Step-by-step: set up brand-protection monitoring across .br and relat…

Step-by-step: set up brand-protection monitoring across .br and relat. UDRP and ccTLD domain recovery and defense across .br. Email the firm to assess your cas…

A counterfeit shop launches on a .br domain that mirrors your brand name almost exactly. Orders are being redirected. Your Brazilian distributor is fielding complaints from confused customers. By the time your legal team is alerted, the domain has been live for six months. This is the scenario that brand-protection monitoring is designed to prevent — or at least shorten dramatically.

To set up brand-protection monitoring across .br and related zones, you need to track new registrations, WHOIS/RDDS changes, and content signals across the Brazilian namespace — governed by Registro.br, the country-code registry operated by NIC.br — and across adjacent gTLD and regional zones where your brand is equally exposed. Brazil's .br dispute procedure (SACI-Adm) governs most enforcement actions in the zone; the UDRP does not apply to .br directly. A monitoring program that detects a bad-faith registration early enough to act on it — typically within days of the domain going live — is worth more than any single recovery filing.

This guide walks each step in sequence, names the trap hidden inside it, and ends with a realistic picture of costs, escalation paths, and the evidence that decides whether enforcement succeeds.

Step 1: Map the zones you actually need to monitor

Effective monitoring starts with a clear scope — and most brand owners draw it too narrowly. Brazil's namespace is not limited to second-level .br registrations. The zone tree includes functional second-level domains such as .com.br, .net.br, .org.br, .ind.br, .tur.br, .adv.br, and sector-specific strings, each operated under Registro.br's rules. A competitor or cybersquatter can operate under any of them.

The related-zone question does not stop at Brazil's borders. In our practice, we consistently see brand owners harmed by registrations in .com, .net, and new gTLDs (such as .shop, .store, .online) that target a Brazilian-market audience — using Portuguese-language content and Brazilian payment gateways — while sitting in a zone the brand owner never monitored. A .com cybersquat targeting Brazilian consumers is a UDRP matter; a .com.br one is a SACI-Adm matter. Both need to be in scope from day one.

Trap in this step: treating the zone map as fixed. Registry policies change, new gTLDs launch, and registrants shift zones deliberately when one becomes harder to exploit. Build a review cycle — at minimum quarterly — into the scope definition.

What governs .br disputes, and why does it matter for monitoring strategy?

Brazil's .br dispute procedure, SACI-Adm (Sistema de Resolução de Conflitos de Nomes de Domínio em Âmbito Administrativo), is a distinct national procedure administered through Registro.br. It is not the UDRP, and panels are not bound by UDRP jurisprudence. Understanding the governing rules shapes what evidence you collect and what monitoring signals you prioritize.

Under SACI-Adm, the complainant must show trademark rights in Brazil recognized under applicable Brazilian law, that the domain is identical or confusingly similar to that mark, and that the registrant lacks a legitimate interest or registered the domain in bad faith. The structure is broadly analogous to the UDRP, but the governing substantive rules are those of Brazilian trademark law — meaning registration with the INPI (Brazil's national IP office) carries significant weight. A brand with strong common-law recognition in Brazil but no INPI registration starts from a weaker evidentiary position than it would in a UDRP proceeding where unregistered trademark rights are more clearly recognized.

For gTLD domains (.com, .net, and new gTLDs), the UDRP applies in the ordinary way before WIPO, the Forum, CAC, or ADNDRC. A brand owner with both a .com.br and a .com variant registered against it faces two separate procedures in parallel — or must choose one to pursue first. Monitoring strategy should reflect this: alert tiers should separate SACI-Adm candidates from UDRP candidates at the point of detection, not at the point of escalation.

Trap in this step: assuming SACI-Adm timelines and costs mirror WIPO. They do not. Verify current SACI-Adm rules, fees, and timelines with counsel before building an enforcement budget, as the procedure operates under Brazilian institutional rules that may change independently of ICANN policy.

For an assessment of your brand's exposure across .br and adjacent zones, contact info@cognomenlaw.com.

Step 2: Define the mark variants and name strings to watch

A monitoring program is only as good as the watchlist it runs against. Most brand owners maintain a list of registered marks — but that list alone is insufficient for domain monitoring. Registrants who register domains in bad faith rarely use the exact mark string; they rely on confusing similarity.

The watchlist should include: the exact mark string in each of its registered and unregistered forms; common typographical variants (transposed letters, dropped vowels, doubled consonants); phonetic equivalents in Portuguese (critical for Brazil-focused monitoring); the mark combined with generic descriptors such as "comprar," "loja," "oficial," "desconto," and "suporte"; the mark combined with the brand's product category or geographic identifier; and internationalized character variants (cedilla, acute accent, tilde) that are valid in .br registration.

The output of this step is a documented watchlist — a living document, not a one-time spreadsheet. It should be version-controlled and reviewed whenever the brand's mark portfolio changes.

Trap in this step: omitting social-media and marketplace handles from the scope. In the Brazilian market, domain registrations and social-media account seizures often occur together. A complete monitoring program tracks both, even if the legal response mechanisms differ.

Step 3: Stand up the technical monitoring layer and interpret alerts correctly

Technical monitoring for domain registrations works by querying new zone file data — where available — and RDDS (registration data directory services, formerly WHOIS) on a defined cadence. For .br, Registro.br makes registration data queryable; confirm the current query interface and bulk-access rules with counsel, as access policies are subject to change under Brazilian data protection rules (LGPD, Brazil's general data protection law).

For gTLD zones, ICANN's zone file access program provides new-registration feeds for participating registries — currently available for most new gTLDs and legacy gTLDs including .com and .net. A monitoring service that draws on both the Registro.br data and ICANN zone files is the minimum viable technical setup.

In our practice, alert fatigue is one of the most common failure modes we encounter. A broad watchlist run against a high-volume registry generates significant alert volume — most of it legitimate. The monitoring layer needs a triage protocol: exact-match alerts escalate immediately to a legal review queue; fuzzy-match alerts go to a business-side analyst first; alerts for domains showing no active content go to a watch list for 30-day follow-up rather than immediate action. Acting on every alert with legal resources wastes budget and can lead to premature enforcement filings that undermine later proceedings.

Trap in this step: ignoring content signals. Registration data tells you a domain exists. It does not tell you whether it is being used in a way that triggers liability. A passive holding — a domain parked with no content or generic parking ads — is a different enforcement problem than a domain hosting a counterfeit shop. Your triage protocol must include periodic content checks on flagged domains, not just registration data.

Step 4: Run chain-of-title checks and prior-dispute history before any enforcement decision

Once an alert is triaged to the legal review queue, the first action is a chain-of-title check — not a complaint draft. A registrant who held the domain before your mark was registered, or whose registration predates your entry into the Brazilian market, is a materially different enforcement target than a registrant who registered the day after your INPI filing published.

Chain-of-title for a .br domain means checking the Registro.br registration date, the creation date in RDDS, any historical ownership data that is publicly accessible, and whether any prior SACI-Adm or court proceeding has already involved this domain. Under the SACI-Adm rules, a prior adverse finding on a domain may inform but does not automatically determine the outcome of a subsequent complaint. More importantly, a domain that was the subject of a prior complaint that was denied presents a different risk profile — that denial may indicate the registrant has a documented legitimate interest, or that a panel already rejected a similar complainant's theory.

This step also applies to any domain you are considering acquiring through purchase rather than enforcement. A domain with a prior SACI-Adm or UDRP filing history carries title risk. We regularly advise acquirers who discover — after agreeing on a price — that the domain they are buying was previously a dispute respondent, or that the chain of registrants includes a prior holder who was a cybersquatter. Pre-acquisition due diligence on prior dispute history is non-negotiable for any domain of commercial value. See our chain-of-title verification service for the specific checks we run.

Trap in this step: confusing registration date with acquisition date. A domain may have been registered early but acquired through a private sale by its current holder only recently — after your mark's priority date. The chain of title, not just the creation date, is what matters.

Step 5: Choose the right enforcement route — SACI-Adm, UDRP, court, or purchase

With a confirmed alert, a complete chain-of-title review, and an initial evidence read, you face the central enforcement decision: which route?

If the domain is a .com.br or other .br second-level string, SACI-Adm is the relevant administrative path. It does not transfer ownership in the same way a UDRP does; confirm the current remedies available under the procedure — including cancellation and transfer mechanics — with counsel, as the procedure's remedy structure should be verified against current Registro.br rules rather than assumed from UDRP analogies. Court proceedings in Brazil remain an option where administrative relief is unavailable or insufficient; those are handled with local litigation counsel in the relevant jurisdiction.

If the domain is a .com, .net, or new gTLD, the UDRP applies. Filing fees at WIPO start at USD 1,500 for a single-member panel on one to five domains. A standard UDRP case resolves in approximately two months. If the case covers a new gTLD and you only need the domain taken down rather than transferred, URS is a lower-cost suspension option — though it does not transfer ownership.

If both a .com and a .com.br variant are registered against you — a common pattern in the Brazilian market — you face a genuine multi-route decision. Running SACI-Adm and a UDRP in parallel is possible, but the evidentiary records and procedural timelines do not align neatly. In one recent matter (a .com and .com.br pair, summer 2025), we advised a brand owner to prioritize the UDRP on the .com first — because the traffic and commercial harm was concentrated there — and then use that outcome's evidentiary record to inform the SACI-Adm filing. The sequencing cut total elapsed time and avoided inconsistent evidentiary positions.

Purchase — negotiated acquisition from the current registrant — is sometimes faster and cheaper than enforcement, particularly where the bad-faith case has a weak element. We assess the three UDRP (or SACI-Adm) elements against the evidence before recommending enforcement over negotiation. A proceeding that is likely to fail — or to produce an RDNH finding against a UDRP complainant — does more reputational and strategic damage than a negotiated purchase would have.

Trap in this step: filing the enforcement complaint before the evidence is assembled. A SACI-Adm or UDRP complaint filed on a weak evidentiary record can poison a subsequent negotiation, signal to the registrant that the case is marginal, and — in a UDRP context — risk an RDNH finding that becomes a public record against your brand.

To weigh SACI-Adm against a UDRP action or a negotiated purchase for your domain, email info@cognomenlaw.com.

Step 6: Assemble the evidence record before any filing

In both SACI-Adm and UDRP proceedings, the complaint is the primary evidentiary vehicle. There is no discovery, no oral hearing in most cases, and no right to supplement after the response without leave from the panel. The record you file with the complaint is effectively the case you have.

What decides the outcome? In our experience across .br monitoring and enforcement matters, the critical evidence clusters are: your trademark registration documents (INPI certificate for Brazil-facing marks, plus any international registrations); use evidence predating the disputed registration (advertising spend, website traffic data, press coverage in Brazil); content screenshots of the disputed domain, time-stamped and preserved in a format that demonstrates what a user sees; RDDS history printouts showing the registration date and any registrant changes; and evidence of any prior conduct by the registrant — other similar registrations, a pattern of bad-faith registrations in other zones, a demand for sale, or use of the domain to redirect traffic to a competitor.

The last category — a sale demand or a pay-per-click redirect — is often the clearest bad-faith indicator, and it is also the evidence most commonly overlooked in a brand owner's initial internal review. Marketing teams who receive a "buy this domain" email sometimes delete it without preserving a copy. Monitoring programs should include an internal triage protocol for exactly this scenario: any communication involving a domain on the watchlist goes to legal counsel with the full email header intact.

Step 7: Structure ongoing monitoring as a repeating cycle, not a one-time audit

A monitoring program that runs once is a snapshot. A program that runs continuously is a posture. The distinction matters because the .br namespace — and the adjacent gTLD zones where Brazilian-market actors operate — is not static. New registrations occur daily. Existing domains change hands, change content, and change use. A domain that was innocuous at detection may become a counterfeit shop six months later.

The repeating cycle has four recurring components. First, weekly or daily zone-file or RDDS checks against the watchlist for new registrations. Second, monthly content checks on all domains in the active watch queue — those flagged but not yet escalated. Third, quarterly watchlist review against any changes in the brand's mark portfolio, product lines, or Brazilian-market activity. Fourth, an annual enforcement posture review — a read of whether the prior year's escalations produced outcomes, whether the triage threshold should be adjusted, and whether the zone scope still reflects actual risk.

In our practice, brand owners who skip the quarterly and annual cycles typically re-encounter the same problem two to three years later: a domain that was in the watch queue but never escalated has become a significant operational problem, and the evidence record that would have been fresh at detection is now stale or unavailable.

Trap in this step: treating the program as the legal team's responsibility alone. The most effective monitoring programs we have seen embed a lightweight triage function in the brand owner's marketing or compliance team, with a defined escalation path to legal counsel. Content alerts — "this domain is now showing a counterfeit product page" — are often caught faster by someone who knows the brand's products than by a paralegal reviewing a screenshot queue.

How do costs and fees split across monitoring and enforcement?

Brand-protection monitoring involves two distinct cost layers. Monitoring costs — the technical and administrative cost of running zone-file checks, maintaining the watchlist, and performing triage — are typically fixed or subscription-based, sized to the watchlist volume and alert cadence. These are operational costs, not legal fees, and are best negotiated directly with the monitoring provider.

Enforcement costs split again: forum filing fees, which are fixed by the institution, and legal fees, which are time-and-matter-dependent. For a UDRP at WIPO, the filing fee is USD 1,500 for a single-member panel on one to five domains. Legal fees for a straightforward single-domain UDRP complaint typically fall in a range commonly seen in the market of USD 3,000 to USD 7,000, separate from the filing fee — though the actual fee in any matter depends on complexity and the volume of evidence. For SACI-Adm, verify current filing fees directly with Registro.br or with counsel, as these are set under Brazilian institutional rules and are not published in ICANN materials.

Where a domain is acquired by purchase rather than enforcement, escrow structure is a separate cost consideration. We routinely advise on escrow mechanics for domain transactions involving Brazilian-market names to ensure that the transfer completes before funds release and that the Registro.br transfer requirements are met. See our domain transactions services for the full scope of transaction-side support we provide.

Respondent-side costs are relevant for brand owners who are themselves served with a complaint — including a SACI-Adm or UDRP complaint targeting a domain the brand legitimately owns. Defense costs in a well-documented good-faith registration case are comparable to complainant costs at the forum-filing-fee level, with legal fees again fact-dependent. Where the complaint appears abusive, pursuing a finding of Reverse Domain Name Hijacking (RDNH) in a UDRP context is a separate strategic question with its own cost-benefit calculus.

Trap in this step: conflating monitoring costs with enforcement budgets in the same annual line item. They are structurally different: monitoring costs are ongoing and relatively predictable; enforcement costs are event-driven and highly variable. Build them as separate budget lines.

Related at COGNOMEN

• Domain transactions and brand-protection monitoring services — full scope of transaction support
• Chain-of-title verification — prior dispute history and acquisition due diligence checks
• URS suspension for new gTLDs — when and how URS applies instead of UDRP