal activity such as smishing or phishing can never confer rights or legitimate interests on a respondent

(WIPO Overview 3.0, section 2.13.1).

The Panel finds the second element of the Policy has been established.

C. Registered and Used in Bad Faith

The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith.

In the present case, the Panel notes that the Respondent has used the disputed domain names in
connection with a smishing and phishing scam, involving the use of the Complainant’s logo and the targeting
of the Complainant’s employees in an effort to fraudulently obtain their log-in details into the Complainant’s
system. It is clear from this that the Respondent knew of the Complainant and its ASURION trademark when
it registered the disputed domain names, and that they were registered with the intention of perpetrating a
fraud.

Panels have held that the use of a domain name for illegal activity such as smishing or phishing, or other types of fraud, constitutes bad faith (WIPO Overview 3.0, section 3.4). Having reviewed the record, the Panel finds the Respondent’s registration and use of the disputed domain names in connection with a smishing or phishing scam constitutes bad faith under the Policy.

The Panel finds that the Complainant has established the third element of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel
orders that the disputed domain names <assurionsso.net> and <asurionsso.com> be transferred to the
Complainant.

/Angela Fox/ Angela Fox Sole Panelist Date: February 6, 2024