Saudi Tourism Authority v Abo Ali

WIPO Case No. D2024-0901

ARBITRATION
AND
MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

Saudi Tourism Authority v. Abo Ali

Case No. D2024-0901

1. The Parties

The Complainant is Saudi Tourism Authority, Saudi Arabia, represented by Kadasa Intellectual Property,

Saudi Arabia.

The Respondent is Abo Ali, Jordan.

2. The Domain Name and Registrar

The disputed domain name <sta2030.com> (the “Domain Name”) is registered with NameSilo, LLC (the

“Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on February 29, 2024. On February 29, 2024, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Domain Name. On February 29, 2024, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Domain Name which differed from the named Respondent (Protected under PrivacyGuardian.org) and contact information in the Complaint. The Center sent an email communication to the Complainant on March 5, 2024, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on March 7, 2024.

The Center verified that the Complaint together with the amended Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for

Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the
Complaint, and the proceedings commenced on March 8, 2024. In accordance with the Rules, paragraph 5,
the due date for Response was March 28, 2024. The Respondent did not submit any response.
Accordingly, the Center notified the Respondent’s default on April 2, 2024.

page 2

The Center appointed Ian Lowe as the sole panelist in this matter on April 24, 2024. The Panel finds that it
was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of

Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.

4. Factual Background

The Complainant is a Saudi government entity established in 2020 to support the growth of the tourism
sector in Saudi Arabia. It is the registered proprietor of Saudi Arabia trademark number 1442013536 SAUDI
TOURISM AUTHORITY and Device, in both the Arabic and English language, registered on December 14,
2020. The Complainant operates a website at “ Since it was established, the Complainant

has consistently referred to itself as “STA”, as have third parties.

The Panel notes from the Complainant’s website that on November 29, 2023, the General Assembly of the international exhibition Expo 2030.

The Domain Name was registered on December 16, 2023. It does not resolve to an active website, but it has been used to send fraudulent phishing emails in the Arabic language including one purporting to be sent by the Director of Human Resources and CEO of the Saudi Tourism Authority, seeking confirmation of acceptance of a job offer at the Saudi Tourism Authority, and inviting the recipient to click on a link to an “employment platform” in order to provide required details.

5. Parties’ Contentions

A. Complainant

The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the Domain Name.

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

6. Discussion and Findings

According to paragraph 4(a) of the Policy, for this Complaint to succeed in relation to the Domain Name the
Complainant must prove that:

(i)        the Domain Name is identical or confusingly similar to a trademark or service mark in which the Complainant has rights; and

(ii)       the Respondent has no rights or legitimate interests in respect of the Domain Name; and

(iii)      the Domain Name has been registered and is being used in bad faith.

A. Identical or Confusingly Similar

It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain name. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, (“WIPO Overview 3.0”), section 1.7.

page 3

The Complainant has rights in the trademark SAUDI TOURISM AUTHORITY, but also contends that it has become well known, and is regularly referred to, both by itself and third parties, as STA. It has also adduced evidence of a number of references to the Complainant as STA on social media. The Complainant uses the domain “STA” for its website address. The Panel also takes into account that, as discussed further below, the Respondent has used the Domain Name, which comprises the initialism STA and the numerals “2030”, for fraudulent emails that purport to have been sent by officers of the Complainant. Accordingly, it is clear to the Panel that the Respondent used “STA” in the Domain Name because it anticipated that emails comprising STA would be taken to be emails from the Complainant and that STA would be taken to refer to the Complainant. The fact that a respondent is shown to have been targeting the complainant’s mark may support the complainant’s assertion that its mark has achieved significance as a source identifier. WIPO Overview 3.0, section 1.3.

Accordingly, the Panel accepts that as a result of its use of STA over a number of years, the Complainant
has acquired sufficient goodwill and reputation in STA as to give rise to unregistered trademark rights in the
STA mark (the “Mark”) for purposes of the Policy.

Ignoring the generic Top-Level Domain (“gTLD”) “.com”, the Domain Name comprises STA together with the numerals “2030”. In the Panel’s view, this addition does not prevent a finding of confusing similarity between the Domain Name and the Complainant’s mark. Accordingly, the Panel finds that the Domain Name is

confusingly similar to a mark in which the Complainant has rights.

The Panel finds the first element of the Policy has been established.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name.

Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. Accordingly, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.0, section 2.1.

The Panel considers that the Complainant has made out a strong prima facie case that the Respondent
could have no rights or legitimate interests in respect of the Domain Name. The use of the Domain Name for
an email address intended to deceive recipients into believing that emails were sent from a legitimate
account of the Complainant could not possibly demonstrate rights or legitimate interests. The Respondent
has chosen not to respond to the Complaint and has accordingly failed to counter the prima facie case
established by the Complainant. In the circumstances, the Panel finds that the Respondent does not have

any rights or legitimate interests in respect of the Domain Name.

The Panel finds the second element of the Policy has been established.

C. Registered and Used in Bad Faith

Given the nature of the Domain Name and its use for fraudulent emails purporting to originate with an
employee of the Complainant, the Panel considers it inconceivable that the Respondent did not have the
Complainant and its rights in the Mark in mind when it registered the Domain Name. The Panel notes that
the Domain Name was registered shortly after the announcement that the Saudi city Riyadh was to host
Expo 2030, which the Panel takes to explain the composition of the Domain Name. In the Panel’s view, the

page 4

fraudulent email has all the hallmarks of what is known as a Business Email Compromise scam, and it is very likely that the Respondent has sent such emails with a view to phishing for personal and/or financial information or for other illegitimate activities.

Panels have held that the use of a domain name for illegal activity such as phishing, distributing malware, unauthorized account access/hacking or impersonation/passing off constitutes bad faith. WIPO Overview 3.0, section 3.4.

Having reviewed the evidence, the Panel finds that the registration and subsequent use of the Domain Name to send fraudulent emails of the kind described above amounts to paradigm bad faith registration and use for the purposes of paragraph 4(a) of the Policy.

The Panel finds that the Complainant has established the third element of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Domain Name <sta2030.com> be transferred to the Complainant.

/Ian Lowe/
Ian Lowe
Sole Panelist
Date: May 6, 2024