Instagram, LLC v Domain Admin, Whois Privacy Corp. / Alexander

WIPO Case No. D2022-0678

ARBITRATION
AND
MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

Instagram, LLC v. Domain Admin, Whois Privacy Corp. / Alexander
Papadopoulos, Domain Admin, Whois Privacy Corp. / Lukas Erickson

Case No. D2022-0678

1. The Parties

The Complainant is Instagram, LLC, United States of America (“United States”), represented by Tucker Ellis
LLP, United States.

The Respondents are Domain Admin, Whois Privacy Corp., Bahamas / Alexander Papadopoulos, Greece, and Domain Admin, Whois Privacy Corp., Bahamas / Lukas Erickson, United Kingdom.

2. The Domain Names and Registrar

The disputed domain names <hackinstagram.net> and <hackinstagrampasswords.com> are registered with

Internet Domain Service BS Corp (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on February 28, 2022. On February 28, 2022, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain names. On March 1, 2022, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain names which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on March 1, 2022, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on March 5, 2022.

The Center verified that the Complaint together with the amended Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for

Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondents of the
Complaint, and the proceedings commenced on March 9, 2022. In accordance with the Rules, paragraph 5,
the due date for Response was March 29, 2022. The Respondents did not submit any response.
Accordingly, the Center notified the Respondents’ default on March 31, 2022.

page 2

The Center appointed Alistair Payne as the sole panelist in this matter on April 20, 2022. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The Complainant is a well reputed global online photo and video sharing social networking application and currently has over 1 billion monthly active users and 500 million daily active users, and is ranked the 18th most visited site in the world according to web information company Alexa. It owns numerous trade mark registrations worldwide for the word mark INSTAGRAM including United States Registration No. 4,146,057, INSTAGRAM, registered on May 22, 2012, and European Union Trade Mark No. 014493886 for INSTAGRAM, registered on December 24, 2015. The Complainant also owns various domain names incorporating its INSTAGRAM trade mark, including <instagram.net> and <instagram.com>.

The disputed domain name <hackinstagram.net> was registered on August 5, 2013 to Alexander
Papadopoulos of Greece and resolves to a website which offers a “free” tool to hack Instagram accounts and
the disputed domain name <hackinstagrampasswords.com> was registered on May 2, 2014 by Lukas

Erickson of the United Kingdom and redirects to <hackinstagram.net> and ultimately to the same website.

5. Parties’ Contentions

A. Complainant

The Complainant requests that the disputes in relation to each of the disputed domain names be consolidated. It notes that where a complaint is filed against multiple respondents, panels consider: (i) whether the domain names or corresponding websites are subject to common control, and (ii) whether the consolidation would be fair and equitable to all parties.

The Complainant submits that the disputed domain name <hackinstagrampasswords.com> redirects to the other disputed domain name <hackinstagram.net>. It says that both disputed domain names redirect to the exact same website, which offers a “free” tool to “hack” Instagram accounts. The Complainant notes that

both disputed domain names use the same naming pattern, combining the term “hack” with the
Complainant’s INSTAGRAM mark. The Complainant says that it is apparent that both disputed domain
names have a similar meaning in that they evoke a service for hacking Instagram passwords and accounts
and that this further supports an inference that the respondents are operating for a common purpose. The
Complainant notes that both of the disputed domain names were registered with the same registrar and use
the same privacy service and both incorporate the Complainant’s INSTAGRAM mark in its entirety. It
follows, submits the Complainant, that it is therefore more likely than not that the disputed domain names are
subject to common ownership or control.

The Complainant submits that requiring it to file separate complaints would cause the Complainant to incur considerable additional time and expense. It says that consolidation will permit multiple domain name disputes arising from a common nucleus of facts and involving common legal issues to be heard and efficiently resolved in a single administrative proceeding.

The Complainant submits that it owns registered trade mark rights as noted above and that its INSTAGRAM mark is wholly incorporated into each of the disputed domain names. It says that the addition of the words “hack” and/or “passwords” in each of the disputed domain names does not remove the confusing similarity between each of them and the Complainant’s INSTAGRAM mark.

The Complainant submits that the Respondents are not using the disputed domain names in connection with a bona fide offering of goods or services. It says that the Respondents are not licensees of the Complainant

page 3

and are not affiliated with the Complainant in any way. The Complainant submits that it has not authorised an illegal hacking scheme that it says likely distributes malware onto users’ devices. It says that the Respondents use the disputed domain names to offer a “free download” of software purportedly capable of hacking Instagram user accounts. In doing so they use the INSTAGRAM mark, including a stylized representation of the Complainant’s registered camera logo design and according to the Complainant this might suggest that some affiliation exists between the Complainant and the Respondents when no such affiliation exists. None of this, says the Complainant, is use in connection with a bona fide offering of goods or services.

the Respondents to make use of its INSTAGRAM trade mark, in a domain name or otherwise. The

Neither, says the Complainant, is there any evidence to suggest that the Respondents are commonly known by either of the respective disputed domain names. The Complainant notes that the WhoIs data for the disputed domain names do not identify a person or company commonly known by those names. It says that the Respondent names identified by the Registrar, too, are individuals which do not resemble the disputed domain names in any way and that the Respondents are making an unauthorised use of the INSTAGRAM mark and logo on the website to which the disputed domain names resolve.

Nor, says the Complainant are the Respondents currently making a legitimate noncommercial or fair use of the respective disputed domain names without intent for commercial gain to misleadingly divert consumers as the Respondents’ website is currently being used in connection with an illegal hacking scheme and the potential distribution of malware.

As far as bad faith is concerned the Complainant submits that the use of the disputed domain names for per se illegal activity, such as hacking and malware distribution is considered evidence of bad faith (see WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), section 3.1.4). It says also that the registration of a confusingly similar domain name that is obviously connected with a particular trade mark owner by someone with no connection with the trade mark owner, suggests bad faith. It says that in this case each of the disputed domain names are confusingly similar to the Complainant’s INSTAGRAM mark and were registered several years after the mark’s registration and because the Complainant’s mark is so well known, the registration and use by the Respondents of each of the disputed domain names, especially in connection with a hacking scheme and the potential distribution of malware, supports a finding of bad faith.

Finally, it says that the presence of a disclaimer at the bottom of the Respondents’ website indicates that
they are fully aware of the Complainant’s INTAGRAM mark and also of the confusion caused by the disputed
domain names. It says that the disclaimer does not serve to render the Respondents’ activities bona fide
and that considering the degree of repute attaching to the INSTAGRAM mark there are no circumstances
under which the Respondents’ use of the disputed domain names could plausibly be in good faith under the

Policy.

B. Respondent

The Respondents did not reply to the Complainant’s contentions.

6. Discussion and Findings

In this case the disputed domain name <hackinstagrampasswords.com> redirects to the other disputed
domain name <hackinstagram.net> and both disputed domain names ultimately resolve to the same
website, which offers a “free” tool to “hack” Instagram accounts. As the Complainant notes, it is apparent
that both disputed domain names have a similar meaning in that they evoke a service for hacking Instagram
passwords and accounts. Further, both disputed domain names were registered with the same registrar and
use the same privacy service, all of which is further suggestive of them being under common control.

page 4

Consolidation of cases with apparently separate respondents is generally permitted where the circumstances
suggest that the disputed domain names are under common control and where consolidation would also be
fair and equitable, as appears to be the case here. Where, as in this case, both disputed domain names
also resolve ultimately to the same website and therefore concern common factual circumstances and legal
issues and there are no other factors mitigating against consolidation, then it appears most efficient for the

disputes to be resolved in a single administrative proceeding.

In the circumstances of this case, the Panel finds that the disputed domain names, or at least the
corresponding websites, are subject to common control, and consolidation would be fair and equitable to all

Parties. Accordingly, the Panel orders consolidation of the disputes into these proceedings.

A. Identical or Confusingly Similar

The Complainant has demonstrated that it owns numerous trade mark registrations worldwide for the word mark INSTAGRAM including United States Registration No. 4,146,057, INSTAGRAM, registered on May 22, 2012, and European Union Trade Mark No. 014493886 for INSTAGRAM, registered on December 24, 2015. Each of the disputed domain names wholly incorporate the Complainant’s INSTAGRAM mark and are therefore confusingly similar to it. The inclusion in addition of the English words “hack” and/or “passwords” does not prevent a finding of confusing similarity. As a result the Complaint succeeds under the first element of the Policy.

B. Rights or Legitimate Interests

The Complainant has submitted that the Respondents are not using the disputed domain name in connection with a bona fide offering of goods or services. It has further said that the Respondents are not licensees of the Complainant and are not affiliated with the Complainant in any way, and that it has not authorised either of the Respondents to make use of its INSTAGRAM trade mark, in a domain name, or otherwise.

The Complainant has also submitted that the Respondents are using each of the disputed domain names in connection with an illegal hacking scheme that very likely distributes malware onto users’ devices. It says that the Respondents are using the disputed domain names to offer a “free download” of software purportedly capable of hacking Instagram user accounts. Based on the representation of the website to which each of the disputed domain names ultimately resolve, it appears to the Panel that the Respondents are certainly offering hacking software from the website and that they are using the INSTAGRAM mark and also the stylized representation of that mark used by the Complainant without its authority and illegitimately.

The Complainant has also asserted that neither of the Respondents are commonly known by the respective disputed domain names on the basis that the WhoIs data for the disputed domain names does not identify a person or company commonly known by those names. Rather, individuals identified by the Registrar do not resemble either of the disputed domain names in any way. The Complainant has submitted that the

Respondents are not making a legitimate noncommercial or fair use of the disputed domain names but is rather seeking to mislead Internet users to divert them to its website likely for its own commercial purposes, namely for an illegal hacking scheme. The Complainant has also suggested that this could be for the purpose of distribution of malware onto users’ devices.

In these circumstances the Panel finds that the Complainant has made out a prima facie case that the Respondents have no rights or legitimate interests in the disputed domain names. This case has not been rebutted by the Respondents. For this reason, and also as set out under Part C below, the Panel finds that the Complaint succeeds under this element of the Policy.

C. Registered and Used in Bad Faith

The disputed domain names were registered in August 2013 and May 2014 respectively. Both registrations postdate the Complainant’s United States Registration No. 4,146,057 for INSTAGRAM registered on

page 5

May 22, 2012. Considering that the Complainant’s INSTAGRAM mark is a very distinctive coined term used by the Complainant for its global platform under the INSTAGRAM mark, that both the disputed domain names ultimately redirect users to the same website, and that the product being promoted at that website is for the purpose of hacking the passwords of accounts on the Complainant’s INSTAGRAM websites, and even uses the mark INSTAGRAM in the same fancy font as used by the Complainant, it is apparent that the Respondents were well aware of the Complainant and its INSTAGRAM platform upon registration of each of the disputed domain names.

The use of the disputed domain names by the Respondents to resolve to a website that offers a product which is specifically being promoted to facilitate the illegal and unauthorised hacking of passwords on the Complainant’s INSTAGRAM website amounts to evidence of bad faith in and of itself. (See section 3.1.4 of the WIPO Overview 3.0). Moreover, the circumstances of this case tend to support the Complainant’s contention that the disputed domain names are being used for the purpose of distributing malware. While there is no direct evidence of this conduct, there is a reasonably strong inference that the Respondent is using the website at the disputed domain names for this purpose, noting, inter alia, the layout and content of the website.

Further, in circumstances that the INSTAGRAM mark is so well reputed globally the mere use of it in the
disputed domain names, by an unaffiliated entity without authorisation, creates a presumption of bad faith
(See section 3.1.4 of the WIPO Overview 3.0). There is no suggestion here that the disputed domain
names, each of which contain the word “hack”, are in any way being used for a legitimate purpose under
section 4(c) of the Policy and the Respondents had every opportunity to justify their use in the course of
these proceedings. On the contrary they are being used in relation to a product and website that facilitates
unauthorised hacking and in those circumstances no disclaimer can render the Respondents’ activities and
their use of the respective disputed domain names as bona fide. The fact that both disputed domain names
are registered in the name of a privacy service only reinforces the Panel’s view of the Respondents’ bad faith
in these circumstances.

Accordingly, the Panel finds that the disputed domain names have been both registered and used in bad faith and that the Complaint also succeeds under this element of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain names, <hackinstagram.net> and <hackinstagrampasswords.com>, be transferred to the Complainant.

/Alistair Payne/
Alistair Payne
Sole Panelist
Date: May 4, 2022