Enel S.p.A. v Privacy service provided by Withheld for Privacy ehf/Paolo

WIPO Case No. D2022-2504

ARBITRATION

AND

MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

Enel S.p.A. v. Privacy service provided by Withheld for Privacy ehf/Paolo
Frizzi

Case No. D2022-2504

1. The Parties

The Complainant is Enel S.p.A., Italy, represented by Società Italiana Brevetti S.p.A., Italy.

The Respondent is Privacy service provided by Withheld for Privacy ehf, Iceland/ Paolo Frizzi, Italy, self represented.

2. The Domain Name and Registrar

The disputed domain name <enelenergia.email> is registered with NameCheap, Inc. (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on July 4, 2022. On

July 11, 2022, a revised Complaint was received by the Complainant. On July 11, 2022, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On July 11, 2022, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on July 12, 2022 providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on July 15, 2022.

The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal

requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for

Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for

Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the the due date for Response was August 9, 2022. The Response was filed with the Center on July 28, 2022.

page 2

The Center appointed Edoardo Fano as the sole panelist in this matter on August 12, 2022. The Panel finds
that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of

Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

Pursuant to the paragraphs 10 and 12 of the Rules, on August 25, 2022, the Panel issued a Procedural
Order, followed by a reminder on August 31, 2022, requesting the Complainant to confirm that the
Respondent is not authorized to use its trademark and to address the question of whether the Complainant
is a customer of the Respondent, and requesting the Respondent to provide evidence, if any exists, that the

Complainant is a customer, on or before August 31, 2022.

On August 31, 2022, both the Complainant and Respondent submitted their respective reply to the Panel’s

Procedural Order.

The language of the proceeding is English, being the language of the Registration Agreements, as per paragraph 11(a) of the Rules.

4. Factual Background

The Complainant is Enel S.p.A., an Italian company operating in the field of energy supply and owning several trademark registrations for ENEL, among which the following ones:

-	European Union Trademark Registration No. 000756338 for ENEL and design, registered on June 25,
1999;
-	Italian Trademark Registration No. 0000825734 for ENEL, registered on October 4, 2000; and
-	Italian Trademark Registration No. 0001299011 for ENEL, registered on June 1, 2010.

The Complainant also operates on the Internet, owning several domain names which include the trademark

ENEL and being “ and “ its main websites.

The Complainant provided evidence in support of the above.

According to the WhoIs records, the disputed domain name was registered on December 1, 2021, and when

the Complaint was filed the disputed domain name redirected to a webpage belonging to the Respondent’s

website and explaining that it is part of a simulated phishing cyber-attack.

5. Parties’ Contentions

A. Complainant

The Complainant states that the disputed domain name <enelenergia.email> is confusingly similar to its trademark ENEL.

Moreover, the Complainant asserts that the Respondent has no rights or legitimate interests in respect of the disputed domain name since it has not been authorized by the Complainant to register the disputed domain name or to use its trademark within the disputed domain name, it is not commonly known by the disputed domain name and it is not making either a bona fide offering of goods or services or a legitimate noncommercial or fair use of the disputed domain name.

The Complainant submits that the Respondent has registered the disputed domain name in bad faith, since

the Complainant’s trademark ENEL is well known in the field of energy supply. Therefore, the Respondent
targeted the Complainant’s trademark at the time of registration of the disputed domain name, with the

page 3

purpose to intentionally attract, for commercial gain, Internet users to its website by taking advantage of the

Complainant’s trademark reputation. Furthermore, the Complainant suspects that the Respondent could be

using the disputed domain name for phishing activities, since the MX records attached to the disputed

domain name have been activated.

Finally, in response to the Panel’s Procedural Order, requesting the Complainant to confirm that the

Respondent is not authorized to use its trademark and to address the question of whether the Complainant

is a customer of the Respondent, the Complainant confirmed that the Respondent is not authorized to use its

trademark and that the Complainant is not a customer of the Respondent.

B. Respondent

The Respondent is the CEO of Libraesva S.r.l., a company operating in the field of email security and

archiving solutionsand owning a phishing awareness platform called “PhishBrain”, at the website

The “PhishBrain” service consists of simulating phishing campaigns either via email or

SMS.

The Respondent states that the disputed domain name is used in the context of this phishing awareness service, being one of the many domains that the companies that bought the PhishBrain service can choose to send simulated phishing campaigns to their employees.

Therefore, the Respondent asserts to have a legitimate interest in respect of the disputed domain name since the latter is used for bona fide offering of its phishing awareness service to companies that are already

the Respondent’s customers, without the Respondent getting any commercial advantage.

The Respondent submits that the disputed domain name was not registered and is not used in bad faith, but instead that it protects the Complainant, whose trademark is routinely abused by malicious actors, and it

drives additional traffic to the Complainant’s website.

Finally, in response to the Panel’s Procedural Order, requesting the Respondent to provide evidence, if any

exists, that the Complainant is its customer, the Respondent confirmed that the Complainant is not its

customer.

6. Discussion and Findings

Paragraph 4(a) of the Policy lists three elements, which the Complainant must satisfy in order to succeed:

(i) the disputed domain name is identical or confusingly similar to a trademark or service mark in which the

Complainant has rights; and

(ii) the Respondent has no rights or legitimate interests in respect of the disputed domain name; and

(iii) the disputed domain name has been registered and is being used in bad faith.

A. Identical or Confusingly Similar

The Panel finds that the Complainant is the owner of the trademark ENEL both by registration and acquired reputation and that the disputed domain name is confusingly similar to the trademark ENEL.

Regarding the addition of the term “energia” (meaning “energy” in Italian), the Panel notes that it is now well

established that, where the relevant trademark is recognizable within the disputed domain name, the addition
of terms or letters to a domain name does not prevent a finding of confusing similarity between the disputed
domain name and the trademark (see, e.g., Aventis Pharma SA., Aventis Pharma Deutschland GmbH v.
Jonathan Valicenti, WIPO Case No. D2005-0037; Red Bull GmbH v. Chai Larbthanasub, WIPO Case No.

page 4

D2003-0709; America Online, Inc. v. Dolphin@Heart, WIPO Case No. D2000-0713). The addition of the

term “energia” does not therefore prevent the disputed domain name from being confusingly similar to the

Complainant’s trademark. See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third

Edition (“WIPO Overview 3.0”), section 1.8.

It is also well accepted that a generic Top-Level Domain (“gTLD”), in this case “.email”, is typically ignored

when assessing the similarity between a trademark and a domain name. See WIPO Overview 3.0, section

1.11.1.

The Panel finds that the Complainant has therefore met its burden of proving that the disputed domain name

is confusingly similar to the Complainant’s trademark, pursuant to the Policy, paragraph 4(a)(i).

B. Rights or Legitimate Interests

Paragraph 4(a)(ii) of the Policy requires the Complainant to prove that the Respondent has no rights or legitimate interests in the disputed domain name.

The Respondent may establish a right or legitimate interest in the disputed domain name by demonstrating in accordance with paragraph 4(c) of the Policy any of the following circumstances, in particular but without limitation:

“(i) before any notice to you of the dispute, your use of, or demonstrable preparations to use, the domain

name or a name corresponding to the domain name in connection with a bona fide offering of goods or

services; or

(ii) you (as an individual, business, or other organization) have been commonly known by the domain name,

even if you have acquired no trademark or service mark rights; or

(iii) you are making a legitimate noncommercial or fair use of the domain name, without intent for commercial

gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue.”

According to paragraph 4(a) of the Policy, the Complainant has the burden of proving the three elements of

the Policy. However, satisfying the burden of proving a lack of the Respondent’s rights or legitimate interests

in respect of the disputed domain name according to paragraph 4(a)(ii) of the Policy is potentially difficult,

since proving a negative circumstance is more complicated than establishing a positive one.

As such, it is well accepted that it is sufficient for the Complainant to make a prima facie case that the
Respondent has no rights or legitimate interests in the disputed domain name in order to shift the burden of
production on the Respondent. If the Respondent fails to demonstrate rights or legitimate interests in the
disputed domain name in accordance with paragraph 4(c) of the Policy or on any other basis, the
Complainant is deemed to have satisfied paragraph 4(a)(ii) of the Policy. See WIPO Overview 3.0, section
2.1.

The Complainant in its Complaint, and as set out above, has established a prima facie case that the Respondent has no rights or legitimate interests in the disputed domain name. It asserts that the Respondent is not currently associated with the Complainant in any way, is not commonly known by the disputed domain name and is not making a bona fide offering of goods or services or a legitimate noncommercial or fair use of the disputed domain name: according to the Complainant, the Respondent is intentionally attracting, for commercial gain, Internet users to its website by taking advantage of the

Complainant’s trademark reputation.

The prima facie case presented by the Complainant is enough to shift the burden of production to the
Respondent to demonstrate that it has rights or legitimate interests in the disputed domain name.

page 5

The Respondent asserts to have a legitimate interest in respect of the disputed domain name since the latter is used for a claimed bona fide offering of its phishing awareness service to companies that are already the

Respondent’s customers, and according to the Respondent without the Respondent getting any commercial

advantage.

According to the WIPO Overview 3.0, sections 2.5.2, the following factors should be considered as supporting a claimed fair use:

“(i) whether the domain name has been registered and is being used for legitimate purposes and not as a

pretext for commercial gain or other such purposes inhering to the respondent’s benefit, (ii) whether the

respondent reasonably believes its use (whether referential, or for praise or criticism) to be truthful and well

founded, (iii) whether it is clear to Internet users visiting the respondent’s website that it is not operated by

the complainant, (iv) whether the respondent has refrained from engaging in a pattern of registering domain

names corresponding to marks held by the complainant or third parties, (v) where appropriate, whether a

prominent link (including with explanatory text) is provided to the relevant trademark owner’s website, (vi)

whether senders of email intended for the complainant but (because of user confusion) directed to the

respondent are alerted that their message has been misdirected, (vii) whether there is an actual connection

between the complainant’s trademark in the disputed domain name and the corresponding website content,

and not to a competitor, or an entire industry, group, or individual, and (viii) whether the domain name

registration and use by the respondent is consistent with a pattern of bona fide activity (whether online or

offline).”

Considering that, as confirmed by both the Complainant and the Respondent in their respective reply to the

Panel’s Procedural Order, there is no relationship between the Complainant and the Respondent, the Panel

finds that the use of the Complainant’s trademark within the disputed domain name, so that the

Respondent’s customers could use it in order to simulate phishing campaigns with their employees, does not

provide the Respondent with rights or legitimate interests in the disputed domain name.

Internet users visiting the Respondent’s webpage, corresponding to the disputed domain name, would not

find any link to the relevant trademark Complainant’s website, unless they access another Respondent’s

webpage, namely “phishbrain.libraesva.com/?h=enelenergia.email”, and therefore they may misunderstand

that there is a relationship between the Respondent and the Complainant when there is/they are not, or that

the former’s actions are endorsed by the latter when they are not.

As regards the Respondent stating that, by using the disputed domain name, it is not getting any commercial advantage, the Panel is of the opinion that a commercial gain, like in the present case, may include gaining a reputational advantage, although not readily quantified, since Internet users could believe that the

Complainant is a Respondent’s customer and that the Respondent’s email security service has been

successfully used by the Complainant against phishing activities. See WIPO Overview 3.0, section 2.5.3. The Panel moreover has doubts as to this claim of the Respondent as it does not claim to be a non-profit

and its website bears links “get pricing” and “free trial” speaking to a commercial undertaking.

The Panel cites with approval Facebook, Inc. and Instagram, LLC v. WhoisGuard Protected, WhoisGuard, Inc. / Phishing Operations, Wombat Security Technologies, WIPO Case No. D2020-3218, and notes that while the Respondent may provide a useful service and recognizing that such service may rely on an appearance of authenticity in a broad sense, it is not clear why such service would require the use of domain

names confusingly similar to third party trademarks – whose owners have their own interest in monitoring and policing the use of their marks on the Internet – without authorization, as opposed e.g., to those of the Respondent’s actual clients who would presumably have authorized the use of their marks for such purpose.

The Panel therefore finds that paragraph 4(a)(ii) of the Policy has been satisfied.

page 6

C. Registered and Used in Bad Faith

Paragraph 4(b) of the Policy provides that “[…] for the purposes of paragraph 4(a)(iii) of the Policy, the

following circumstances, in particular but without limitation, if found by the Panel to be present, shall

be evidence of the registration and use of a domain name in bad faith:

(i) circumstances indicating that [the Respondent has] registered or has acquired the domain name related to the domain name; or

primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to
the Complainant who is the owner of the trademark or service mark or to a competitor of the
(ii) that [the Respondent has] registered the domain name in order to prevent the owner of the
trademark or service mark from reflecting the mark in a corresponding domain name, provided that

[the Respondent has] engaged in a pattern of such conduct; or

(iii) that [the Respondent has] registered the domain name primarily for the purpose of disrupting the

business of a competitor; or

(iv) that by using the domain name, [the Respondent has] intentionally attempted to attract, for

commercial gain, Internet users to [the Respondent’s] website or other online location, by creating a

likelihood of confusion with the Complainant’s mark as to the source, sponsorship, affiliation, or

endorsement of [the Respondent’s] website or location or of a product or service on [the

Respondent’s] website or location”.

Regarding the registration in bad faith of the disputed domain name, the reputation of the Complainant’s

trademark ENEL in the the field of energy supply is clearly established and the Panel finds that the domain name in bad faith, especially because in its Response the Respondent is stating that the

Complainant’s trademark is “routinely abused by malicious actors”.

As regards the use in bad faith of the disputed domain name, pointing to a Respondent’s webpage showing a simulated phishing cyber-attack, the Panel finds that it is likely to create confusion with the Complainant’s trademark as to the source, sponsorship, affiliation, or endorsement of the Respondent’s website and that

the Respondent is therefore knowingly taking advantage from user confusion. See WIPO Overview 3.0,
section 3.1.4. The Panel also incorporates here its findings under the second element and again notes that
nothing would prevent the Respondent from undertaking its activities by reference to third party marks that
have been authorized for such purpose; notably the record is devoid of any suggestion that the Respondent

has sought to contact the Complainant in this regard.

The above suggests to the Panel that the Respondent intentionally registered and is using the disputed

domain name in order to attract, for commercial gain, Internet users (here, employees of the Respondent’s

clients, even if it is self-evident that those employees are not per se clients of the Respondent) to its website

in or online location accordance with paragraph 4(b)(iv) of the Policy and based on taking advantage of the

reputation and goodwill in the Complainant’s marks for the benefit of the Respondent’s client(s).

Moreover, the Panel considers that the nature of the disputed domain name, which is almost identical to the

Complainant’s trademark with the mere addition of the term “energia” (meaning “energy” in Italian), further

supports a finding of bad faith. See WIPO Overview 3.0, section 3.2.1.

The Panel finds that the Complainant has presented evidence to satisfy its burden of proof with respect to the issue of whether the Respondent has registered and is using the disputed domain name in bad faith.

page 7

The Panel therefore finds that paragraph 4(a)(iii) of the Policy has been satisfied.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <enelenergia.email> be transferred to the Complainant.

/Edoardo Fano/

Edoardo Fano

Sole Panelist
Date: September 5, 2022