Step-by-step: set up brand-protection monitoring across .ch and related zones

A Swiss distributor registers your brand name under .ch before your product launch. A month later, the domain redirects to a competitor's site. You discover it only when a customer asks why your Swiss page looks different. That scenario is not hypothetical – in our practice, we encounter it regularly, and it is almost always preventable.

To set up brand-protection monitoring across .ch and related zones, you need a structured watch program that covers the SWITCH registry for .ch and .li, adjacent zones likely to be weaponized against your brand, and a documented escalation path for each alert class. SWITCH administers .ch and .li under Swiss law; neither zone operates under the UDRP, so the dispute route differs materially from a .com complaint. A well-designed watch program identifies infringements early enough to use the lower-cost registry procedures before litigation becomes necessary.

This guide walks each step in sequence, names the trap in each one, and shows where the process connects to chain-of-title checks, prior-dispute history, and the correct escalation route for the Swiss zone.

Why .ch Monitoring Differs From a Standard gTLD Watch Program

SWITCH, the registry for .ch and .li, operates under Swiss law and its own dispute-resolution rules – not the UDRP. That single fact reshapes every element of a monitoring program aimed at Swiss zones. The complaint procedure, the eligible claimants, and the remedies available are all governed by the SWITCH Dispute Resolution Procedure and, ultimately, Swiss civil law. A brand owner who files a UDRP against a .ch domain has chosen the wrong venue and will lose time.

What does this mean for watch design? It means your alert thresholds, your evidence-gathering protocol, and your escalation triggers must be calibrated to the Swiss rules from the outset. A .com watch program copied and pointed at .ch will flag the right domains but route the response incorrectly. That mismatch is the first trap: teams assume procedural uniformity across zones and act on the gTLD playbook where a different one applies.

Beyond .ch and .li, the related zones that commonly matter for Swiss brands include .eu (for companies with EU or EEA nexus), .com (global, UDRP-governed), and .de for cross-border spillover into Germany. Each zone has its own procedure. A monitoring program worth building covers all four, with zone-specific escalation branches. The .eu zone uses the ADR.eu platform administered through the Czech Arbitration Court; .de disputes typically proceed through the German courts, with a DENIC DISPUTE entry blocking transfer during litigation; .com disputes proceed through WIPO, the Forum, or CAC under the UDRP. One alert system, four procedural paths.

For an assessment of your current brand-protection posture across Swiss and adjacent zones, contact info@cognomenlaw.com.

Step 1: Define the Watch Perimeter – Which Zones and Which Strings?

The first decision is scope: which domain strings and which zones will the program monitor? Getting this wrong at the outset produces either alert fatigue (too broad) or gaps that allow infringement to go undetected (too narrow). The trap in this step is defaulting to exact-match monitoring only, which misses typosquats and phonetic variants.

Begin by listing the exact-match strings – your primary trademark, your brand name in both Roman and any transliterated forms, and your product names with independent commercial significance. For each string, generate a set of variant classes:

• Typosquats: single-character substitutions, deletions, transpositions, and common keyboard-adjacency errors (e.g., "brannd" for "brand").
• Prefix and suffix additions: hyphens, generic terms (shop, kaufen, support, service), country indicators (swiss, ch, schweiz).
• Phonetic equivalents: particularly relevant where the brand name has a German or French rendering common in Switzerland.
• Homoglyphs: characters that appear visually similar but encode differently – a growing attack vector in internationalized domain names (IDNs).

Cross that string list with the zone list. At minimum, monitor .ch, .li, .eu, .com, and .de for a Swiss-facing brand. Add .fr and .it if the brand operates in Romandy or Ticino, where French and Italian cross-border registrations are a realistic threat. The output of this step is a documented watch matrix: strings × zones. Every subsequent alert flows through it.

Step 2: Choose a Monitoring Data Source and Set Alert Frequency

New registrations in most zones are reported in zone files or through registry-level WHOIS/RDDS feeds, and several commercial services aggregate these into daily or real-time alert streams. The trap here is over-relying on a single data source that misses private or delayed zone-file publication schedules particular to .ch.

SWITCH does not publish a fully open zone file in the way that Verisign does for .com. Access to .ch zone data for brand-protection purposes requires either a direct data-access arrangement with SWITCH or use of a monitoring provider that has such an arrangement. Confirm, before contracting, that your chosen tool covers .ch and .li zone data with a publication lag you can accept. A 24-hour lag on .ch data is industry-standard; anything longer means a registrant has already had a day to configure the domain before you see the alert.

Set alert frequency to daily for new registrations and weekly for existing-domain changes (registrant data updates, nameserver changes, MX record additions that suggest email-fraud setup). The weekly scan for existing domains is the step most programs omit. A domain registered two years ago with no content becomes dangerous the moment its nameservers change to point at a phishing kit.

Step 3: Triage Every Alert – Four Categories, Four Responses

A watch program that generates alerts without a structured triage protocol creates work without output. The trap in this step is treating every alert as requiring immediate legal action, which exhausts budget and desensitizes the team to real threats.

We recommend a four-category triage at alert intake:

1. Category A – Immediate action: The domain is live, actively trading, or redirecting to a competitor. Escalate to legal within 48 hours. Preserve evidence immediately (timestamped screenshots, WHOIS/RDDS record, source code, any phishing indicators).
2. Category B – Monitor closely: The domain resolves but carries only a parking page or no content. Log, screenshot, and re-check in seven days. If monetized parking appears, re-categorize to A.
3. Category C – Low risk, watch only: The domain is registered by an entity with a plausible legitimate interest – a business with a matching trade name, a reseller agreement, a prior use. Confirm registrant identity if RDDS data is available; re-triage in 30 days.
4. Category D – No action: The domain does not credibly compete with or exploit your mark. Archive and close.

Category A alerts demand the fastest response because evidence in domain disputes decays: a registrant can change content, delete MX records, or transfer the domain before you have a case on file. In a recent matter involving a .ch typosquat (spring 2025), the registrant altered the redirected URL within 72 hours of the brand owner's first internal review meeting. The evidence preserved before that change was the case; the post-change state of the domain was irrelevant to the outcome.

Step 4: Chain-of-Title and Prior-Dispute Checks Before You Acquire or Enforce

Whether you are acquiring a domain through negotiation or preparing an enforcement action, a chain-of-title check is essential. The trap here has two faces: brand owners who skip the check before acquisition discover they bought a tainted domain with prior dispute history; those who skip it before enforcement file against a registrant who has a stronger rights record than they assumed.

A chain-of-title check for a .ch domain covers:

• Current and historical WHOIS/RDDS registrant data (to the extent accessible under Swiss data protection rules and SWITCH policy).
• Historical DNS records: what the domain has resolved to, and when changes occurred. Passive-DNS tools are reliable here.
• Prior SWITCH dispute history: has the domain been the subject of a dispute proceeding? If so, what was the outcome? A prior finding of legitimate interest in the registrant's favor is not preclusive, but it materially affects strategy.
• Prior UDRP or other gTLD-procedure involvement: if the same registrant holds related .com or .eu domains and has prior bad-faith findings against them, that pattern is relevant evidence in a Swiss proceeding.
• Trademark registration records: in Switzerland, the Swiss Federal Institute of Intellectual Property (IGE/IPI) maintains the trademark register. Confirm the date your rights pre-date the domain registration – or confirm that they do not, which raises a legitimate-interest defense risk you must address before filing.

For acquisitions specifically, the escrow structure matters as much as the title check. A domain purchase where the seller's chain of title is unclear should not proceed without a structured escrow that conditions release of funds on clean transfer confirmation. We regularly advise buyers who discover mid-transfer that the domain they are purchasing was previously the subject of an abusive-registration proceeding – a fact the seller did not disclose. That scenario is avoidable with a proper pre-acquisition due-diligence protocol.

To weigh UDRP against a court action for your case, or to plan chain-of-title review for a pending .ch acquisition, email info@cognomenlaw.com.

How Do You Escalate When Monitoring Detects an Active Infringement Under .ch?

Once a Category A alert is confirmed, the escalation route for .ch is the SWITCH Dispute Resolution Procedure, not the UDRP. The SWITCH procedure is distinct: it requires the complainant to demonstrate rights in a name under Swiss law, and the domain holder may assert defenses based on legitimate interests under the same body of law. The remedy, if the complaint succeeds, can include transfer. Unlike the UDRP, which requires both registration and use in bad faith (a cumulative test), the Swiss procedure evaluates abuse under its own standard – which is why translating a UDRP brief into a SWITCH complaint without adaptation is a common and costly mistake.

The escalation sequence looks like this:

1. Evidence lock: Preserve all screenshots, DNS records, WHOIS/RDDS captures, and traffic or brand-confusion evidence before any communication with the registrant. Contacting the registrant first can prompt a content wipe.
2. Rights confirmation: Verify that your Swiss trademark registration (or other recognized right under Swiss law) predates the domain registration. If your registration is pending or post-dates the domain, you need a different legal theory and a different strategy.
3. Forum selection: For .ch, file under the SWITCH procedure. For .eu domains in the same infringement cluster, file via ADR.eu at the Czech Arbitration Court. For any .com domain in the cluster, file at WIPO (filing fee USD 1,500 for a single-member panel on 1–5 domains) or another accredited UDRP provider. Multi-zone infringement frequently justifies parallel filings, timed strategically.
4. Registrar notification: Simultaneously notify the registrar of the .ch domain of the abuse, referencing the SWITCH procedure. Registrars are required to cooperate with SWITCH dispute outcomes; early notice creates a record of registrar awareness.
5. Settlement window: In many cases, the registrant capitulates upon receipt of the complaint. Document any transfer offer carefully; an unstructured transfer without formal agreement can create chain-of-title issues of its own.

In a recent matter (a .ch and .eu dual-zone infringement, late 2024), we coordinated parallel filings under the SWITCH procedure and ADR.eu, with a UDRP complaint at WIPO covering the .com variant. The strategy resolved the .eu and .com claims first, which then supported the Swiss proceeding with a record of consistent bad-faith findings against the same registrant.

What Evidence Decides the Outcome in a Swiss Zone Dispute?

The quality of your evidence file determines the outcome at least as much as the legal theory. In Swiss zone proceedings, panels and courts evaluate whether the registrant's conduct amounts to abuse of the claimant's rights – and the evidence standard is concrete, not inferential. Vague assertions of brand confusion without supporting documentation are routinely rejected.

The evidence that most reliably moves a Swiss-zone decision includes:

• Timestamped screenshots of the domain's content at the time of discovery, and at each subsequent change. Bare assertions that the domain once hosted harmful content, without preserved captures, carry little weight.
• Traffic or click-through data showing that users reached the infringing domain via searches for your brand – search-engine cached pages and referral analytics both serve this function.
• A documented timeline of your rights: trademark registration date, first use in commerce in Switzerland, and any prior dealings with the registrant.
• Communications with the registrant, particularly any demand for payment (a classic Paragraph 4(b) bad-faith indicator under the UDRP; treated similarly under Swiss abuse doctrine).
• Registration pattern evidence: does this registrant hold other domains targeting third-party marks? A pattern of abusive registrations is powerful corroborating evidence in any zone, and it is one of the few arguments that travels across forum boundaries without significant adaptation.

What does not decide the outcome, despite common belief? Mere registration of a confusingly similar string without evidence of abusive use or bad-faith intent will not, on its own, support a transfer order in most Swiss-zone proceedings. The myth that registration alone is enough – that a brand owner can always claw back any domain resembling its mark – is the most pervasive misconception we address in advising complainants. Rights do not automatically defeat registration; the abuse element must be established on the facts.

How to Handle the Respondent-Side Risk: What If the Alert Is Wrong?

A monitoring program that generates false positives – and every program does – creates respondent-side risk. If you send a cease-and-desist or file a complaint against a domain held by a registrant with a legitimate interest, you expose the brand owner to a finding of Reverse Domain Name Hijacking (RDNH). Under the UDRP, an RDNH finding means the complaint was brought in bad faith to deprive a legitimate registrant of their domain; the finding is reputational and public, with no monetary penalty, but it is indexed and discoverable.

How do you guard against this? The triage protocol in Step 3 is the first line of defense. The chain-of-title check in Step 4 is the second. Before any enforcement action, the analyst preparing the complaint should be able to answer: does the registrant have a plausible legitimate interest? Is there any prior use by the registrant predating our mark? If the honest answer to either question is "possibly," the enforcement action should not proceed without further investigation.

We regularly defend registrants who receive complaints from brand owners whose monitoring programs generated a false-positive alert and escalated without adequate triage. The domains in those cases are typically held by registrants who have operated legitimate businesses under the same or similar name for years. Understanding the registered-before-trademark dynamic is essential both for designing a monitoring program that avoids RDNH exposure and for defending a registrant facing an overreaching complaint.

Step 5: Build the Escalation Register and Review Cycle

A monitoring program without a governance structure decays within months. The trap in this final step is treating the program as a one-time setup rather than a living operational process. Domain threats evolve: new TLDs launch, registrant tactics change, and your brand's exposure shifts as you enter new markets or launch new products.

Build an escalation register – a structured log of every alert, its triage category, the action taken, and the outcome. Review it quarterly. The quarterly review should address:

• Alert volume trends: is the number of Category A alerts rising? That may indicate a coordinated campaign rather than opportunistic cybersquatting, and it warrants a different strategic response.
• Zone coverage gaps: are new gTLD launches or ccTLD policy changes creating exposure not covered by the current watch matrix?
• Threshold calibration: are Category D (no-action) decisions holding up on re-review, or are some of those domains now live and harmful?
• Pending matters: what is the status of any active SWITCH, ADR.eu, or UDRP proceedings? Are decisions due? Has the registrar confirmed any pending transfers?

The review cycle also creates the documentary record that demonstrates good-faith enforcement to a future panel or court. Brand owners who can show a consistent, documented monitoring practice are better positioned to argue that their complaint is proportionate and well-grounded – and less vulnerable to RDNH findings.

Our brand-protection monitoring technology service provides the alert infrastructure, triage support, and quarterly review framework described in this guide, integrated with the enforcement services needed when Category A alerts arise. More on the full range of domain transaction and protection services is available at our transactions practice page.

Related at COGNOMEN

• Domain transactions, acquisitions, and brand protection monitoring across gTLDs and ccTLDs
• Technology-backed brand-protection monitoring with integrated escalation support
• Respondent defense where a domain was registered before the complainant's trademark existed

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.