Aflasecurityincident.com, Alfacsecurityincident.com

The timeline behind aflasecurityincident.com

Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.

How each disputed name was decided in this proceeding.

Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.

ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Aflac Inc. v. Domain Administrator, Fundacion Privacy Services LTD Case No. D2026-2127 1. The Parties The Complainant is Aflac Inc., United States of America (“United States”), represented by Hogan Lovells (Paris) LLP, France. The Respondent is Domain Administrator, Fundacion Privacy Services LTD, Panama. 2. The Domain Names and Registrar The disputed domain names <aflasecurityincident.com> and <alfacsecurityincident.com> are registered with Media Elite Holdings Limited (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on May 16, 2026. On May 18, 2026, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain names. On the same date, the Registrar transmitted by email to the Center its verification response, confirming that the Respondent is listed as the registrant and providing the contact details. The Center verified that the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on May 20, 2026. In accordance with the Rules, paragraph 5, the due date for Response was June 9, 2026. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on June 10, 2026. The Center appointed Anita Gerewal as the sole panelist in this matter on June 15, 2026. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. page 2 4. Factual Background Founded in 1955 in Columbus, Georgia, United States, as “American Family Life”, the Complainant evolved into one of the leading providers of supplemental insurance, adopting the name “Aflac” in 1989. The Complainant expanded across the United States by 1970 and entered the Japanese market by 1974, the same year it was listed on the New York Stock Exchange under the ticker symbol “AFL”. The Complainant is now one of the leaders in supplemental health insurance in the United States and medical and cancer insurance in Japan. With over 50 million policyholders, more than 12,600 employees worldwide, and revenue exceeding USD 4 billion in the first quarter of 2026, the Complainant has established substantial goodwill and a strong global reputation in the insurance industry. The Complainant owns numerous trademark registrations for the word mark AFLAC, including the following: - United States Trademark Registration No. 1570222 in international class 36, registered on December 5, 1989; and - International Trademark Registration No. 934185 in international class 36, registered on July 24, 2007. 1 The Complainant is also the owner of numerous domain names incorporating its AFLAC trademark, including but not limited to <aflac.com>, <aflacgroupinsurance.com>, and <aflacgroup.com>. The Complainant registered the domain name <aflac.com> in 1995 and uses it to operate its main corporate website. Following a security incident in June 2025, the Complainant registered the domain name <aflacsecurityincident.com> on June 20, 2025 to provide updates to its customers. The said domain name redirected policyholders to the CyEx Medical Shield enrolment portal, where the Complainant offered 24 months of complimentary credit monitoring, identity theft protection, medical fraud protection, and customer support. The disputed domain names were both registered on June 25, 2025 and, prior to the filing of the Complaint, resolved to parked pages with pay-per-click (“PPC”) links that refer to, inter alia, “data security solutions”, “network security breach detecion [sic]”, and “cybersecurity risk assessment services”. 5. Parties’ Contentions A. Complainant The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain names. Notably, the Complainant contends that it has established rights in the AFLAC trademark through its registered trademark portfolio. It argues that the disputed domain names are confusingly similar to the AFLAC mark as they incorporate intentional misspellings of the trademark – one omitting the letter “c” and the other transposing the letters “l” and “f” – which constitute classic examples of typosquatting. The addition of the terms “security” and “incident” does not prevent a finding of confusing similarity, as the AFLAC mark remains clearly recognisable. Accordingly, the Complainant submits that the disputed domain names satisfy the first element of the UDRP as they are confusingly similar to its well-known AFLAC trademark. 1 The Panel notes that the trademarks are owned by American Family Life Assurance Company of Columbus, a company related to the Complainant. page 3 The Complainant submits that the Respondent has no rights or legitimate interests in the disputed domain names, as the Respondent is neither affiliated with nor authorised by the Complainant to use the AFLAC trademark. The disputed domain names resolve to parking pages displaying PPC advertisements relating to cybersecurity and data security, which the Complainant argues are intended to capitalise on the goodwill associated with its AFLAC mark and mislead Internet users seeking the Complainant’s official security incident website. The Complainant further contends that there is no evidence that the Respondent is commonly known by the disputed domain names or owns any trademark rights in AFLAC or any variation thereof. The Respondent’s misspelling of the Complainant's AFLAC trademark, the similarity between the disputed domain names and the Complainant's own domain name <aflacsecurityincident.com>, and the commercial use of the disputed domain names to generate PPC revenue all support the conclusion that the Respondent is not making a bona fide offering of goods or services or any legitimate noncommercial or fair use of the disputed domain names. The Complainant also contends that the Respondent registered and uses the disputed domain names in bad faith, given the long-standing reputation and global recognition of the AFLAC trademark, which has been in continuous use for over 35 years. It submits that the Respondent could not reasonably have been unaware of the Complainant’s rights, particularly as the disputed domain names were registered just five days after the Complainant registered <aflacsecurityincident.com> and closely mimic that domain name through intentional misspellings combined with the terms “security” and “incident”. The Complainant further argues that the Respondent’s use of a proxy registration service, coupled with the redirection of the disputed domain names to parking pages containing PPC advertisements related to cybersecurity, demonstrates an intention to mislead Internet users seeking the Complainant’s official security incident website and to profit from click-through revenue. Accordingly, the Complainant submits that the Respondent intentionally sought to create a likelihood of confusion with the AFLAC trademark for commercial gain, constituting registration and use in bad faith under the UDRP. B. Respondent The Respondent did not reply to the Complainant’s contentions. 6. Discussion and Findings A. Identical or Confusingly Similar It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain name. WIPO Overview of WIPO Panel Views on Select UDRP Questions (“WIPO Overview 3.1”), section 1.7. The Complainant has shown rights in respect of the AFLAC trademark for the purposes of the Policy. WIPO Overview 3.1, section 1.2.1. The Panel finds the mark is recognizable within the disputed domain names, notwithstanding the intentional misspellings of the trademark – one omitting the letter “c” and the other transposing the letters “l” and “f”. Accordingly, the disputed domain names are confusingly similar to the AFLAC trademark for the purposes of the Policy. WIPO Overview 3.1, sections 1.7 and 1.9. Although the addition of other terms, here, “security” and “incident”, may bear on assessment of the second and third elements, the Panel finds the addition of such terms does not prevent a finding of confusing similarity between the disputed domain names and the mark for the purposes of the Policy. WIPO Overview 3.1, section 1.8. The Panel finds the first element of the Policy has been established. page 4 B. Rights or Legitimate Interests Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name. Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving that a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element. WIPO Overview 3.1, section 2.1. Having reviewed the available record, the Panel finds the Complainant has established a prima facie case that the Respondent lacks rights or legitimate interests in the disputed domain names. The Respondent has not rebutted the Complainant’s prima facie showing and has not come forward with any relevant evidence demonstrating rights or legitimate interests in the disputed domain names such as those enumerated in the Policy or otherwise. The Respondent is not affiliated with or authorised by the Complainant to use the AFLAC trademark, nor is there any evidence that the Respondent is commonly known by the disputed domain names or holds any trademark rights in the term “AFLAC” or any variation thereof. The disputed domain names resolve to parked pages displaying PPC links relating to cybersecurity and data security. Noting the composition of the disputed domain names containing a misspelling of the Complainant’s AFLAC trademark and closely matching that of the Complainant’s official domain name <aflacsecurityincident.com>, and the timing of registration, the Panel considers the monetisation of traffic through PPC links indicative of an attempt to capitalise on the Complainant’s reputation and divert Internet users seemingly for commercial gain, rather than a bona fide offering of goods or services or a legitimate noncommercial or fair use. Accordingly, the Respondent lacks rights or legitimate interests in the disputed domain names under paragraph 4(a)(ii) of the Policy. The Panel finds the second element of the Policy has been established. C. Registered and Used in Bad Faith The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular, but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith. Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith, but other circumstances may be relevant in assessing whether a respondent’s registration and use of a domain name is in bad faith. WIPO Overview 3.1, section 3.2.1. The Panel finds that the disputed domain names were registered and are being used in bad faith. Given the Complainant’s long-standing and globally recognized AFLAC trademark, which has been in continuous use for over 35 years, the Panel considers it highly unlikely that the Respondent was unaware of the Complainant’s rights at the time of registration. This inference is reinforced by the fact that the disputed domain names were registered shortly after the Complainant registered the domain name <aflacsecurityincident.com> and closely mimic that domain name through intentional misspellings of the Complainant’s trademark combined with the terms “security” and “incident”. The use of the disputed domain names for parked pages containing PPC advertisements relating to cybersecurity indicates in the circumstances of this case an intent to exploit Internet user confusion for commercial gain. The Panel page 5 therefore concludes that the Respondent has intentionally attempted to attract Internet users to its websites by creating a likelihood of confusion with the Complainant’s mark as to source, sponsorship, or affiliation, for commercial benefit, and that paragraph 4(b)(iv) of the Policy is applicable. The Panel finds that the Complainant has established the third element of the Policy. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain names <aflasecurityincident.com> and <alfacsecurityincident.com> be transferred to the Complainant. /Anita Gerewal/ Anita Gerewal Sole Panelist Date: June 29, 2026

Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.