CVS Pharmacy, Inc. (“CVS”) v Vince Gill

WIPO Case No. D2024-4339

ARBITRATION
AND
MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

CVS Pharmacy, Inc. (“CVS”) v. Vince Gill

Case No. D2024-4339

1. The Parties

The Complainant is CVS Pharmacy, Inc., United States of America (“United States”), represented by The

GigaLaw Firm, Douglas M. Isenberg, Attorney at Law, LLC, United States.

The Respondent is Vince Gill, United States.

2. The Domain Name and Registrar

The disputed domain name <cvshealth-corporation.com> (the “Disputed Domain Name”) is registered with

Hostinger Operations, UAB (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on October 22, 2024. On the same day, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Disputed Domain Name. On October 23, 2024, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Disputed Domain Name which differed from the named Respondent (Domain Admin / Privacy Protect, LLC) and contact information in the Complaint.

The Center sent an email communication to the Complainant on October 25, 2024, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on October 27, 2024.

The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for

Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the
Complaint, and the proceedings commenced on October 30, 2024. In accordance with the Rules, paragraph

page 2

5, the due date for Response was November 19, 2024. The Respondent did not submit any response.
Accordingly, the Center notified the Respondent’s default on November 21, 2024.

The Center appointed Lynda M. Braun as the sole panelist in this matter on November 25, 2024. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The Complainant, CVS Pharmacy, Inc., is a publicly traded Rhode Island, United States corporation that is a wholly owned subsidiary of CVS Health Corporation, which had an annual revenue in 2023 of USD 357.8 billion. The Complainant holds many assets directly, including most of the company’s intellectual property interests, such as the CVS trademarks and the domain names containing the CVS trademarks. The Complainant employs approximately 300,000 workers in more than 9,000 local touchpoints, serving more than 186 million people via 5 million daily interactions across the company’s numerous locations.

The Complainant owns the following registered trademarks through the United States Patent and Trademark
Office (“USPTO”), including, but not limited to: CVS, United States Trademark Registration No. 919,941,
registered on September 7, 1971, with a first use in commerce of May 9, 1963; CVS, United States
Trademark Registration No. 1,698,636, registered on July 7, 1992; CVS, United States Trademark
Registration No. 1,904,058, registered on July 11, 1995 and CVS HEALTH, United States Trademark
Registration No. 5,055,141, registered on October 4, 2016. The Complainant also owns hundreds of
registered trademarks in dozens of jurisdictions worldwide for marks that consist of or contain CVS or CVS
HEALTH (hereinafter collectively referred to as the “CVS Mark”).

The Complainant is the owner of the domain name <cvshealth.com>, registered on April 15, 2005, from which it operates its main consumer-facing website that describes its company and services, among other things.

The Disputed Domain Name was registered on September 19, 2024, and resolves to an error landing page with no substantive content, and thus is not using the Disputed Domain Name in connection with an active website. It was reported to the Complainant by a cybersecurity company that the Respondent used the

Disputed Domain Name to perpetuate a phishing scheme in which the Respondent configured the Disputed Domain Name for email functions and used the email address incorporating the Disputed Domain Name to impersonate an individual from the Complainant’s company by “sending out emails to vendors impersonating
someone from the company, requesting updates to orders or requesting quotes for various goods and

services in a supply chain attack.”

5. Parties’ Contentions

A. Complainant

The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the Disputed Domain Name. Notably, the Complainant contends that:

- the Disputed Domain Name is confusingly similar to the Complainant’s trademark because the Disputed term “corporation”, and then followed by the generic Top-Level Domain (“gTLD”) “.com”, and thus does not prevent a finding of confusing similarity;

- the Respondent has no rights or legitimate interests in respect of the Disputed Domain Name because,
among other things, the Respondent has not used the Disputed Domain Name in connection with an active

page 3

website; the Respondent used the Disputed Domain Name in connection with a phishing scam to
impersonate the Complainant ; and the Respondent was not commonly known by the CVS Mark or any

similar name; and

-the Disputed Domain Name was registered and was used in bad faith because, among other things, the and send fraudulent emails to the Complainant’s vendors, requesting updates to orders or requesting quotes for various goods and services; the Respondent had actual knowledge of the Complainant when it registered and used the Disputed Domain Name; and the Respondent used the Disputed Domain Name passively.

The Complainant seeks the transfer of the Disputed Domain Name from the Respondent to the Complainant in accordance with paragraph 4(i) of the Policy.

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

6. Discussion and Findings

Paragraph 4(a) of the Policy requires that the Complainant prove the following three elements in order to prevail in this proceeding:

(i) the Disputed Domain Name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights;

(ii)       the Respondent has no rights or legitimate interests in respect of the Disputed Domain Name; and

(iii)      the Disputed Domain Name was registered and is being used in bad faith.

A. Identical or Confusingly Similar

Paragraph 4(a)(i) of the Policy requires a two-fold inquiry: a threshold investigation into whether a complainant has rights in a trademark, followed by an assessment of whether the disputed domain name is identical or confusingly similar to that trademark. The Panel concludes that in the present case, the Disputed Domain Name is confusingly similar to the CVS Mark.

It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the Disputed Domain Name. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), section 1.7.

It is uncontroverted that the Complainant has established rights in the CVS Mark based on its many years of
use as well as its registered trademarks for the CVS Mark in the United States and jurisdictions worldwide.
The consensus view is that “registration of a mark is prima facie evidence of validity”. The Respondent has
not rebutted this presumption, and therefore the Panel finds that the Complainant has rights in the CVS

Mark.

The Disputed Domain Name consists of the entirety of the Complainant’s CVS Mark, followed by the term
“health”, joined by a hyphen to the term “corporation”, and then followed by the gTLD “.com”. The Panel
therefore finds that the CVS Mark is recognizable within the Disputed Domain Name. Accordingly, the Panel
concludes that the Disputed Domain Name is confusingly similar to the trademark for the purposes of the
Policy. WIPO Overview 3.0, section 1.7.

page 4

As stated in section 1.8 of WIPO Overview 3.0, “where the relevant trademark is recognizable within the disputed domain name, the addition of other terms (whether descriptive, geographical, pejorative, meaningless, or otherwise) would not prevent a finding of confusing similarity under the first element”. Thus, the addition of the term “health” to the Complainant’s CVS Mark in the Disputed Domain Name, joined by a hyphen to the term “corporation” does not prevent a finding of confusing similarity. See e.g., Allianz Global Investors of America, L.P. and Pacific Investment Management Company (PIMCO) v. Bingo-Bongo, WIPO Case No. D2011-0795; and Hoffmann-La Roche Inc. v. Wei-Chun Hsia, WIPO Case No. D2008-0923. Moreover, it is well established that a disputed domain name that wholly incorporates a trademark will normally be considered confusingly similar to that trademark for purposes of the Policy despite the addition of a hyphen. The presence or absence of punctuation marks such as hyphens cannot on their own avoid a finding of confusing similarity. See Six Continents Hotels, Inc. v. Helen Siew, WIPO Case No. D2004-0656.

Finally, the addition of a gTLD such as “.com” in a domain name is a technical requirement. As such, it is
well established that a gTLD may typically be disregarded when assessing whether a disputed domain name
is identical or confusingly similar to a trademark. See Proactiva Medio Ambiente, S.A. v. Proactiva, WIPO
Case No. D2012-0182 and WIPO Overview 3.0, section 1.11.1. Thus, the Panel finds that the Disputed

Domain Name is confusingly similar to the Complainant’s CVS Mark.

Based on the available record, the Panel finds that the first element of the Policy has been established.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name.

Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving that a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.0, section 2.1.

In this case, given the facts as set out above, the Panel finds that the Complainant has made out a prima
facie case. The Respondent has not submitted any arguments or evidence to rebut the Complainant’s prima
facie case. Furthermore, the Complainant has not authorized, licensed or otherwise permitted the
Respondent to use its CVS Mark. Nor does the Complainant have any type of business relationship with the
Respondent. There is also no evidence that the Respondent is commonly known by the Disputed Domain
Name or by any similar name, nor any evidence that the Respondent was using or making demonstrable
preparations to use the Disputed Domain Name in connection with a bona fide offering of goods or services.
See Policy, paragraph 4(c).

Further, based on the reported use made by the Respondent of the Disputed Domain Name to impersonate the Complainant’s vendors and configure emails to perpetuate a phishing scheme, requesting updates to orders or quotes for various goods and services, does not confer rights or legitimate interests on the Respondent. See WIPO Overview 3.0, section 2.13.1 (“Panels have categorically held that the use of a domain name for illegal activity (e.g., the sale of counterfeit goods or illegal pharmaceuticals, phishing, distributing malware, unauthorized account access/hacking, impersonation/passing off, or other types of fraud) can never confer rights or legitimate interests on a respondent.”). See also CMA CGM v. Diana Smith, WIPO Case No. D2015-1774 (finding that the respondent had no rights or legitimate interests in the disputed domain name, holding that “such phishing scam cannot be considered a bona fide offering of goods or services nor a legitimate noncommercial or fair use of the Domain Name”).

page 5

In sum, the Panel concludes that the Complainant has established an unrebutted prima facie case that the Respondent lacks rights or legitimate interests in the Disputed Domain Name. The Panel finds it likely that the Respondent is using the Disputed Domain Name for commercial gain with the intent to mislead and

defraud the Complainant’s vendors by incorporating the Disputed Domain Name into fraudulent emails sent
by the Respondent to those vendors in the name of the Complainant. The Panel states that such use cannot
conceivably constitute a bona fide offering of a product or service within the meaning of paragraph 4(c)(i) of
the Policy. The Panel also concludes that nothing on the record before it would support a finding that the

Respondent is making a legitimate noncommercial or fair use of the Disputed Domain Name.

Based on the available record, the Panel finds that the second element of the Policy has been established.

C. Registered and Used in Bad Faith

The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith.

Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith. The Panel finds that based on the record, the Complainant has demonstrated the existence of the Respondent’s bad faith registration and use of the Disputed Domain, but other circumstances may be relevant in assessing whether a respondent’s registration and use of a domain name is in bad faith. WIPO Overview 3.0, section 3.2.1.

First, based on the circumstances here, the Panel concludes that the Respondent’s registration and use of the Disputed Domain Name had been done for the specific purpose of trading on the name and reputation of the Complainant and its CVS Mark. See Madonna Ciccone, p/k/a Madonna v. Dan Parisi and “Madonna.com”, WIPO Case No. D2000-0847 (“[t]he only plausible explanation for Respondent’s actions appears to be an intentional effort to trade upon the fame of Complainant’s name and mark for commercial gain”).

WIPO Overview 3.0, section 3.1.4 (use of a domain name for per se illegitimate activity such as phishing or impersonation/passing off is considered evidence of bad faith). See also Stichting BDO v. Contact Privacy Inc. Customer 7151571251/gregory Motto, WIPO Case No. D2022-2023 (finding the phishing scheme and use of an email address incorporating the disputed domain name to fraudulently obtain payment of invoices to be evidence of bad faith pursuant to paragraph 4(b)(iv) of the Policy for intentionally misleading and confusing the public into believing that the Respondent was associated and/or affiliated with the Complainant).

Second, panels have held that the use of a domain name for illegal activity constitutes bad faith. registration and use of the Disputed Domain Name constitutes bad faith under the Policy due to the Respondent’s reported use of an email phishing scheme in which the Respondent sent fraudulent emails to the Complainant’s vendors, requesting updates to orders or quotes for various goods and services. See

The activation of MX records for the Disputed Domain Name by the Respondent further reinforces Panel’s Complainant’s vendors of sums of money as reported to the Complainant by a cybersecurity company. Such conduct demonstrates the Respondent’s bad faith and is precisely the conduct that the Policy aims to proscribe.
finding on bad faith because it gives rise to the possibility that the Respondent intended to use the Disputed
Domain Name to send emails as part of a fraudulent phishing scheme. Thus, the Panel concludes that the

Third, the Panel also finds that the Respondent had actual knowledge of the Complainant and its rights in the CVS Mark when registering the Disputed Domain Name, emblematic of bad faith registration and use. It strains credulity to believe that the Respondent did not know of the Complainant or its CVS Mark, as evidenced by the Respondent’s use of the entirety of the CVS Mark in the Disputed Domain Name with the

page 6

related term “health”. Thus, the Panel finds that in the present case, the Respondent had the Complainant’s
CVS Mark in mind when registering and using the Disputed Domain Name.

Finally, inactive or passive holding of the Disputed Domain Name by the Respondent may amount to bad faith. See Advance Magazine Publishers Inc. and Les Publications Condé Nast S.A. v. ChinaVogue.com, WIPO Case No. D2005-0615; Société pour l’Oeuvre et la Mémoire d’Antoine de Saint Exupéry –

Succession Saint Exupéry – D’Agay v. Perlegos Properties, WIPO Case No. D2005-1085. It has long been held in UDRP decisions that the passive holding of a disputed domain name that incorporates a well-known or distinctive trademark without a legitimate purpose does not prevent a finding that the disputed domain
Telstra Corporation Limited v.

name is being used in bad faith under paragraph 4(a)(iii) of the Policy. See name (i.e., passive holding) does not prevent a finding of bad faith. See WIPO Overview 3.0, section 3.3.

Nuclear Marshmallows, WIPO Case No. D2000-0003; Jupiters Limited v. Aaron Hall, WIPO Case No.
Based on the passive holding doctrine, the Panel has taken into consideration the following factors in arriving
at a finding of bad faith registration and use: (i) the Complainant’s trademark is well-known; (ii) the
Respondent appears to have taken pains to conceal its identity by using a privacy protection service; and
(iii) the Respondent has not submitted a response in the proceeding. The Panel therefore finds that the
Disputed Domain Name, which resolves to an inactive landing page, has been used passively, and thus, the

Respondent registered and used the Disputed Domain Name in bad faith.

Based on the available record, the Panel finds that the third element of the Policy has been established.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Disputed Domain Name <cvshealth-corporation.com> be transferred to the Complainant.

/Lynda M. Braun/
Lynda M. Braun
Sole Panelist
Date: December 9, 2024