Set up brand-protection monitoring across .us and related zones: what panels actually decide

A competitor registers your brand name as a .us domain, points it at a lookalike storefront, and your customers start filing chargebacks. Or a domain investor acquires a typosquat of your house mark across a half-dozen related ccTLDs and parks them on pay-per-click pages. By the time your legal team flags the registrations, the damage to goodwill is already accumulating. The question is not whether this will happen. The question is whether your monitoring program will catch it in time to act.

To set up brand-protection monitoring across .us and related zones, a brand owner must combine automated zone-file alerts across the usDRP-governed .us ccTLD and adjacent gTLDs with periodic RDDS/WHOIS sweeps, chain-of-title checks, and a pre-built escalation path that routes each alert to the right remedy – the usDRP, a UDRP filing at WIPO or the Forum, or court action under applicable anticybersquatting law. A well-structured program intercepts infringement before it compounds and preserves the evidence needed to win a dispute.

This analysis covers the governing rules in .us, the monitoring architecture, the evidence that decides outcomes, the transaction-due-diligence layer, and the cross-zone decision logic that tells you which forum to use when an alert fires.

What rules govern .us – and why does it matter for monitoring?

The .us ccTLD is administered under the Nexus Program, which requires registrants to have a bona fide US presence or connection. That requirement narrows the pool of legitimate registrants and, importantly, governs which dispute procedure applies. The usDRP – the .us Dispute Resolution Policy – closely tracks the UDRP's three-element test but applies exclusively to .us domains and sits outside the standard WIPO/Forum/CAC/ADNDRC pipeline.

The three elements a complainant must establish under the usDRP are functionally identical to Paragraph 4(a) of the UDRP: (1) the disputed domain is identical or confusingly similar to a mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered or is being used in bad faith. Note that some administrations of the usDRP read the third element with a disjunctive ("or") rather than the UDRP's strictly cumulative "registered AND used" standard – a distinction that can favor complainants where pre-notice bad-faith use is evident even if the original registration motive is unclear. In our practice, we treat this nuance as a fact-specific question that requires early analysis of the registration timeline relative to the complainant's rights.

Remedies under the usDRP mirror the UDRP: transfer or cancellation, with no monetary award. The procedure is administered through an approved dispute-resolution provider; verify the current approved provider and fee schedule with counsel, as these can change. Because the remedy is transfer (not suspension), the usDRP is generally more useful than a URS-style procedure for brand owners who want to actually hold the domain rather than simply disable it.

What does this mean for monitoring? A .us registration that would have been a clear UDRP candidate in .com requires a parallel but distinct tracking approach. You need zone-file access or a monitoring service that covers the .us zone file, and your alert-routing logic must recognize that a .us hit triggers a usDRP analysis rather than a WIPO complaint. Getting that routing wrong wastes weeks.

For an assessment of your brand's exposure across .us and adjacent zones, contact info@cognomenlaw.com.

How should you structure a monitoring program across .us and related zones?

An effective program has four layers: zone-file surveillance, RDDS/WHOIS analytics, marketplace and auction monitoring, and a pre-defined escalation protocol. Each layer captures a different class of threat, and all four are necessary because infringers have become adept at exploiting gaps between them.

Zone-file surveillance is the first and fastest layer. For .us, the registry publishes a zone file that a monitoring service or counsel can query to identify newly registered strings that match or approximate your marks. The latency between registration and detection should be measured in hours, not days. For adjacent gTLDs – .com, .net, .org, and the new gTLDs that overlap your brand's commercial space – a separate feed is required because each zone file is distributed independently. In our experience, brand owners who monitor only .com miss a significant fraction of infringing registrations that appear first in less-watched zones and then migrate to .com once the operator has tested the traffic.

RDDS/WHOIS analytics catches what zone-file surveillance misses: transfers of existing registrations, privacy-shield changes that reveal a new registrant, and registrations that use deliberate typos or character substitutions (often called typosquatting) that a simple exact-match alert will not surface. A well-calibrated fuzzy-match algorithm set to an edit-distance threshold of two to three characters, combined with phonetic equivalence checks, materially reduces the false-negative rate.

Marketplace and auction monitoring addresses the acquisition vector. A domain that has not yet been weaponized may already be listed for sale on a broker platform at a price that signals the registrant knows whose mark it approximates. Catching a listing before it closes gives you the option of a pre-acquisition challenge under the usDRP rather than a post-acquisition dispute against a new holder who may claim innocent purchase.

Escalation protocol is the layer most brand owners underinvest in. An alert that lands in a general inbox and then waits for a meeting is not a monitoring program – it is a paper trail. The protocol must specify: who receives the alert, what triage criteria separate a dispute from a coexistence situation, what internal approvals are needed to authorize a filing, and which outside counsel handles each zone and procedure. Document the protocol, test it annually, and revise it each time the zone mix changes.

What evidence decides a usDRP or UDRP outcome in .us-adjacent disputes?

Evidence governs everything. A monitoring program that fires an alert without simultaneously capturing the right evidence creates a compliance burden without a litigation asset. The evidence that panels consistently treat as dispositive falls into three categories: rights evidence, similarity evidence, and bad-faith evidence.

Rights evidence is the easiest to assemble in advance. US federal trademark registrations are the gold standard – a registered mark eliminates any argument that the complainant lacks rights in the name. Common-law rights require more work: the complainant must establish prior commercial use in the US that predates the disputed registration, which means preserving dated sales records, advertising materials, and third-party references. For a .us domain, the Nexus Program's requirement that registrants have a US connection also limits the registrant's ability to claim purely foreign rights – a point that occasionally surfaces in respondent briefs and that a monitoring program should account for by tracking the registrant's stated location in RDDS records.

Similarity evidence includes a screenshot capture of the registration data at the moment the alert fires, an archived copy of the website the domain resolves to (or a record that it is parked or passive), and a visual or textual comparison of the disputed domain string to the mark. Panels deciding usDRP and UDRP cases on .us-adjacent disputes have consistently held that the top-level domain suffix (.us) is generally disregarded in the similarity analysis – the comparison focuses on the second-level label. A domain that is phonetically identical to a registered mark, or that differs only by a common descriptive word or a transposition of letters, will typically satisfy the first element.

Bad-faith evidence is the most fact-intensive. Paragraph 4(b) of the UDRP – which the usDRP mirrors – lists non-exhaustive circumstances: offering to sell the domain to the rights holder at a price exceeding out-of-pocket costs; registering to disrupt a competitor; attracting users for commercial gain by creating a likelihood of confusion; and a pattern of abusive registrations. In our practice, the single most valuable piece of bad-faith evidence is a contemporaneous screenshot of the site at registration or shortly after – before the registrant can sanitize the content. Monitoring programs that archive the live site daily for the first 30 days after an alert fires produce far stronger records than programs that archive on demand.

The consensus view among panels is that passive holding – a domain that resolves to a blank or "coming soon" page – can still satisfy the bad-faith use requirement where the domain is identical to a well-known mark and the registrant offers no credible legitimate explanation. The contrary view, expressed in a minority of decisions, requires some affirmative bad-faith conduct beyond mere registration. A well-documented monitoring record that captures the full lifecycle of the domain's use (or non-use) protects the complainant under either standard.

In a recent matter (a .us typosquat of a US consumer brand, spring 2025), we assembled a monitoring record spanning 60 days of archived daily screenshots that showed the domain cycling through three different parking configurations – each one targeting the complainant's customers. The panel found bad faith under both the active-use and passive-holding lines of authority. No single screenshot would have been sufficient; the series told the story.

How does chain-of-title due diligence protect acquirers in .us transactions?

A monitoring program that surfaces a desirable domain for acquisition – whether a lapsed registration you want to register fresh, or a domain offered for sale by its current holder – must be paired with a due-diligence layer before any transfer of funds. This is where brand-protection monitoring and domain transactions intersect directly.

Chain-of-title due diligence for a .us domain has four components. First, review the full registration history, including prior holders and any changes in registrant identity. A domain that has changed hands multiple times in the last 24 months, especially if those changes correlate with dispute filings, is a warning sign. Second, run a search for prior usDRP or UDRP proceedings against the domain. A prior transfer order that was reversed, or a prior proceeding that ended in a finding against the current registrant, may affect your ability to hold the domain after acquisition – and may make you a respondent in a re-filed proceeding. Third, check the Nexus certification status. A .us registration held by a party that no longer satisfies the Nexus requirements is potentially vulnerable to a registry challenge entirely separate from the usDRP. Fourth, review any prior RDNH findings against a complainant who previously challenged the domain – because an RDNH finding signals that the challenge was itself abusive, which can support a respondent's legitimate-interest claim in any future proceeding.

Escrow structure matters as much as the due diligence findings. For any .us domain purchase above a nominal threshold, funds should be held in escrow pending registrar confirmation of the transfer – not released on the buyer's receipt of transfer auth codes, which can be reversed. The escrow provider should be a neutral third party with a published dispute resolution procedure for failed transfers. Do not rely on a bilateral wire transfer for a domain acquisition of any significance; the risk of a failed or reversed transfer with no recourse is real.

In a cross-zone matter (a .us and .com portfolio acquisition, autumn 2024), we identified in pre-close due diligence that one of the six domains being transferred had been the subject of a usDRP complaint that settled before a decision – with the settlement agreement placing a restriction on re-transfer for 18 months. The acquirer had not discovered that restriction through routine registry checks; it emerged only through a targeted review of the dispute provider's published case history. The acquisition closed on a modified structure that excluded the restricted domain pending expiration of the restriction period.

To weigh the due-diligence requirements for a .us domain acquisition, email info@cognomenlaw.com.

Which forum and procedure should you use when a .us alert fires?

The right route depends on the zone, the remedy you need, and the speed at which the infringement is causing harm. Getting this choice wrong – filing a UDRP complaint against a .us domain, or filing a usDRP proceeding against a .com – results in a jurisdictional dead end that the respondent's counsel will exploit immediately.

For a .us domain, the usDRP is the primary administrative route. It delivers a transfer or cancellation remedy, typically within a matter of weeks, at a forum filing fee that is set by the approved dispute provider (verify the current fee schedule with counsel). Legal fees are layered on top, in ranges broadly comparable to a single-domain UDRP matter. If the infringing conduct also supports a US anticybersquatting claim – and particularly if you want monetary damages or an injunction that the usDRP cannot provide – US court action is available in parallel or as an alternative; we handle that in coordination with local litigation counsel familiar with the applicable federal and state court procedures.

For a .com, .net, or .org domain surfaced by the same monitoring sweep, the UDRP applies. The choice of forum within the UDRP – WIPO, the Forum, CAC, or ADNDRC – affects the timeline, the panel pool, and the filing fee. WIPO charges USD 1,500 for a single-member panel on one to five domains and typically delivers a decision within roughly two months. The Forum's entry fee begins around USD 1,300 for a single-member panel. WIPO and the Forum together handle approximately 97% of all UDRP proceedings. For a monitoring program that may generate multiple simultaneous alerts across both .us and .com, coordinating filings across both procedures – with parallel timelines and coordinated evidence packages – is more efficient than treating each domain in isolation.

For new gTLDs (.shop, .online, .brand, and similar extensions) that appear in a monitoring sweep, the URS is an option where speed is the overriding priority and transfer is not required – URS suspends the domain for its registration term but does not transfer ownership. The UDRP remains available for new gTLDs where transfer is the goal.

For adjacent ccTLDs – a brand that is targeted simultaneously in .us, .ca (Canada), and .co (Colombia, which operates under UDRP) – the monitoring program must route each hit to the correct procedure. The .ca domain follows the CIRA CDRP, which has its own complainant eligibility requirements. The .co domain, having adopted the UDRP, routes to the standard UDRP providers. A monitoring program that flattens all ccTLD alerts into a generic "file a UDRP" workflow will miss these distinctions and produce filings that fail on procedural grounds before reaching the merits.

What are the consensus and minority views on passive holding in .us disputes?

Passive holding is the fact pattern that most often separates cases where monitoring pays off from cases where the brand owner files and loses. The consensus view – well-established in UDRP panels and applicable by analogy under the usDRP – is that registering a domain identical to a well-known mark and then doing nothing with it can itself constitute bad-faith use. The reasoning is that the registrant's passive conduct is commercially motivated: the mere holding of the domain forces the brand owner to either pay to acquire it or police it indefinitely.

The minority view, expressed in decisions that favor registrants, requires some affirmative misconduct: a pay-per-click page, an attempted sale, or a pattern of similar registrations. Under this line, a truly blank domain – one that has never resolved and has never been offered for sale – may not satisfy the bad-faith use requirement, even where the registration appears opportunistic.

Why does this matter for monitoring? Because the panel view your case lands under is unpredictable. A monitoring program that archives daily screenshots for the first 60 days after an alert fires will capture any transition from passive to active bad-faith use. If the domain goes from blank to pay-per-click, the archive proves it. If it stays blank throughout, you have documented the passive holding in full detail, which supports the consensus-view argument. Either way, the archive is the asset.

The RDNH risk runs in the other direction. A complainant who files against a domain that the registrant registered legitimately – pre-dating the complainant's trademark rights, or under a name the registrant is genuinely known by – runs the risk of an RDNH finding. That finding, while carrying no monetary penalty, is public and damages the complainant's credibility in future proceedings. A monitoring program that includes an RDNH risk screen – asking whether the registrant's use is plausibly legitimate before authorizing a filing – reduces that exposure significantly. In our practice, we apply that screen as a mandatory step before any filing recommendation, regardless of how strong the similarity evidence appears at first review.

How do portfolio-level monitoring strategies differ from single-mark programs?

A brand owner with a single mark in one class can maintain a workable monitoring program with relatively simple tools and a clear escalation path. A brand owner with dozens of marks across multiple classes, operating under parent and sub-brands, needs a fundamentally different architecture – one that the monitoring program itself must reflect.

Portfolio-level programs require a mark hierarchy: which marks are the most commercially sensitive, which are in active use versus reserved, and which are approaching expiration and therefore more vulnerable to a defensive registration by a third party. The monitoring alerts are then weighted accordingly. An alert on the primary house mark in .us receives immediate escalation; an alert on a dormant sub-brand registered only in a minor class may route to a quarterly review rather than an emergency filing.

The cross-zone dimension of a portfolio program is also more complex. A single monitoring event – say, the registration of a string that approximates your primary mark – may trigger alerts in .us, .com, .net, and three new gTLDs simultaneously, all by the same registrant. A UDRP complaint can cover multiple domains registered by the same holder, which allows a single filing to address the .com and new-gTLD hits in one proceeding. The .us domain requires a separate usDRP filing. Coordinating those two filings – identical evidence packages, synchronized timelines, a single factual narrative – is substantially more efficient than managing them as independent matters.

Portfolio monitoring also intersects with domain acquisition strategy. A brand owner who identifies a cluster of infringing registrations in .us and adjacent zones has three options: file disputes, attempt private acquisition, or both. The decision depends on the registrant's conduct (active infringement versus passive holding), the strength of the bad-faith evidence, and the commercial value of owning the domain rather than simply having it cancelled. A monitoring program that produces both a dispute record and an acquisition record gives the brand owner maximum strategic flexibility at the moment of decision.

See our related guidance on domain transactions, due diligence, and portfolio management for the acquisition and escrow mechanics that complement a monitoring program.

What should brand owners do when the registrant ignores the usDRP proceeding?

Default – the registrant's failure to file a response – is common in both UDRP and usDRP proceedings, particularly where the infringing domain is one of many the registrant holds and the cost of defending exceeds the commercial value of the domain. Default does not mean automatic transfer. The panel still applies the three-element test and must be satisfied on the evidence the complainant submits.

A complainant who files a thin complaint and assumes default will carry the case is frequently surprised. Panels in default proceedings have denied transfer where the complaint failed to adequately establish bad faith or where the domain string was not sufficiently similar to the mark. In our experience, a default proceeding requires the same quality of evidence preparation as a contested one – the difference is that no rebuttal will arrive, so the complaint must be self-sufficient.

What the absence of a response does allow is a panel inference. Where the complainant's factual allegations are uncontested, a panel may draw reasonable inferences in the complainant's favor. A well-drafted complaint in a default proceeding frames the key inferences explicitly – identifying what a legitimate registrant would have said in response and noting that no such explanation has been offered. That framing converts the registrant's silence into an evidentiary asset.

After a transfer order in a usDRP default, the registrar implements the transfer absent a court order staying the decision. Brand owners should be aware that a respondent can file a court action in the relevant jurisdiction within a short window after the decision to challenge the transfer; this is an unusual step, but it is a recognized right under the Policy. A monitoring program that includes a post-transfer watch for such challenges – and a document-preservation protocol that maintains the full evidentiary record – is the appropriate backstop.

Related at COGNOMEN

• Domain transactions, due diligence, and brand-protection portfolio services
• Case study: global domain due diligence and chain-of-title review
• FAQ: defending a generic domain registration in ccTLD proceedings

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.