Passbolt S.A. v 4iT Support Pty Ltd

WIPO Case No. DAU2024-0013

ARBITRATION

AND

MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

Passbolt S.A. v. 4iT Support Pty Ltd

Case No. DAU2024-0013

1. The Parties

The Complainant is Passbolt S.A., Luxembourg, represented by IPSILON Benelux SA, Luxembourg.

The Respondent is 4iT Support Pty Ltd, Australia, internally represented.

2. The Domain Name and Registrar

The disputed domain name <passbolt.com.au> is registered with Web Address Registration Pty Ltd (the

“Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on April 18, 2024. On connection with the disputed domain name. On April 22, 2024, the Registrar transmitted by email to the Center its verification response confirming that the Respondent is listed as the registrant and providing the contact details.

The Center verified that the Complaint satisfied the formal requirements of the .au Dispute Resolution Policy
(the “Policy” or “.auDRP”), the Rules for .au Dispute Resolution Policy (the “Rules”), and the WIPO

Supplemental Rules for .au Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2(a) and 4(a), the Center formally notified the Respondent of the
Complaint, and the proceedings commenced on April 24, 2024. In accordance with the Rules, paragraph
5(a), the due date for Response was May 14, 2024. The Respondent sent an email to the Center on April
25, 2024. However, the Respondent did not file any formal Response. Accordingly, the Center notified the

commencement of panel appointment process on May 20, 2024.

The Center appointed Alistair Payne as the sole panelist in this matter on May 24, 2024. The Panel finds
that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of
Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

page 2

4. Factual Background

The Complainant provides computer software security solutions and IT products to companies, IT firms, governmental entities, and universities worldwide, under the name and trade mark PASSBOLT. The Complainant has developed an open source password manager, which allows companies concerned about their security and privacy to handle, share, and allow access to their contents with a high level of security. This service is available through the website at the Complainant’s <passbolt.com> domain name which was registered on January 25, 2011. The Complainant owns various trade mark registrations for or incorporating its PASSBOLT mark including International trade mark registration number 1566448 for PASSBOLT and logo which was registered on October 1, 2020, and is designated in Australia.

The disputed domain name appears to have been registered, or acquired by the Respondent, according to the Registrar’s records, on October 6, 2023. Prior to the filing of this Complaint, it resolved to a website with a login page that featured the Complainant’s PASSBOLT logo together with a field for entry of an email address.

5. Parties’ Contentions

A. Complainant

The Complainant submits that it owns registered trade mark rights in Australia incorporating its PASSBOLT mark as set out above. It says that the disputed domain name wholly incorporates its PASSBOLT mark and is therefore confusingly similar to it.

The Complainant submits that there is no evidence that the Respondent is affiliated with the Complainant, in any way or has he been authorised by it to use and register its trade mark and its legal name PASSBOLT, or to seek registration of any domain name incorporating the said trade mark and name. Furthermore, says the Complainant, the Respondent has no rights or legitimate interests in the disputed domain name. The

Complainant notes that its trade mark registration preceded the registration of the disputed domain name by some years and that the Respondent does not own any trade mark or other rights in the denomination “passbolt”. The Complainant also asserts that the Respondent is not commonly known by the disputed domain name and notes that the term “passbolt” does not occur in any way on the Respondent’s home website at “ nor on any website for which the Respondent is known and there is no evidence that the Respondent is or was ever associated in the consumer’s mind with the term “passbolt”. In short, says the Complainant, the Respondent cannot assert that, before any notice of this dispute, it was using, or had made demonstrable preparation to use, the disputed domain name, or a name corresponding to it in connection with bona fide offering or goods or services.

The Complainant has provided evidence that prior to filing of the Complainant the disputed domain name, resolved to a simulated login webpage which displayed connecting fields and which the Complainant says were most likely for the purpose of phishing or fraudulent misconduct in relation to the Complainant’s

customers’ and its prospects’ identification or account information. It further says that the fact that the direct Internet users for unclear purposes and with not a single link to the Respondent’s real identity cannot amount to a good faith use of the disputed domain name. The Complainant therefore submits that the Respondent was most likely misleading or defrauding consumers into revealing sensitive information based upon a misconception that the website was connected to, or authorised by, the Complainant. This, says the Complainant, does not amount to use of the disputed domain name for any type of legitimate business or service and is inconsistent with the Respondent having rights or legitimate interests in the disputed domain name.

page 3

The Complainant notes that access to the solutions and tools offered as part of its computer related business are provided online through an intranet/extranet system which allows customers to log in, purchase and manage its solutions. It says that the Complainant’s correct identification on the Internet and the security of the “Passbolt” website is therefore crucial in ensuring the proper conduct of the Complainant’s business.

With this in mind, the Complainant notes that, after becoming aware of the disputed domain name registration it sent an email in late October 2023 to the abuse address of the Registrar of the disputed domain name claiming the legitimate transfer of the disputed domain name. It notes that it followed up in December 2023 with a similar email to the auDA (the Registry) Compliance team, even offering to bear the transfer costs of the disputed domain name. However, it appears, according to the Complainant, that no agreement was reached, and no transfer was effected.

As far as registration in bad faith is concerned, the Complainant says that it is implausible that the Respondent was unaware of the Complainant’s trade mark rights when it registered the disputed domain name in circumstances that the Complainant’s trade mark registration was made long before the registration of the disputed domain name, would have appeared in any Google search or trade mark search and considering that the disputed domain name resolves to a web page on which appears, without authorisation, an exact replica of the Complainant’s registered PASSBOLT logo mark.

The Complainant submits that the disputed domain name is so obviously connected with its registered trade mark and the Respondent’s registration and use of the disputed domain name amounts to opportunistic bad faith. Further, says the Complainant, considering the nature of the disputed domain name, as well as the

identical use of the Complainant’s logo on the Respondent’s website, the Respondent could simply not have chosen the disputed domain name for any other reason than deliberately cause confusion amongst users as to its source in order to take unfair advantage of the Complainant’s rights and reputation, which clearly
constitutes a pattern of conduct of bad faith.

Moreover, says the Complainant, the disputed domain name resolves to a website allegedly permitting users to log in to the Complainant’s official website, or to one of the Complainant’s official services on the Internet, which is obviously not the case. It notes that the login widow, topped by the Complainant’s PASSBOLT logo is a clear demonstration that the Respondent has intentionally attempted to usurp the Complainant’s online identity, or to substitute in the Complainant’s online services, for obviously no legitimate reason, and

therefore has used the disputed domain name in bad faith.

B. Respondent

The Respondent did not reply formally to the Complaint, but its General Manager sent an email on April 25,

2024, to the Center in the following terms:

“I am writing to address the recent communication regarding the use of the open-source software from
Passbolt.com on the domain passbolt.com.au.

We understand the concerns and want to assure you that we had no intention of infringing on any copyright or trademark. We installed the open-source software from passbolt.com, and deployed it on passbolt.com.au strictly following the provided instructions. The suggestion that 4IT Support Pty Ltd, an established IT Company here in Australia was using this software to defraud clients is an outright lie and one look at the source from staff at Passbolt.com would have shown this. In addition 4iT Support Pty Ltd had met the requirements by AuDA to use the domain name.

Our purpose in setting up this free password management solution was to offer a basic option to our clients who might not have the budget for a premium product. It was never intended for any fraudulent activity and don’t appreciate suggestion of such just to try and get the domain name.

page 4

Since the service isn’t currently being actively used, we have proactively taken down the instance whilst finding are being made by WIPO.

In relation to the domain name, passbolt.com.au we registered the domain in good intentions. As Passbolt.com doesn’t have an established presence in Australia I do believe that Passbolt.com was just waiting for someone to register the domain name and try and get it transferred to them without having to go through the proper channels. We don’t have an endless money pit to fight Passbolt on this and will leave it at that.”

6. Discussion and Findings

A. Identical or Confusingly Similar

The Complainant has demonstrated that it owns registered trade mark rights for International trade mark registration number 1466448 for PASSBOLT and logo which was registered on October 1, 2020, and is designated in Australia. The dominant element of this trade mark is the word PASSBOLT which is also wholly incorporated into the disputed domain name. Beyond the “.com.au” Second-Level domain name root, the disputed domain name consists only of the PASSBOLT trade mark, therefore the Panel finds that the disputed domain name is identical to the Complainant’s registered trade mark and that paragraph 4(a)(i) of the Policy is satisfied.

B. Rights or Legitimate Interests

The Complainant has submitted that there is no evidence that the Respondent is affiliated with the
Complainant, in any way, or that the Respondent has he been authorised by it to use and register its trade
mark and “Passbolt” name or to seek registration of any domain name incorporating that mark or name.
Furthermore, says the Complainant, the Respondent has no rights or legitimate interests in the disputed
domain name. The Complainant has noted that its trade mark registration preceded the registration of the
disputed domain name by many years and that the Respondent does not own any trade mark or other rights
in the denomination “passbolt”. The Complainant has also asserted that the Respondent is not commonly
known by the disputed domain name and that the term “passbolt” does not occur in any way on the
Respondent’s home website at “ nor on any website for which the Respondent is known
and that there is no evidence that the Respondent is, or was ever associated, in the consumer’s mind with
the term “passbolt”. The Complainant has submitted that the Respondent cannot assert that, before any
notice of this dispute, it was using, or had made demonstrable preparation to use, the disputed domain name
or a name corresponding to it in connection with bona fide offering or goods or services.

The Complainant has also provided evidence that prior to filing of the Complaint the disputed domain name, resolved to a simulated login webpage which the Complainant says was most likely for the purpose of phishing or fraudulent misconduct in relation to the Complainant’s customers’ and prospects’ identification or account information. The Complainant has further submitted that the fact that the Respondent chose a domain name that is identical, or virtually identical, to the Complainant’s trade mark to direct Internet users for unclear purposes and with not a single link to the Respondent’s real identity, does not amount to a good faith use of the disputed domain name. The Complainant has asserted that the Respondent was most likely misleading or defrauding consumers into revealing sensitive information based upon a misconception that the website was connected to, or authorised by, the Complainant. Overall, the Complainant has submitted that this does not amount to use of the disputed domain name for any type of legitimate business or service and is inconsistent with the Respondent having rights or legitimate interests in the disputed domain name.

In its email of April 25, 2024, to the Center, the Respondent did not assert that it has any rights in the
PASSBOLT mark or name but rather confirmed that it installed the open-source software from the website
“ and deployed it on the website “ and registered the disputed
domain name for the purpose of setting up a free password management solution, in the Respondent’s

page 5

words, in order “…. to offer a basic option to our clients who might not have the budget for a premium
product”. This amounts to the Respondent affirming that it has sought to use the disputed domain name
incorporating the Complainant’s PASSBOLT mark, without the Complainant’s authority, for its own
commercial service aimed at a budget clientele. The Respondent has no rights, without the Complainant’s
authority, to use the Complainant’s PASSBOLT mark, whether in the disputed domain name or otherwise for
this purpose and this explanation does not support the Respondent having any rights or legitimate interests
in the disputed domain name.

The Panel finds that the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent’s explanation in its’ email as outlined above has not rebutted the Complainant’s prima facie case and has not provided any relevant evidence demonstrating rights or legitimate interests in the disputed domain name, such as those enumerated in the Policy or otherwise. Rather, the Respondent’s email explicitly reflects its intent to offer competing services through the identical disputed domain name, which by its nature reflects an inherent misleading association to the Complainant. Accordingly, the Panel finds that the Complaint succeeds under this element of the Policy.

C. Registered or Subsequently Used in Bad Faith

The disputed domain name was registered in October 2023, several years after the Complainant’s trade
mark registration. The Complainant’s mark is a coined term and is unusual and unlikely to have been
chosen by the Respondent co-incidentally. It is apparent both from the use of the Complainant’s PASSBOLT
logo mark on the website to which the disputed domain name formerly resolved and from the email of April
25, 2024 sent by the Respondent to the Center, that the Respondent used it knowingly on its website by way
of reference to the Complainant’s PASSBOLT password manager service. In these circumstances, the Panel
finds that the Respondent must have known about the Complainant’s PASSBOLT mark and password
manager service upon registration of the disputed domain name which fulfills the requirements for
registration in bad faith under paragraph 4(a)(iii) of the Policy.

Under paragraph 4(b)(iv) of the Policy there is evidence of registration and use of the disputed domain name in bad faith where a Respondent has used the disputed domain name to intentionally attempt to attract, for commercial gain, Internet users to its website by creating a likelihood of confusion with the Complainant’s trade marks as to the source, sponsorship, affiliation or endorsement of the website.

The Respondent has used the inherently misleading disputed domain name containing the PASSBOLT mark without the Complainant’s knowledge or authorisation and by its own admission in its email of April 25, 2024, to offer a discounted service to its own clients for its own commercial purposes. Internet users seeing the

disputed domain name are likely to have been confused into thinking that it was owned by, affiliated with, or which is likely to have reinforced their initial confusion. These circumstances fulfill the requirements of paragraph 4(b)(iv) of the Policy which is further evidence of registration or use in bad faith.

sponsored by the Complainant, when this is not the case, and they would have ended up at the
In circumstances of such a blatant use without permission of the PASSBOLT mark in the disputed domain
name, and it appears of the PASSBOLT registered logo on the website to which the disputed domain name
resolves, it seems hard to accept the Respondent’s view as expressed in its email that it registered the
disputed domain name with good intentions, or that it did not intend to trade off the reputation attaching to
the Complainant’s PASSBOLT mark and logo. Just because the disputed domain name had not previously
been registered in Australia by the Complainant certainly did not mean that the Respondent was necessarily
entitled to register it as appears to be the suggestion in its email response. This is precisely the sort of
scenario and conduct that the Policy was intended to proscribe and accordingly the Panel finds that the
disputed domain name was registered or used in bad faith and that the requirements of paragraph 4(a) (iii) of
the Policy are fulfilled.

page 6

7. Decision

For all the foregoing reasons, in accordance with Paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <passbolt.com.au> be transferred to the Complainant.

/Alistair Payne/
Alistair Payne
Sole Panelist
Date: June 7, 2024