CVS Pharmacy, Inc. v Vusimuzi Hlongwa

WIPO Case No. D2023-4228

ARBITRATION

AND

MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

CVS Pharmacy, Inc. v. Vusimuzi Hlongwa

Case No. D2023-4228

1. The Parties

The Complainant is CVS Pharmacy, Inc., United States of America (“United States” or “US”), represented by

The GigaLaw Firm, Douglas M. Isenberg, Attorney at Law, LLC, United States.

The Respondent is Vusimuzi Hlongwa, South Africa.

2. The Domain Name and Registrar

The disputed domain name <cvchaelth.com> is registered with Tucows Inc. (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on October 11, 2023. On October 11, 2023, the Center transmitted by email to the Registrar a request for registrar verif ication in connection with the disputed domain name. On October 11, 2023, the Registrar transmitted by email to the Center its verif ication response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent (REDACTED FOR PRIVACY / REDACTED FOR PRIVACY) and contact information in the Complaint. The Center sent an email communication to the Complainant on October 12, 2023, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant f iled an amendment to the Complaint on October 12, 2023.

The Center verif ied that the Complaint together with the amendment to the Complaint satisf ied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notif ied the Respondent of the Complaint, and the proceedings commenced on October 19, 2023. In accordance with the Rules, paragraph 5, the due date for Response was November 8, 2023. The Respondent did not submit any response. However, the entity confirmed by the Registrar verif ication as the Administrative and Billing contact sent email communications to the Center on October 12, 2023, and October 27, 2023. On November 15, 2023, the Center informed the Parties that it would proceed to panel appointment.

page 2

The Center appointed WiIliam A. Van Caenegem as the sole panelist in this matter on November 22, 2023. The Panel f inds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The Complainant is a wholly owned subsidiary of CVS Health and operates one of the largest pharmacy chains in the United States with approximately 300,000 workers in more than 9,000 locations.

The Complainant operates the domain name <cvshealth.com>.

The Complainant is the owner of at least 616 trademark registrations in 42 jurisdictions worldwide for marks that consist of or contain CVS or CVS HEALTH. It is inter alia the registered proprietor in relation to US Registration No. 5,055,141 for CVS HEALTH (f irst used September 6, 2014; registered October 4, 2016); and US Registration No. 5,402,010 for CVS HEALTH (f irst used November 30, 2015; registered February 13, 2018)

. send and receive emails with addresses that use the disputed domain name. The Respondent has engaged in phishing activity using the email address with the terms “account payable” in the form of “[…]@cvchaelth.com.”

The disputed domain name was registered on August 29, 2023, and does not resolve to an active website.
5. Parties’ Contentions
A. Complainant

The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain name.

Notably, the Complainant contends that the disputed domain name is an obvious typo of the CVS trademark because it substitutes the letter “s” with the letter “c” and inverts the letters “e” and “a”. The disputed domain name is therefore said to be an intentional misspelling of the kind mentioned in section 1.9 of WIPO

Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”) and hence confusingly similar to the CVS HEALTH trademark. The Complainant maintains that its trademark is clearly recognizable within the disputed domain name despite the slight spelling variation, and that numerous panels have found that the difference of a single letter does nothing to alleviate confusing similarity. The Complainant points out that previous panels have also found that disputed domain names containing the misspelled word “haelth” are confusingly similar to trademarks that contain the word “health”. The absence of a space between “cvs” and “health” is inconsequential, the Complainant contends.

The Complainant also asserts that the Respondent has no rights or legitimate interests in the disputed domain name, and the Complainant has never assigned, granted, licensed, sold, transferred or in any way authorized the Respondent to register or use the CVS trademark in any manner. The Respondent clearly has not used the disputed domain name “in connection with a bona fide offering of goods or services” and, therefore, cannot establish rights or legitimate interests pursuant to paragraph 4(c)(i) of the Policy as it has been using it in connection with a phishing scam to impersonate the Complainant. The Complainant says that to its knowledge, the Respondent has never been commonly known by the disputed domain name and has never acquired any trademark or service mark rights in the disputed domain name. For that reason, the Complainant says, the Respondent cannot establish rights or legitimate interests pursuant to paragraph 4(c)(ii) of the Policy. The Complainant adds that by using the disputed domain name as part of a phishing scam to impersonate the Complainant, the Respondent cannot establish rights or legitimate interests in it under paragraph 4(c)(iii) of the Policy.

page 3

The Complainant contends that in accordance with WIPO Overview 3.0, section 3.1.4 “[T]he mere registration of a domain name that is identical or confusingly similar… to a famous or widely-known trademark by an unaffiliated entity can by itself create a presumption of bad faith.”. The CVS trademark is clearly famous and/or widely known, the Complainant contends, given that it is protected by at least 616 trademark registrations in at least 42 jurisdictions worldwide, the oldest of which was registered more than 52 years ago. Further, previous panels have referred to “the reputation and fame” of the trademark CVS. The Complainant further asserts that it is inconceivable therefore that the Respondent was unaware of the Complainant when registering the disputed domain name. The Complainant says that the disputed domain name is “so obviously connected with” the Complainant that the Respondent’s actions suggest “opportunistic bad faith” in violation of the Policy.

The Complainant further contends that by using the disputed domain name as part of a phishing scam to impersonate the Complainant, the Respondent has acted in bad faith pursuant to paragraph 4(b)(iii) of the Policy (by “register[ing] the domain name primarily for the purpose of disrupting the business of a

competitor”) and paragraph 4(b)(iv) of the Policy (by “intentionally attempt[ing] to attract, for commercial gain, sponsorship, af f iliation, or endorsement of [Respondent’s] product or service…”). The fact that the Respondent established MX records for the disputed domain name, which enables it to send and receive email, is further evidence of bad faith because it “give[s] rise to the strong possibility that Respondent intended or intends to use the disputed domain name to send emails as part of a f raudulent phishing scheme.”

Finally, the Complainant says that a further indication of bad faith under the Policy is the fact that the oldest existing registration for its CVS trademark, US Registration No. 919, 941, was first used more than 60 years (and registered more than 52 years) before the Respondent’s registration of the disputed domain name.

B. Respondent

The Respondent did not reply to the Complainant’s contentions. However, on October 12, 2023, and October 27, 2023 the Center received emails from an Internet Service Provider company, conf irmed by the Registrar verif ication as the Administrative and Billing contact, indicating that the Respondent, was a

customer of their company but that the Respondent’s account was no longer active. The emails further state that the company has terminated the Respondent’s account on October 11, 2023, for failure to pay and that the Respondent’s account was blacklisted in their system.

6. Discussion and Findings
A. Identical or Confusingly Similar

It is well accepted that the f irst element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain name; see WIPO Overview 3.0, section 1.7.

Based on the available record, the Panel finds the Complainant has shown rights in respect of a trademark or service mark for the purposes of the Policy (WIPO Overview 3.0, section 1.2.1), in particular the marks CVS and CVS HEALTH.

The Panel f inds that the CVS and CVS HEALTH marks are recognizable within the disputed domain name. Accordingly, the disputed domain name is confusingly similar to the marks for the purposes of the Policy; see WIPO Overview 3.0, section 1.7.

The disputed domain name substitutes the letter “s” with the letter “c” and inverts the letters “e” and “a”. The disputed domain name is therefore said to be an intentional misspelling of the kind mentioned in section 1.9 of WIPO Overview 3.0 and hence confusingly similar to the CVS and CVS HEALTH trademarks.

page 4

Based on the available record, the Panel f inds the f irst element of the Policy has been established.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name.

Although the overall burden of proof in UDRP proceedings is on the Complainant, panels have recognized that proving a Respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is of ten primarily within the knowledge or control of the Respondent. As such, where a Complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the Respondent to advance relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisf ied the second element (WIPO Overview 3.0, section 2.1).

Having reviewed the available record, the Panel finds the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent has not rebutted the Complainant’s prima facie case and has not advanced any relevant evidence demonstrating rights or legitimate interests in the disputed domain name such as those enumerated in the Policy or

otherwise.

Panels have held that the use of a domain name for illegal activity, in this case phishing, can never confer rights or legitimate interests on a respondent (WIPO Overview 3.0, section 2.13.1). The Respondent has used the disputed domain name in connection with a phishing scam by impersonating the Complainant’s “Account Payable” department.

Based on the available record, the Panel f inds the second element of the Policy has been established.

C. Registered and Used in Bad Faith

The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith.

In the present case, the Panel notes that the Respondent has used the disputed domain name for illegal activity, that being phishing, it is improbable in the circumstances that the Respondent registered the disputed domain name without knowledge of the Complainant or its rights in the CVS HEALTH trademark. The Complainant has a very extensive reputation in relation to pharmacies in the United States, of which it operates 9,000 or so establishments under the CVS mark. The deliberate misspelling of the CVS HEALTH mark in the disputed domain name is also consistent with bad faith registration. The Respondent

established MX records for the disputed domain name, enabling it to use it to send and receive email, which according to the record it then proceeded to do so by impersonating the Complainant. This is further evidence of bad faith.

Based on the available record, the Panel finds that the Complainant has established the third element of the
Policy.

page 5

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <cvchaelth.com> be transferred to the Complainant.

/WiIliam A. Van Caenegem/
WiIliam A. Van Caenegem
Sole Panelist
Date: December 6, 2023