Novartis AG secured the transfer of leqvio.info and leqvio.site after the Respondent used them to impersonate the brand and collect sensitive medical information via fake patient registration forms. The WIPO panel ordered the transfer, finding that the domains were registered and used in bad faith.
Case Snapshot
| Case Number | D2026-2322 |
|---|---|
| Complainant | Novartis AG |
| Respondent | Scott Kennedy, Replit |
| Disputed Domain | leqvio.infoleqvio.site |
| Threat Tactic | Phishing and Email Fraud |
| Decision Date | 2026-07-21 |
| Panelist | Ada L. Redondo Aguilera |
| Outcome | Transfer |
| Official Source | https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2026-2322 |
Business and Security Risks of Targeted Patient Data Harvesting
The registration of ‘leqvio.info’ and ‘leqvio.site’ presents a critical threat to both brand integrity and consumer safety by facilitating the unauthorized collection of sensitive medical information. By mirroring the LEQVIO brand and deploying online patient registration forms, the Respondent engaged in a sophisticated form of impersonation designed to exploit patient trust. This tactic not only compromises the privacy of individuals seeking medical treatment but also exposes the brand owner to significant regulatory and legal liability. The use of these lookalike domains to solicit personal data creates a direct vector for phishing-based fraud, which can severely damage the reputation of a pharmaceutical entity that relies on patient confidentiality.
Furthermore, the procedural discovery that the Registrar’s verified registrant information differed from the details initially presented in the Complaint highlights the operational difficulties in identifying and mitigating digital threats. The use of deceptive contact information allows bad actors to maintain anonymity while conducting illicit activities, complicating enforcement efforts. For Novartis AG, the persistence of these fraudulent sites creates a long-term risk of brand dilution and loss of consumer trust, as patients may unknowingly submit private health data to third-party bad actors under the guise of legitimate clinical registration. The Panel’s finding of bad faith reinforces the principle that such illegitimate use of a trademarked domain—specifically for fraudulent data collection—constitutes a severe abuse of the domain name system.
Panel Findings on Trademark Infringement and Bad Faith Patient Data Harvesting
To succeed under the UDRP, the Complainant successfully satisfied the three-pronged criteria of the Policy. First, the Panel concluded that the disputed domain names, leqvio.info and leqvio.site, are confusingly similar to the Complainant’s LEQVIO trademark. By incorporating the mark in its entirety and only appending generic Top-Level Domains, the Respondent created a clear risk of consumer confusion. The Complainant substantiated its rights through established registrations dating back to 2014, leaving no doubt regarding the existence and priority of the underlying IP.
Regarding the second and third elements, the Panel determined that the Respondent lacks any rights or legitimate interests in the disputed domains. The evidence confirmed that the websites were actively used to display the LEQVIO mark and host fraudulent patient registration forms soliciting sensitive medical and personal data. Such activity, which the Panel characterized as clear instances of passing off and fraud, explicitly precludes any claim to legitimate use. Consequently, the Panel ruled that these actions constitute bad faith registration and use, as the Respondent sought to exploit the brand’s reputation to facilitate illicit data harvesting.
The Respondent’s failure to file a response, coupled with registrar verification revealing discrepancies between the initial complaint data and the actual registrant identity, further undermined any potential defense. This case underscores a critical business risk for brand owners in the pharmaceutical sector: the deployment of lookalike domains for the active exfiltration of patient information. By leveraging UDRP proceedings, Novartis AG effectively neutralized a sophisticated impersonation tactic that threatened both consumer trust and the integrity of the company’s digital patient outreach operations.
Strategic Enforcement Against Medical Data Harvesting
Novartis AG’s successful recovery of the leqvio.info and leqvio.site domains relied on a clear evidentiary focus on the harm caused by the Respondent’s use of deceptive patient-facing portals. By documenting that these domains hosted forms soliciting sensitive personal and medical data under the guise of an official pharmaceutical registration process, the Complainant established a high-impact narrative of consumer risk. This framing allowed the panel to move beyond simple trademark infringement and recognize the malicious intent inherent in the Respondent’s activities, which directly threatened patient confidentiality and brand integrity within the global healthcare sector.
The legal strategy was further bolstered by the Complainant’s rigorous procedural adherence, specifically in highlighting the discrepancy between the initial registrant details and the subsequent verification provided by the Registrar. The Respondent’s failure to respond to the Complaint further streamlined the panel’s decision-making, allowing for a swift finding that no legitimate commercial or fair use could be established for a domain infrastructure clearly designed for fraudulent data collection. By anchoring the case in the direct contradiction between the brand’s established trademark rights and the Respondent’s unauthorized impersonation of its patient services, Novartis ensured the prompt transfer of the contested assets, mitigating potential regulatory exposure and safeguarding its consumer trust.
Practical Recommendations
- Implement proactive domain monitoring for exact match and ‘brand + keyword’ variations to enable early detection of lookalike sites before they reach significant traffic volume.
- Utilize automated WHOIS verification during the UDRP pre-filing stage to identify discrepancies between registrar data and site content, which helps in naming the correct Respondent.
- Maintain an updated digital forensic repository of screenshots and saved web pages from suspicious domains to provide verifiable evidence of phishing intent, such as illicit data collection forms.
- Establish a coordinated cross-functional response protocol between legal and IT security teams to trigger immediate registrar take-downs for high-risk domains harvesting patient medical information.
- Leverage the precedent of ‘illegitimate activity’ in UDRP cases like this to request expedited proceedings when domains are explicitly linked to credential harvesting or medical data exfiltration.
Frequently Asked Questions (FAQ)
Why were the domain names ‘leqvio.info’ and ‘leqvio.site’ considered confusingly similar to Novartis AG’s trademark?
The WIPO panel found that the disputed domain names incorporated the LEQVIO trademark in its entirety. The inclusion of the mark within the domains, differing only by the generic Top-Level Domains (.info and .site), made them identical or confusingly similar to Novartis’s established trademark.
How did the Complainant demonstrate that the Respondent lacked legitimate rights or interests?
The panel ruled that the Respondent had no rights or legitimate interests because the domains were used for illegitimate, fraudulent activity—specifically, hosting copycat sites to harvest patient medical data. Such deceptive use of a trademarked brand cannot establish a legitimate interest under UDRP policy.
What evidence proved the Respondent acted in bad faith?
Bad faith was established by the use of the domains to impersonate the brand. The sites displayed the LEQVIO trademark and featured fake patient registration forms designed to solicit sensitive personal and medical information, which the panel identified as a clear attempt to engage in phishing and fraud.
What was the tactical outcome of this UDRP proceeding?
Following the Respondent’s failure to file a response, the panel ordered the immediate transfer of the disputed domain names to Novartis AG, successfully mitigating the immediate threat of further unauthorized data harvesting and protecting the brand from ongoing impersonation.
Are fraudulent sites harvesting your patient data?
The Novartis v. LEQVIO case highlights how attackers use domain spoofing to capture sensitive medical information. Our team helps identify and mitigate risks from phishing and impersonation sites before they compromise your brand’s integrity.
This case note is for informational purposes only and is not legal advice.
