WhatsApp, LLC v Waqar Malghani, Pariwiki

WIPO Case No. D2025-3419

ARBITRATION

AND

MEDIATION CENTER

ADMINISTRATIVE PANEL DECISION

WhatsApp, LLC v. Waqar Malghani, Pariwiki

Case No. D2025-3419

1. The Parties

The Complainant is WhatsApp, LLC, United States of America (“United States”), represented by Greenberg

Traurig, LLP, United States.

The Respondent is Waqar Malghani, Pariwiki, Pakistan.

2. The Domain Name and Registrar

The disputed domain name <gbwhatsapp.cyou> is registered with Dynadot Inc (the “Registrar”).

3. Procedural History

The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on August 25, 2025. connection with the disputed domain name. On August 27, 2025, the Registrar transmitted by email to the Center its verification response, disclosing registrant and contact information for the disputed domain name which differed from the named Respondent (REDACTED FOR PRIVACY, Super Privacy Service LTD c/o Dynadot) and contact information in the Complaint. The Center sent an email communication to the Complainant on August 29, 2025, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on September 2, 2025.

The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal
requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for
Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for
Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).

In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on September 4, 2025. In accordance with the Rules, paragraph 5, the due date for Response was September 24, 2025. The Respondent did not submit any

response. Accordingly, the Center notified the Respondent’s default on September 25, 2025.

page 2

The Center appointed Zeynep Yasaman as the sole panelist in this matter on October 5, 2025. The Panel
finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and
Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the

Rules, paragraph 7.

4. Factual Background

The Complainant is a global leader in messaging services for mobile devices, with over two billion users across more than 180 countries. Its WhatsApp application, available in sixty different languages, enables users to send text messages and voice messages, make voice and video calls, and share images, documents, user locations, and other content. In recent years, the WhatsApp mobile application has been ranked among the top apps in the market.

The Complainant is the owner of registered trademarks in various jurisdictions, such as:

- United States trademark WHATSAPP, registration no. 3939463, registered on April 5, 2011, in class 42; - United States figurative trademark registration no. 4359872, registered on July 2, 2013, in classes 9 and 38;

- European Union trademark registration WHATSAPP no. 009986514, registered on October 25, 2011, in
classes 9, 38, and 42;
- European Union figurative trademark registration no. 010496602, registered on May 18, 2012, in classes 9,
38, and 42;
- International Trademark Registration WHATSAPP no. 1396913, registered on December 21, 2017, in
classes 9, 35, 38, 42, and 45;
- International figurative trademark Registration no. 1109890, registered on January 10, 2012, in classes 9
and 38; and
- Indian trademark registration WHATSAPP no. 3111463, registered on November 30, 2015, in classes 9,

35, 36, 38, 42, and 45.

The Complainant’s official domain name is <whatsapp.com>, registered on September 4, 2008. In addition,
the Complainant owns several other domain names incorporating its trademark, including <whatsapp.net>
(registered on February 20, 2009), <whatsapp.org> (registered on February 1, 2010), <whatsapp.us>
(registered on February 1, 2010), <whatsapp.cl> (registered on October 30, 2013), <whatsapp.co.za>
(registered on April 30, 2010), <whatsapp.es> (registered on February 1, 2010), <whatsapp.com.tr>

(registered on August 6, 2013), and <whatsapp.in> (registered on February 1, 2010).

The Complainant enjoys a significant online presence, with 44 million followers and 36 million likes on subscribers on YouTube.

The disputed domain name was registered on January 1, 2025, and resolves to a website where Internet users can upload “GB WhatsApp APK”. The Panel notes that the Complainant’s WHATSAPP trademark and its logo in a slightly different green tone have been used on the website, and “GB WhatsApp APK” is presented as the modified version of the official WhatsApp application, which belongs to the Complainant. The main page of the website includes, inter alia, the following statement: “GB Whatsapp Apk is the

modified version of this official WhatsApp. In social media, people want to be in contact with their loved
ones. This latest alternative experience has several enhanced attributes. Advanced features include
enhancing WhatsApp characteristics, customizing, hiding status, and other boosted functions. Users don’t
have to pay subscription charges and enjoy more robust privacy. GB Whatsapp application comprises an
auto-reply function that enables users to set auto-replying. It has DND mode, allowing the user to turn off
the notifications, and no one can even know you are online”. It indicates AlexMods as the App developer.

page 3

5. Parties’ Contentions

A. Complainant

The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain name.

Notably, the Complainant contends that it holds numerous registrations for the WHATSAPP trademarks and the disputed domain name wholly incorporates the Complainant’s well-known WHATSAPP trademark. According to the Complainant, the addition of the letters “gb” is insufficient to dispel the confusing similarity with the Complainant’s trademark. The Complainant adds that the applicable generic Top-Level Domain (“gTLD”) “.cyou” may be disregarded for the purposes of assessment under the first element. In this regard, the Complainant argues that it has strong rights in the well-known WHATSAPP trademark and the disputed domain name is confusingly similar to this mark.

The Complainant contends that the Respondent has no rights or legitimate interests in the disputed domain name. In that regard, the Complainant argues that there is no evidence to suggest that the Respondent is commonly known by the disputed domain name, and that the Respondent's use of the disputed domain

name to promote an unauthorized modified version of the Complainant’s WhatsApp software does not
suggest in any reasonable way that the Respondent is commonly known by the disputed domain name. To
the knowledge of the Complainant, the Respondent has not acquired or applied for a trademark registration
for “GB WHATSAPP” or “GB WhatsApp APK”, or any variation thereof as reflected in the disputed domain
name. The Complainant adds that the Respondent is not a licensee of the Complainant, nor are they
affiliated with the Complainant in any way. The Complainant has not authorized the Respondent to make
any use of its WHATSAPP trademarks, in a domain name, in a mobile app, in the use of its logos on the
website, or otherwise.

The Complainant asserts that the Respondent is a user of the Complainant’s platforms, as well as a mobile application developer for software integrated with the Complainant’s WhatsApp platform and is therefore explicitly prohibited from using any of the Complainant’s trademarks. The Complainant argues that the Respondent has composed the disputed domain name with the Complainant’s identical and well-known WHATSAPP trademark together with the letters “gb”, which is clearly intended to target the Complainant’s platforms, services, and customers. Thus, the composition of the disputed domain name, coupled with the Respondent’s website content specifically targeting the Complainant, entails a high risk of implied affiliation with the Complainant. The Complainant indicates that the Respondent’s website content specifically targets the Complainant by offering an unauthorized modified version of the Complainant’s WhatsApp software, whilst making prominent use of the Complainant’s trademarks. Furthermore, the website content and favicon display a logo that is confusingly similar to the Complainant’s WhatsApp design mark, replicating the Complainant’s official green color, and even using the same white elements from the original design mark to achieve a similar website look and feel. According to the Complainant, all these elements are likely to confuse users into believing that the disputed domain name and the Respondent’s “GB WhatsApp APK” are operated, approved, sponsored by, or affiliated with the Complainant, which cannot constitute legitimate or noncommercial fair use under the Policy. The Complainant adds that it is impossible for the Respondent to provide any bona fide services as understood within the test set out in Oki Data, while the Respondent uses the Complainant’s famous trademarks in violation of the prohibitions expressly set out in the Complainant’s Terms of Use. Moreover, the Complainant argues that, assuming arguendo that the Oki Data test could apply, the Respondent is not providing bona fide services as understood within the Oki Data test since it is not providing legitimate sales or repairs in relation to a product provided by the Complainant, and it does not disclose their lack of relationship with the Complainant. The Complainant adds that the Respondent expressly encourages and actively induces third-party users of the Complainant’s services to violate the Complainants’ Terms of Use via the scraping of user content or data from the Complainant’s platform.

With regard to bad faith use and registration of the disputed domain name, the Complainant asserts that it is inconceivable for the Respondent to argue that they were not aware of the Complainant's WHATSAPP trademark when they registered the disputed domain name, as the Complainant’s trademark is well known

page 4

WhatsApp, LLC v. Waqar Malghani, Pariwiki, WIPO Case No. D2024-4515, in which the Respondent was found to have registered and used domain names incorporating the Complainant’s trademarks in bad faith, thereby demonstrating that the Respondent has repeatedly targeted the Complainant in bad faith.

throughout the world. Moreover, the disputed domain name and the Respondent’s website content are so Contact Request Form provided by the Registrar, and the Respondent's use of a proxy service or selection of a registrar with default proxy services are indicators of the Respondent’s bad faith. Finally, the Complainant submits that the Respondent has engaged in a pattern of bad faith registration and use, as evidenced by a previous UDRP case see
obviously connected with the Complainant and its WHATSAPP trademarks and services that such use
suggests opportunistic bad faith. The Complainant adds that in choosing a domain name that so closely
resembles the Complainant’s WHATSAPP trademark to promote an unauthorized derivative competing
service, the Respondent is taking advantage of the Complainant’s mark for commercial gain, which supports
a finding of bad faith. Furthermore, given the composition of the disputed domain name and the nature of
the Respondent’s website, Internet users are likely to believe that the Respondent’s website, along with the
modified unauthorized “GB WhatsApp APK” application promoted therein, is affiliated with or somehow
endorsed by the Complainant. The Complainant indicates that the website associated with the disputed
domain name contains no disclaimer and instead contains language that could mislead users. In addition,
according to the Complainant, the Respondent’s modified application promoted via the disputed domain
name may be used to spread malware, to enable spam, to harvest personal data from the Complainant’s
platform, to steal users' account credentials, or for other illegal activities. In this regard the Complainant
indicates that the disputed domain name has been flagged by at least one independent cybersecurity vendor

as being malicious in connection with malware. The Complainant further claims that the fact that the

B. Respondent

The Respondent did not reply to the Complainant’s contentions.

6. Discussion and Findings

A. Identical or Confusingly Similar

Paragraph 4(a)(i) of the Policy requires the complainant to show that the disputed domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights.

Where the complainant holds a nationally or regionally registered trademark or service mark, this prima facie satisfies the threshold requirement of having trademark rights for purposes of standing to file a UDRP case. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, (“WIPO Overview 3.0”), section 1.2.1. In the present case, the Panel notes that the Complainant owns registered WHATSAPP

trademarks. Accordingly, the Complainant has shown rights in respect of a trademark or service mark for
the purposes of the Policy.

It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain name. WIPO Overview 3.0, section 1.7.

The Panel notes that the entirety of the Complainant’s WHATSAPP trademark is reproduced within the disputed domain name. Accordingly, the disputed domain name is confusingly similar to the mark for the purposes of the Policy. WIPO Overview 3.0, section 1.7.

It is well established by panels applying the Policy that where the relevant trademark is recognizable within the disputed domain name, the addition of other terms (whether descriptive, geographical, pejorative, meaningless, or otherwise) would not prevent a finding of confusing similarity under the first element. Similarly, the applicable gTLD in a domain name (e.g., “.com”) is viewed as a standard registration

page 5

H & M Hennes & addition of ”gb” at the beginning of the Second-Level portion of the disputed domain name and the gTLD “.cyou” does not prevent a finding of confusing similarity between the disputed domain name and the mark for the purposes of the Policy. WIPO Overview 3.0, section 1.8.

requirement and as such, is disregarded under the first element confusing similarity test (

The Panel finds the first element of the Policy has been established.

B. Rights or Legitimate Interests

Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name. These are as follows:

(i) before any notice of the dispute, the respondent’s use of, or demonstrable preparations to use, the
domain name or a name corresponding to the domain name in connection with a bona fide offering of goods
or services; or
(ii) the respondent (as an individual, business, or other organization) has been commonly known by the
domain name, even if the respondent has acquired no trademark or service mark rights; or
(iii) the respondent is making a legitimate noncommercial or fair use of the domain name, without intent for
commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue.

Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.0, section 2.1.

Having reviewed the available record, the Panel finds that the Complainant has established a prima facie
case that the Respondent lacks rights or legitimate interests in the disputed domain name. The Respondent
has not rebutted the Complainant’s prima facie showing and has not come forward with any relevant
evidence demonstrating rights or legitimate interests in the disputed domain name such as those
enumerated in the Policy or otherwise.

The Panel notes that there is no evidence suggesting that the Respondent has been commonly known by the disputed domain name within the meaning of the Policy. Furthermore, the Complainant has clearly established that the Respondent is neither affiliated with the Complainant nor authorized or licensed to use the WHATSAPP trademark or register the disputed domain name.

In cases where a domain name consists of a trademark plus an additional term (at the second- or top-level),
UDRP panels have largely held that such a composition cannot constitute fair use if it effectively
impersonates or suggests sponsorship or endorsement by the trademark owner (WIPO Overview 3.0 section
2.5.1). The Panel notes that the nature of the disputed domain name, together with the content of the
associated website, where an allegedly modified version of the Complainant’s application, which does not
belong to the Complainant, has been offered for download, cannot be considered as a bona fide offering of
goods or services, nor a legitimate noncommercial or fair use. Such use carries a risk of implied affiliation
or association with the Complainant.

Where a respondent is re-selling a complainant’s products or providing services relating to them, then the applicable criteria for determining whether a respondent can assert a right or legitimate interest in a domain name that incorporates the complainant’s trademark are set out in Oki Data Americas, Inc. v. ASD, Inc., WIPO Case No. D2001-0903. Outlined in the “Oki Data test”, the following cumulative requirements will be

page 6

applied in the specific conditions of a UDRP case: (i) the respondent must actually be offering the goods or the software in question does not belong to the Complainant but is instead allegedly a modified version of it developed by third parties. In other words, the Respondent does not offer for download the official product of the Complainant. In this regard, in the Panel’s view, such use does not fall within the Oki Data criteria.
services at issue; (ii) the respondent must use the site to sell only the trademarked goods or services;
(iii) the site must accurately and prominently disclose the registrant’s relationship with the trademark holder;
and (iv) the respondent must not try to “corner the market” in domain names that reflect the trademark.

Panels have held that the use of a domain name for illegitimate activity such as phishing, distributing malware, impersonation/passing off can never confer rights or legitimate interests on a respondent. WIPO Overview 3.0, section 2.13.1. In this regard, the Panel notes that the disputed domain name has been rated by a cybersecurity and threat intelligence platform as having a risk score of 100, indicating an extremely high likelihood of malicious activity. The analysis shows strong indicators of phishing (72), malware (37), and spam (46), with a proximity score of 100, meaning it closely resembles other known malicious domain names. This domain name is therefore considered unsafe.

The Panel finds the second element of the Policy has been established.

C. Registered and Used in Bad Faith

The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith:

(i) circumstances indicating that the respondent has registered or has acquired the domain name primarily
for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant
who is the owner of the trademark or service mark or to a competitor of that complainant, for valuable
consideration in excess of its documented out of pocket costs directly related to the domain name; or

(ii) that the respondent has registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that the respondent has engaged in a pattern of such conduct; or

(iii) that the respondent has registered the domain name primarily for the purpose of disrupting the business

of a competitor; or

(iv) that by using the domain name, the respondent has intentionally attempted to attract, for commercial
gain, Internet users to the respondent’s website or other on-line location, by creating a likelihood of confusion
with the complainant’s mark as to the source, sponsorship, affiliation, or endorsement of the respondent’s
website or location or of a product or service on the respondent’s website or location.

The Panel notes that the Complainant’s trademark WHATSAPP enjoys a worldwide reputation. It has been established in previous UDRP decisions that the registration of a domain name incorporating a widely- recognized or well-known trademark by a third party who has no connection with the trademark can by itself suggest opportunistic bad faith (see Pepsico, Inc. v. Domain Admin, WIPO Case No. D2006-0435; Veuve Clicquot Ponsardin, Maison Fondée en 1772 v. The Polygenix Group Co., WIPO Case No. D2000-0163). Having taken into consideration the composition of the disputed domain name, the content of the associated website, which contains numerous references to the Complainant’s trademark and services, the Respondent’s failure to come forward with any explanation for the registration of the disputed domain name and the use of a privacy service to conceal its identity, the Panel considers that the Respondent was aware of the Complainant’s well-known trademark and services offered under it. Moreover, the Panel notes that the fact that the Respondent had been involved in a previous UDRP case (WhatsApp, LLC v. Waqar Malghani, Pariwiki , WIPO Case No. D2024-4515) concerning a domain name <gbwhatsapp.click> incorporating the Complainant’s trademark, demonstrates the Respondent’s awareness of the Complainant’s

page 7

trademark and its intention to exploit it. In that regard, the Panel finds that the Respondent deliberately
targeted the Complainant and the registration of a domain name incorporating the Complainant’s well-known
mark, while being aware of such mark and lacking any rights or legitimate interests, constitutes registration in
bad faith.

Furthermore, the Panel considers that by using the Complainant’s trademark and an almost identical figurative logo to offer an unauthorized version of the Complainant’s product, the Respondent has registered and used the disputed domain name to attract, for commercial gain, Internet users to the Respondent’s website, by creating a likelihood of confusion with the Complainant’s mark as to the source, sponsorship, affiliation, or endorsement of the Respondent’s website.

Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith, but other circumstances may be relevant in assessing whether a respondent’s registration and use of a domain name is in bad faith. WIPO Overview 3.0, section 3.2.1.

As noted above, the website under the disputed domain name has been identified by a cybersecurity and threat intelligence platform as having a risk score of 100, indicating an extremely high likelihood of malicious activity.

Having reviewed the record, the Panel finds the Respondent’s registration and use of the disputed domain name constitutes bad faith under the Policy.

The Panel finds that the Complainant has established the third element of the Policy.

7. Decision

For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name <gbwhatsapp.cyou> be transferred to the Complainant.

/Zeynep Yasaman/
Zeynep Yasaman
Sole Panelist
Date: October 17, 2025