Analysis of the UDRP decisions made following procedures started during the COVID-19 pandemic reminds us of the impossibility of predicting all cybersquatting cases. These decisions also reveal certain flaws in the management of domain name portfolios.
During the H1N1 flu pandemic in 2009, Hoffmann-La Roche faced a series of cybersquatting cases targeting the “Tamiflu” trademark:
Table 1
The “Tamiflu” trademark was fully included in these domain names. Every domain name is similar to the trademark, but none is identical. Registering all the domain names including the trademark would not be conceivable since the possibilities are infinite (typosquatting, the addition of geographic identifiers or generic words, etc.). At that time, what are commonly called “new gTLDs” did not exist. Consequently, the brand defense strategy against cybersquatting primarily involved 1) the registration of domain names identical to the trademark wherever possible (all gTLDs and ccTLDs whose conditions permitted such registration) and 2) domain name monitoring in order to identify similar or identical domain names. In this regard, it is very likely that it was during such monitoring that the abusive “Tamiflu” domain names mentioned in Table 1 were discovered.
In 2020, the situation is much more complex. It is crucial, at least for the pharmaceutical industry involved in the treatment of diseases spread on a pandemic scale, to register as much domain.ccTLD and domain.IccITLD (for “Internationalized ccTLD“) as possible. However, the strategy concerning the gTLDs, now so numerous, deserves a specific analysis. Indeed, it is probably unnecessary to conduct so-called “preventive” or “defensive” registrations for each gTLD. First, registering a .gTLD domain is not always possible, especially when the registry requires sectoral conditions. Second, it does not seem imperative to reserve domain names for the most expensive top-level domains (e.g., .INC and .WEB) because the financial risk would be too high for the majority of domainers and cybersquatters. On the other hand, many gTLDs can be registered at relatively affordable prices, which means that they are available to fraudsters. In this case, it is recommended to register the domain name identical to the trademark, at least for top-level domains that concern the sector of activity of the said trademark and, as far as possible, for other TLDs. In the health industry, TLDs have multiplied (Tsee able 2). Some companies and institutions in the health sector have also acquired their own brandTLDs, a strategy that will, in the long term, reduce the risks of confusion and cases of fraud (see Table 2).
Table 2
The UDRP procedures mentioned in Table 3 were initiated for the recovery of domain names registered during the first weeks of the COVID-19 pandemic, between January 2020 and April 2020.
Table 3
Let us focus our attention on the following four examples.
1. The domain name gilead.health was registered by a non-authorized third party on March 19, 2020, at a time when Gilead Sciences was in the media headlines (e.g., Bloomberg.com, 2020-03 -20; NYTimes.com, 2020-03-18). Given that the .HEALTH TLD designates the health industry, it would have been relevant, for Gilead, to register gilead.health as early as the beginning of the sunrise period in order to avoid any risk of cybersquatting, phishing or any other type of fraud. Indeed, the domain name is identical to the “Gilead” trademark and the .HEALTH TLD clearly makes patients or consumers think that any communication coming from such a domain name necessarily emanates from Gilead. Moreover, in the present case, the domain name referred to the Gilead’s institutional site, and such redirection often involves phishing activity (WIPO, D2020-0731, Gilead Sciences, Inc. v. WhoisGuard Protected, WhoisGuard, Inc. / Ling Ye, Shionogi Co. Ltd., May 19, 2020).
2. The plaquenil.club domain name was registered on March 22, 2020, while the “Plaquenil” brand was frequently cited in the media (e.g., france24.com, 2020-03-22; LeMonde.fr, 2020-03-21; NYPost.com, 2020-03-19). Unlike .HEALTH, .CLUB has, at first glance, nothing to do with the health sector. Therefore, the registration of plaquenil.club was not a priority for Sanofi, the “Plaquenil” trademark owner. However, in such a case, when the registration of the domain name is not required, it is nevertheless essential to set up a surveillance strategy for the trademark owner to be warned of as soon as possible. Consequently, the trademark owner, duly informed, may act accordingly to obtain the domain name transfer. In this case, there is no doubt that Sanofi relied on such a mechanism (WIPO, D2020-0797, Sanofi c. WhoisGuard, Inc. / James Plante, May 12, 2020 ). The same comment can be made for the domain name lexapro.space ( CAC, 103060, H. Lundbeck A / S v. Ivan Ivanov, 2020-06-15 ).
3. Bayer, the owner of a “RESOCHIN” trademark (chloroquine diphosphate), had never registered the domain names resochin.com and resochin.net. Hence, the latter were caught respectively on February 19, 2020 (WIPO, D2020-0910, Bayer Intellectual Property GmbH v. 刘金 力 (liujinli), June 1, 2020) and March 24, 2020 (WIPO, D2020-0913 , Bayer Intellectual Property GmbH v. Super Privacy Service LTD c / o Dynadot / Rose Irinco Mercado, June 15, 2020). The principle “1 trademark = 1+ domains” (ideally .COM) was not followed. An unexpected event, such as the current pandemic, provides an opportunity to conduct audits of domain name portfolios to ensure their completeness.
4. The French company Projetclub, holder of the intellectual property rights related to the famous “Easy Breath” mask, was also the victim of a wave of cybersquatting cases as soon as the medical profession, faced with a shortage of respirators, learned that this diving mask could be used, with some modifications, as respiratory assistance equipment. Again, the product received unexpected and massive media coverage and many domain names were abusively registered between January 20, 2020, and February 16, 2020 (easybreath.fun, easybreathmask.shop, easybreathmask.space, easybreath. shop, easybreath.space, mask-easybreath.shop and snork-easybreath.shop) (WIPO, D2020-0275, PROJETCLUB v. Мікловші Андрій Олександрович / Miklovshiy Andrey, May 1, 2020). In the present case, it would not have been reasonable, for Projetclub, to reserve all these domain names. However, one might think that easybreath.fun and easybreath.shop could have been pre-emptively registered.
As the agendas are turned upside down, events are easy prey for cybersquatters. Thus, on March 24, 2020, the International Olympic Committee announced the Tokyo Olympic Games’ postponement, at the latest, in the summer of 2021 (Olympic.org, 2020-03-24). Since such a postponement was already conceivable a few weeks before, the domain name tokyo2021.org was registered as early as February 3, 2020. It was put up for sale (WIPO, D2020-0808, International Olympic Committee and Tokyo Organizing Committee of the Olympic and Paralympic Games v. Contact Privacy Inc. Customer 1246395316 / Daniel O’Hare, June 12, 2020). Organizers of events postponed to 2021 are strongly advised to register the “2021” domain names as soon as possible.
In a period of crisis such as that provoked by the current pandemic, it seems prudent for the companies to be widely exposed to the media 1) to plan an audit of their domain names portfolio and 2) to establish an online brand protection strategy. In addition, with regard to monitoring strategies in progress, it seems beneficial to set them up so that the holder of the trademark rights is informed, as soon as possible, of the appearance of a new domain name likely to deceive consumers or patients.
Finally, the announcement of an effective treatment against COVID-19 will most likely be followed by a wave of cybersquatting that will strike both the name of the company and that of the brand chosen. The strategy of preventive registrations, before any public communication, will reduce the impact and the risk of fraud towards the consumers or the patients.
