Step-by-step: set up brand-protection monitoring across .store and re…

Step-by-step: set up brand-protection monitoring across .store and re. UDRP and ccTLD domain recovery and defense across .store. Email the firm to assess your…

A retailer launches a new product line. Within weeks, a stranger registers the matching .store domain, points it at a counterfeit storefront, and starts collecting the brand's customers. The registrant is unreachable. The damage compounds daily. Had monitoring been in place at launch, the registration would have been flagged before the first sale.

To set up brand-protection monitoring across .store and related zones, you define a watch perimeter covering exact-match, phonetic, and typosquat variants of your marks; configure automated alerts tied to new registrations and WHOIS/RDDS data; and establish a triage protocol that routes confirmed infringements to the appropriate dispute route – UDRP at WIPO for .store (a new gTLD operating under the standard Policy) or the governing national procedure for ccTLD co-registrations. The WIPO filing fee for a single-domain complaint starts at USD 1,500. The trap at every step is latency: a monitoring program that flags a domain three months after registration is far less useful than one that flags it on day one.

This guide walks each step in sequence, names the trap hidden inside it, and closes with the dispute routes available when a flagged domain turns into a live infringement.

What makes .store a priority zone for brand monitoring?

.store is a commercially sensitive new gTLD because its namespace is purpose-built for retail – and that alignment makes it a preferred vehicle for cybersquatters targeting e-commerce brands. The zone operates under the UDRP administered by WIPO, the Forum, the Czech Arbitration Court (CAC), and ADNDRC, so a brand owner who wins all three UDRP elements can obtain a transfer order through the same familiar procedure used for .com. That is the good news. The complication is scale: .store shares the retail-brand space with dozens of overlapping zones – .shop, .boutique, .deals, .sale – and a monitoring program that covers only .store misses the wider pattern.

In our practice we regularly see brand owners who set up watches for .com and .net at launch, then discover that the first infringement appears in .store six months later because no alert was configured there. The lesson is that the zone selection decision must happen at the same time as the trademark filing, not after the first problem surfaces.

The UDRP applies to .store as a contracted new gTLD, which means the three-element test – confusing similarity, no legitimate interest, registration and use in bad faith – governs any dispute. Panels have consistently held that the gTLD suffix is generally irrelevant to the confusing-similarity analysis; a domain identical to a registered mark at the second level satisfies the first element regardless of whether the suffix is .com or .store. That consistency is useful: evidence that works in a .com case transfers directly to a .store case.

Step 1 – Define the watch perimeter before you register anything

The first decision is what to watch, and the trap is defining it too narrowly. Most brand owners begin with an exact-match watch on the primary trademark string. That catches the obvious registrations. It misses the domain that inserts a hyphen, doubles a letter, or appends a generic retail term – "buy," "shop," "store," "official" – to the brand string.

A properly scoped perimeter covers four variant classes:

• Exact-match: the mark string plus every monitored gTLD and ccTLD suffix.
• Typosquats: single-character substitutions, transpositions, omissions, and phonetic equivalents of the mark string.
• Compound variants: the mark string combined with generic retail terms, product categories, or geographic qualifiers.
• Homograph variants: Internationalized Domain Names that visually mimic the mark string using characters from a different script.

The trap at this step is over-relying on the exact-match list and treating the other three classes as optional refinements. In a recent matter (a .store typosquat identified in spring 2025), the infringing domain had transposed two letters in the brand name and added the suffix "–shop." An exact-match watch would not have flagged it. A typosquat sweep did.

Step 2 – Configure zone coverage across .store and the related retail namespace

Zone coverage is the second decision, and the related-zone problem is significant. "Related zones" for a retail brand means at minimum: .store, .shop, .boutique, .deals, .sale, .discount, .buy, and the primary ccTLD for each market where the brand trades. A brand active in the UK, Australia, and Canada should add .uk, .au, and .ca to that list. Each ccTLD carries its own dispute procedure: Nominet DRS for .uk, the auDRP for .au, the CIRA CDRP for .ca.

The practical approach is to tier the coverage. Tier 1 – .com, .store, .shop, and the brand's primary market ccTLDs – receives real-time alerts on new registration data. Tier 2 – the broader retail new gTLDs – receives weekly batch sweeps. Tier 3 – remaining ccTLDs – receives monthly audits against the mark string. The tier assignment should be reviewed annually, because zone usage patterns shift as registrar pricing changes and new gTLDs gain or lose traction.

The trap here is treating zone coverage as a one-time configuration. Zone relevance changes. A zone that carried almost no infringing registrations two years ago may become a preferred vehicle this year if a major registrar discounts it heavily. The monitoring protocol must include a quarterly review of which zones are generating new alerts, with a standing instruction to escalate any zone that produces more than a threshold number of alerts in a quarter.

For an assessment of your brand-protection monitoring perimeter across .store and related zones, contact info@cognomenlaw.com.

Step 3 – Establish a triage protocol that separates alerts from actionable disputes

A monitoring program that generates alerts without a triage protocol produces noise, not protection. The triage step converts a raw registration flag into a decision: investigate further, watch and accumulate evidence, or file a dispute immediately. Most brand owners who come to us after a monitoring failure did not lack alerts – they lacked the downstream process to act on them.

A workable triage framework uses three criteria applied in sequence to each alert:

1. Similarity score: how closely does the flagged domain resemble the mark string? Exact or near-exact – immediate escalation. Compound variant with a generic term – investigate use first.
2. Resolved content: what does the domain currently display? A counterfeit storefront or pay-per-click links to competitors is strong evidence of bad faith under Paragraph 4(b) of the UDRP. A parked page with no content is a weaker but still actionable signal. An unresolved domain is a watch item, not yet a filing.
3. WHOIS/RDDS data: is the registrant identity concealed by a privacy proxy? Is the registration date recent relative to the brand's trademark filing or commercial launch? A privacy proxy is not independently bad faith, but combined with a near-exact domain string and infringing content it strengthens the case materially.

The trap at this step is treating a parked page as inactive. Panels have consistently held that passive holding of a domain confusingly similar to a well-known mark can, in the right circumstances, constitute bad faith use. Waiting for the registrant to activate the domain before filing may mean waiting until the evidence of harm is harder to quantify but the infringement is already underway.

How does the UDRP apply to .store disputes, and what evidence decides the outcome?

The UDRP applies to .store as it does to every new gTLD: the complainant must satisfy all three elements of Paragraph 4(a) – confusing similarity, no legitimate interest, and registration and use in bad faith. The only remedies are transfer or cancellation; no monetary award is available under the Policy. A standard case is normally completed within about two months, with the respondent given 20 days to file a response once the case commences.

For .store disputes, the evidence that most frequently decides outcomes falls into three categories. First, use evidence: screenshots of the resolving page captured at multiple dates, ideally soon after registration, to show bad-faith use that correlates with the registration date. Second, WHOIS chronology: registration date versus the complainant's trademark priority date and the date of commercial launch. A domain registered the day after a brand's public announcement is much harder to explain as coincidence than one registered two years before the brand existed. Third, pattern evidence: other registrations in the same zone or related zones by the same registrant, each following the same structure, which tends to establish the pattern-of-conduct factor under Paragraph 4(b).

The cross-zone dimension matters here. If monitoring reveals that the same registrant holds the infringing .store domain and a matching .com or .shop registration, a single UDRP complaint can cover all domains held by that registrant – the filing-fee calculation changes, but the evidentiary package strengthens because each domain in the complaint reinforces the pattern finding.

Step 4 – Run a chain-of-title check before acquiring any flagged domain

Not every flagged domain is a dispute. Some brand owners prefer to purchase an infringing or conflicting domain rather than file a complaint. That approach is legitimate, but it carries a specific trap: acquiring a domain without a chain-of-title and prior-dispute-history check means inheriting any taint the domain carries.

A domain previously the subject of a UDRP complaint and transferred to a complainant carries a dispute history in the WIPO case database. A domain acquired through an opaque broker chain may conceal a prior transfer order, a prior theft, or a prior escrow dispute. Purchasing that domain does not erase the history; it transfers the exposure to you as the new registrant. A subsequent challenge by a different complainant will be reviewed against the full chain, not just your acquisition.

The practical steps before any acquisition in the .store zone or a related retail zone are:

• Search the WIPO case database and the Forum's docket for the exact domain string to identify any prior proceedings.
• Review the registrar's WHOIS history (where accessible) for the full chain of registered holders.
• Confirm that the current seller has the authority to transfer and that no registrar-level dispute entry or lock is active on the domain.
• Structure the purchase through a reputable escrow service, with transfer confirmation as the condition of fund release.

In a recent matter (a .store acquisition, autumn 2025), a brand owner approached us after purchasing a domain for a mid-four-figure sum, only to receive a UDRP complaint from a third party two months later. Due-diligence review of the WIPO database before closing would have shown a prior complaint filed against the same string, settled before a decision, creating unresolved dispute history. The acquisition proceeded without that check. The subsequent complaint cost more to defend than the domain cost to buy.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

Step 5 – Choose the right dispute route when a flagged domain requires action

The right route depends on the zone, the remedy you need, and the registrant's conduct. For .store and the other new gTLDs, the UDRP is almost always the starting point: it operates through WIPO, the Forum, CAC, or ADNDRC, delivers a decision within about two months, and transfers the domain to you at a total cost that is far lower than litigation. The choice between WIPO and the Forum is partly tactical – WIPO has a larger pool of experienced panelists for new-gTLD cases; the Forum's fees begin slightly lower at around USD 1,300 for a single-member, one-to-two domain complaint.

If the infringement also covers a .uk domain, the Nominet DRS applies separately: a distinct procedure with a free mediation stage before any expert decision, and a test of "abusive registration" that reads "registered or used" abusively – a materially lower threshold than the UDRP's cumulative "registered and used" requirement. A .eu infringement routes through the EURid ADR procedure at the Czech Arbitration Court, where the remedy can include transfer if the complainant meets EU eligibility requirements. A .de infringement has no arbitration track at all; the German courts and a DENIC dispute entry to block transfer while litigation proceeds are the correct route.

Where the infringement is confined to .store and closely related new gTLDs and you need the domain transferred rather than merely suspended, the UDRP is the direct path. Where you need the domain taken offline quickly during a pending UDRP proceeding, a URS filing for the same zone can suspend the domain within days, at lower cost, though it does not transfer ownership. If you also want monetary damages – for diverted sales, brand harm, or lost customers – neither UDRP nor URS reaches money; US anticybersquatting litigation is the only mechanism that does, handled with local litigation counsel in the relevant jurisdiction.

What happens when monitoring reveals a default registrant?

A registrant who ignores a UDRP complaint defaults. Default does not mean automatic transfer. The panel still evaluates whether the complainant has met all three UDRP elements on the filed record, without inference from the silence. In practice, a well-documented complaint – accurate WHOIS chronology, clear screenshots showing bad-faith use, and a mark with priority predating the registration – will normally succeed in a default case, because the Panel has no contrary evidence to weigh.

The trap in a default scenario is assuming the filing can be thin. Panels have denied complaints on default where the complainant's evidence failed to establish the registration-and-use-in-bad-faith element, or where the submitted mark evidence was incomplete. We assemble default filings to the same standard as contested ones: the fact that the respondent did not appear does not reduce the burden on the complainant.

For a monitoring program specifically, a default pattern across multiple flagged domains – the same registrant failing to respond in multiple UDRP cases – is itself evidence of a pattern of abusive registrations under Paragraph 4(b). We document that pattern and include it in each successive complaint as it accumulates.

Related at COGNOMEN

• Domain transactions, due diligence, and brand-protection monitoring services
• Recover a lapsed .uk domain through the Nominet DRS procedure
• FAQ: ccTLD mediation and national dispute procedures across jurisdictions