Box, Inc. v Personal Computer

WIPO Case No. D2023-0429

ARBITRATION

AND

MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

Box, Inc. v. Personal Computer

Case No. D2023-0429

1. The Parties

The Complainant is Box, Inc., United States of America (“United States”), represented by The GigaLaw Firm,

Douglas M. Isenberg, Attorney at Law, LLC, United States.

The Respondent is Personal Computer, United States.

2. The Domain Names and Registrar

The disputed domain names <boxokta.com>, <box-okta.org>, <box-shared.com>, <boxsso.com>, and

<boxtransfers.com> (the “Disputed Domain Names”) are registered with NameCheap, Inc. (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on January 31, 2023.
On January 31, 2023, the Center transmitted by email to the Registrar a request for registrar verification in
connection with the Disputed Domain Names. On January 31, 2023, the Registrar transmitted by email to
the Center its verification response disclosing registrant and contact information for the Disputed Domain
Names which differed from the named Respondent (Privacy service provided by Withheld for Privacy ehf)
and contact information in the Complaint. The Center sent an email communication to the Complainant on
February 1, 2023 providing the registrant and contact information disclosed by the Registrar, and inviting the
Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the

Complaint on February 3, 2023.

The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for

Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the
Complaint, and the proceedings commenced on February 9, 2023. In accordance with the Rules, paragraph
5, the due date for Response was March 1, 2023. The Respondent did not submit any response.
Accordingly, the Center notified the Respondent’s default on March 2, 2023.

page 2

The Center appointed Lynda M. Braun as the sole panelist in this matter on March 14, 2023. The Panel
finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and
Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the

Rules, paragraph 7.

4. Factual Background

The Complainant is a modern content management platform for companies of all sizes. Founded in 2005,1
the Complainant is a publicly-traded company that provides content cloud services to empower organizations
to manage the entire content lifecycle, work securely from anywhere, and integrate across numerous
applications. To date, tens of thousands of third-party developers have leveraged the Complainant’s
platform as the secure content layer for their applications.

As of January 31, 2022, the Complainant had more than 100,000 paying organizations, the Complainant employed 2,172 individuals, and its solution was offered in 25 languages.

The Complainant owns at least 348 trademark registrations in at least 23 jurisdictions worldwide that consist
of or incorporate the term BOX. The Complainant owns the following trademarks, among others, in the
United States with the United States Patent and Trademark Office (“USPTO”): BOX, United States
Registration No. 3,429,191, registered on May 20, 2008; BOX, United States Registration No. 3,612,423,
registered on April 28, 2009; and BOX, United States Registration No. 3,722,965, registered on December
8, 2009. In addition, the Complainant owns the trademark registration for BOX with the European Union
Intellectual Property Office, European Union Trademark Registration No. 6,792,337, registered on May 31,

2012.

The aforementioned trademarks will hereinafter collectively be referred to as the “BOX Mark”.

The following Disputed Domain Names were registered between August 1, 2022 and October 28, 2022, could not be reached.

more than 14 years after the Complainant first obtained its first registration for the BOX Mark:
<boxokta.com>, registered on August 1, 2022; <box-okta.org>, registered on August 1, 2022; <box-
shared.com>, registered on August 1, 2022; <boxsso.com>, registered on October 28, 2022; and
<boxtransfers.com>, registered on September 11, 2022. The Respondent is using the Disputed Domain

5. Parties’ Contentions

A. Complainant

The following are the Complainant’s contentions:

- the Disputed Domain Names are confusingly similar to the Complainant’s BOX Mark.

- the Respondent has no rights or legitimate interests in respect of the Disputed Domain Names.

- the Disputed Domain Names were registered and are being used in bad faith.

- the Complainant seeks the transfer of the Disputed Domain Names from the Respondent to the
Complainant in accordance with paragraph 4(i) of the Policy.

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

page 3

6. Discussion and Findings

In order for the Complainant to prevail and have the Disputed Domain Names transferred to the
Complainant, the Complainant must prove the following (Policy, paragraph 4(a)):

(i)        the Disputed Domain Names are identical or confusingly similar to a trademark or service mark in which the Complainant has rights; and

(ii)       the Respondent has no rights or legitimate interests in respect of the Disputed Domain Names; and

(iii)      the Disputed Domain Names were registered and are being used in bad faith.

A. Identical or Confusingly Similar

Paragraph 4(a)(i) of the Policy requires a two-fold inquiry, a threshold investigation into whether a complainant has rights in a trademark, and an assessment of whether the disputed domain name is identical or confusingly similar to that trademark. The Panel concludes that in the present case, the Disputed Domain Names are confusingly similar to the BOX Mark.

It is uncontroverted that the Complainant has established rights in the BOX Mark based on its years of use as well as its numerous registered trademarks for the BOX Mark in the United States, the European Union, and other jurisdictions worldwide. The registration of a mark satisfies the threshold requirement of having

trademark rights for purposes of standing to file a UDRP case. As stated in section 1.2.1 of the WIPO
Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), “[w]here
the complainant holds a nationally or regionally registered trademark or service mark, this prima facie
satisfies the threshold requirement of having trademark rights for purposes of standing to file a UDRP case.”
Thus, the Panel finds that the Complainant satisfied the threshold requirement of having rights in the BOX

Mark.

The <boxokta.com> Disputed Domain Name consists of the BOX Mark followed by the trademark OKTA,[2]
and then followed by the generic Top-Level Domain (“gTLD”) “.com”. The <box-okta.org> Disputed Domain
Name consists of the BOX Mark joined by a hyphen to the trademark OKTA, and then followed by the gTLD
“.org”. The <box-shared.com> Disputed Domain Name consists of the BOX Mark joined by a hyphen to the
term “shared”, and then followed by the gTLD “.com”. The Disputed Domain Name <boxsso.com> consists
of the BOX Mark followed by the abbreviation “sso” (for “single sign-on”),[3] and then followed by the gTLD
“.com”. The <boxtransfers.com> Disputed Domain Name consists of the BOX Mark followed by the term
“transfers”, and then followed by the gTLD “.com”.

[2] OKTA is a partner of the Complainant.

[3] SSO is a session and user authentication service that permits a user to use one set of login credentials -- for example, a username

Where the trademark is recognizable in the Disputed Domain Name, as the BOX Mark is here, the addition of a trademark, such as OKTA, and terms such as “shared”, “sso”, and “transfers” does not prevent a finding of confusing similarity. See WIPO Overview 3.0, section 1.8 (“where the relevant trademark is recognizable within the disputed domain name, the addition of other terms (whether descriptive, geographical, pejorative, meaningless, or otherwise) would not prevent a finding of confusing similarity under the first element”).

Moreover, it is well established that a disputed domain name that wholly incorporates a trademark may be confusingly similar to that trademark for purposes of the Policy despite the addition of a hyphen. The presence or absence of punctuation marks such as hyphens cannot on their own avoid a finding of confusing similarity. See Six Continents Hotels, Inc. v. Helen Siew, WIPO Case No. D2004-0656.

Finally, the addition of a gTLD such as “.com”, “.org”, or “.net” in a domain name is a technical requirement.
Thus, it is well established that such element may typically be disregarded when assessing whether a

page 4

Proactiva Medio Ambiente, S.Av.

domain name is identical or confusingly similar to a trademark. See . that the Disputed Domain Names are confusingly similar to the Complainant’s BOX Mark.

Accordingly, the Panel finds that the first element of paragraph 4(a) of the Policy has been met by the

Complainant.

B. Rights or Legitimate Interests

Under the Policy, a complainant has to make out a prima facie case that the respondent lacks rights or legitimate interests in the disputed domain name. Once such a prima facie case is made, the respondent carries the burden of production of evidence that demonstrates rights or legitimate interests in the disputed domain name. If the respondent fails to do so, the complainant may be deemed to have satisfied paragraph 4(a)(ii) of the Policy. See WIPO Overview 3.0, section 2.1.

facie case. The Respondent has not submitted any arguments or evidence to rebut the Complainant’s prima facie case. Furthermore, the Complainant has not authorized, licensed or otherwise permitted the Respondent to use its BOX Mark. Nor does the Complainant have any type of business relationship with the	In this case, given the facts as set out above, the Panel finds that the Complainant has made out a prima Names or by any similar names, nor any evidence that the Respondent was using or making demonstrable preparations to use the Disputed Domain Names in connection with a bona fide offering of goods or services. See Policy, paragraph 4(c).
Moreover, the composition of the Disputed Domain Names, comprising the entirety of the BOX Mark, carries a risk of implied affiliation and cannot constitute fair use here, as they effectively suggest sponsorship or endorsement by the Complainant. See WIPO Overview 3.0, section 2.5.1.
In sum, the Panel finds that the Complainant has established an unrebutted prima facie case that the Respondent lacks rights or legitimate interests in the Disputed Domain Names.
Finally, by using the Disputed Domain Names in connection with a purported phishing scheme that also includes malware, the Respondent has not used the Disputed Domain Names “in connection with a bona fide offering of goods or services” and, therefore, cannot establish rights or legitimate interests pursuant to paragraph 4(c)(i) of the Policy. As set forth in section 2.13.1 of WIPO Overview 3.0: “Panels have categorically held that the use of a domain name for illegal activity (e.g., the sale of counterfeit goods or illegal pharmaceuticals, phishing, distributing malware, unauthorized account access/hacking, impersonation/passing off, or other types of fraud) can never confer rights or legitimate interests on a respondent”.
Accordingly, the Panel finds that the second element of paragraph 4(a) of the Policy has been met by the Complainant.
C. Registered and Used in Bad Faith
The Panel finds that based on the record, the Complainant has demonstrated the existence of the the Policy.
First, the Panel finds that the Respondent had actual knowledge of the Complainant’s BOX Mark and targeted the Complainant when it registered the Disputed Domain Names, demonstrating the Respondent’s bad faith. Based on the widespread use of the BOX Mark in the United States, Europe, and other jurisdictions worldwide, it strains credulity to believe that the Respondent had not known of the Complainant or its BOX Mark when registering the Disputed Domain Names. The Respondent’s awareness of the Complainant and its BOX Mark additionally suggests that the Respondent’s decision to register the Disputed

page 5

Domain Names was intended to cause confusion with the Complainant’s BOX Mark and to disrupt the Complainant’s business. Such conduct indicates that the Respondent registered the Disputed Domain Names in bad faith.

Second, the Panel concludes that the Respondent registered and used the Disputed Domain Names in bad faith in an attempt to attract Internet users to the Respondent’s resolving websites by creating a likelihood of confusion with the Complainant’s BOX Mark as to the source, sponsorship, affiliation, or endorsement of the Disputed Domain Names’ resolving websites. The Respondent’s registration and use of the Disputed

the name and reputation of the Complainant and its BOX Mark. See Madonna Ciccone, p/k/a Madonna v. Dan Parisi and “Madonna.com”, WIPO Case No. D2000-0847 (“[t]he only plausible explanation for	Domain Names indicate that such registration and use had been done for the specific purpose of trading on mark for commercial gain”).
Third, the registration of a domain name that is confusingly similar to a registered trademark by an entity that has no relationship to that mark may be sufficient evidence of opportunistic bad faith. See Ebay Inc. v. Wangming, WIPO Case No. D2006-1107; Veuve Clicquot Ponsardin, Maison Fondée en 1772 v. The Polygenix Group Co., WIPO Case No. D2000-0163 (use of a name connected with such a well-known service and product by someone with no connection to the service and product suggests opportunistic bad faith). Based on the circumstances here, the Respondent registered and used the Disputed Domain Names in bad faith in an attempt to create a likelihood of confusion with the Complainant’s BOX Mark.
Fourth, the Respondent is allegedly using the Disputed Domain Names in connection with a phishing and malware scheme, demonstrating bad faith. See WIPO Overview 3.0, section 3.1.4 (“the use of a domain name for per se illegitimate activity such as… phishing… is manifestly considered evidence of bad faith”); and WIPO Overview 3.0, section 3.4 (“use of a domain name for purposes other than to host a website may
trademark in the disputed domain names are evidence of bad faith. See, e.g., DeLaval Holding AB v. Registration Private, Domains By Proxy LLL / Craig Kennedy, WIPO Case No. D2015-2135; CMA CGM v.
constitute bad faith”). Numerous UDRP panels have found that phishing schemes that use a complainant’s domain name would not prevent a finding of bad faith. WIPO Overview 3.0, section 3.3.
Finally, the Panel notes that by registering five Disputed Domain Names all incorporating the Complainant’s further indicator of the Respondent’s bad faith.
Accordingly, the Panel finds that the third element of paragraph 4(a) of the Policy has been met by the Complainant.
7. Decision
For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Disputed Domain Names <boxokta.com>, <box-okta.org>, <box-shared.com>, <boxsso.com>, and <boxtransfers.com> be transferred to the Complainant.
/Lynda M. Braun/ Lynda M. Braun Sole Panelist Date: March 22, 2023

1 The Complainant was incorporated in 2005 as Box.Net, Inc., a Washington corporation, and later reincorporated in 2008 under the
same name as a Delaware corporation. In November 2011, the Complainant changed its name to Box, Inc.

and password -- to access multiple applications.