How to bring a court action when UDRP cannot reach a .shop domain

A brand owner discovers that a .shop domain matching its registered trademark has been pointed at a competing storefront. A demand letter goes unanswered. The UDRP complaint looks straightforward — until counsel checks the registrant's conduct and realizes the situation calls for something the arbitral panel cannot give: a damages award, an injunction, or a reversal of a fraudulent transfer. That is when a court action enters the picture.

To bring a court action when UDRP cannot reach a .shop domain, you must identify the gap — whether that is a demand for monetary damages, evidence of domain theft requiring transfer reversal, or a registrant who has engineered a situation that falls outside all three UDRP elements — and then file in the jurisdiction whose anticybersquatting statute or general civil law governs the registrant or the harm. The UDRP filing fee at WIPO starts at USD 1,500, but a court action is the only route that reaches money and can compel third-party disclosure. The right choice depends on the facts, the zone, and the remedy sought.

This page covers when .shop falls under UDRP jurisdiction, when court action is the superior route, the mechanics of a court filing, the evidence that decides outcomes, and how to start.

Does the UDRP apply to .shop — and where does it stop?

.shop is a new generic top-level domain (new gTLD) that operates under UDRP jurisdiction; WIPO and the Forum both accept .shop complaints, and the standard three-element test of Paragraph 4(a) of the UDRP applies. That covers confusing similarity to a trademark, absence of legitimate interest, and bad-faith registration and use. WIPO's filing fee for a single-member panel covering one to five domains is USD 1,500, and a standard case completes in roughly two months.

But UDRP authority ends at the edge of the Policy. The panel cannot award damages. It cannot enjoin ongoing conduct beyond ordering a transfer or cancellation. It cannot compel a registrar to produce account records. And it cannot unwind a fraudulent domain transfer — the scenario where a hijacker has already moved the domain to a new registrant through a stolen credential or forged authorization. In each of those situations, a national court can act where the panel cannot.

There is a second limit worth naming. The UDRP's bad-faith test requires that the domain was registered and used in bad faith — both limbs, cumulatively. A respondent who registered the domain legitimately years ago and only later repurposed it may survive on the registration prong alone, leaving the trademark owner without a UDRP remedy even if current use is clearly harmful. Court anticybersquatting litigation under the applicable national statute typically has a lower threshold on that same point, addressing registration or use in some jurisdictions.

For a read on whether the three UDRP elements are met in your .shop situation — or whether a court route is the better fit — reach us at info@cognomenlaw.com.

When does a court action beat UDRP for a .shop dispute?

Four situations push a .shop dispute toward court rather than arbitration. Understanding which one applies to your facts is the first decision the case turns on.

First: you need damages. UDRP panels have no power to award money. If the .shop domain has been used to divert sales, defraud customers, or damage the brand in a quantifiable way, a court action under the applicable anticybersquatting legislation — in the US, generically referred to as US anticybersquatting litigation — or under general civil-law tort doctrine is the only mechanism that reaches compensation.

Second: the domain was stolen. Domain theft — where a registrant's account was compromised, credentials were phished, or a fraudulent transfer instruction was submitted to the registrar — is not a UDRP matter. The Policy addresses disputes between a trademark owner and a registrant; it does not adjudicate which of two parties is the rightful registrant. A court can order transfer reversal, account restoration, and in appropriate cases, disclosure from the registrar or hosting provider as to how the transfer occurred. We regularly handle these escalations; the registrar-lock and transfer-reversal mechanics are distinct from the UDRP process and move on a different clock.

Third: the respondent is outside UDRP reach in a practical sense. A UDRP decision binds the registrar, not the registrant personally. If the respondent operates a business under the disputed .shop domain, a court injunction can stop that business directly. The UDRP cannot.

Fourth: the registration predates the mark but use became infringing. Where the timing kills the UDRP bad-faith registration prong, a trademark-infringement or passing-off action in the relevant national court may succeed where the panel could not.

In a recent matter (a .shop domain used to operate a counterfeit goods storefront, spring 2025), we coordinated with local litigation counsel in the relevant jurisdiction to secure an interim injunction suspending the site within days of filing, while the UDRP track — which would have taken two months — was still being evaluated. Speed and remedy drove the choice.

How does the registrar-lock and transfer-reversal process work?

Before a court filing, the immediate priority in any domain-theft scenario is to freeze the asset. A domain that moves to a second registrar after the theft becomes significantly harder to recover; the chain of custody lengthens and the registrar's cooperation drops sharply once the domain is no longer in their system.

The standard sequence runs like this. The rightful registrant — or their counsel — contacts the current registrar of record with evidence of the unauthorized transfer: access logs, account emails, registrar transaction records, and any WHOIS/RDDS history showing the change of registrant field. Most registrars have an abuse or dispute escalation pathway. A formal legal hold request, supported by a filed or imminent court action, typically produces a registrar lock — a status flag preventing further transfer — within hours in urgent cases.

The court filing itself comes next. The claim identifies the .shop domain by name, establishes the petitioner's prior rights (registration certificate, use evidence, chain of title), and seeks one or more of: a temporary restraining order or interim injunction preventing further transfer; a mandatory order for transfer back to the claimant; discovery orders directed at the registrar; and damages where a monetary claim is viable. Local litigation counsel in the relevant jurisdiction handles the procedural steps specific to that court system.

Registry cooperation is a separate lever. GMO Registry, the operator of .shop, has its own abuse and lock procedures. A court order naming the registry — or a credible pre-filing legal hold request — can trigger a registry-level lock independent of the registrar's action. We document the full chain when preparing the evidentiary package.

To plan recovery of a stolen or hijacked .shop domain, contact info@cognomenlaw.com.

What evidence decides a court action for a .shop domain?

Courts deciding anticybersquatting or domain-theft claims look at a structured body of evidence. Getting that evidence assembled before filing — not after — is what separates a fast interim order from a prolonged dispute.

For a cybersquatting claim, the core record includes: proof of trademark rights predating the .shop registration (registration certificates, first-use dates, market recognition materials); the registration date and registrant identity as captured in WHOIS/RDDS history; screenshots and archived captures of how the domain was used (pay-per-click parking pages, competing storefront, phishing site); any direct communications in which the registrant offered to sell the domain at a price suggesting awareness of the mark; and evidence of a pattern if the registrant holds other similarly abusive names.

For a domain-theft claim, the evidentiary picture is different. Here you are establishing that the current registrant of record obtained the domain through unauthorized means. The documentary spine is: the original registration confirmation and account records showing the legitimate holder; registrar access logs or account-activity records showing an unauthorized login or transfer instruction; any phishing email or social-engineering artifact that preceded the transfer; and the RDDS change-of-registrant timestamp that correlates with the compromise event.

Expert evidence on digital forensics is sometimes warranted. Where the chain of compromise runs through multiple hosting accounts or jurisdictions, a structured forensic report — prepared by a qualified expert, not counsel — significantly strengthens the interim-order application. We work with local litigation counsel in the relevant jurisdiction to identify appropriate experts at the outset.

In a second matter from our practice (a .shop theft where the original registrant's registrar credentials were phished, autumn 2024), the combination of account-access logs and registrar-communication records produced a same-week registrar lock and, within three weeks of filing, a court order for transfer reversal. The forensic chain was complete before the first court document was drafted.

How does the UDRP compare to a court action for .shop — which route is right?

The right route depends on the remedy you need, the timeline you can afford, and the conduct you are trying to stop. Here is the decision logic in plain terms.

If the .shop domain is parked or pointed at a pay-per-click page and you simply want it transferred, the UDRP at WIPO or the Forum is almost always the faster and cheaper path. The WIPO single-member panel filing fee is USD 1,500, and a decision arrives in roughly two months. Legal fees for a straightforward single-domain complaint typically fall in the USD 3,000–7,000 range, separate from the forum fee. The process is entirely online; there is no in-person hearing. That combination of speed and cost is hard to beat when the facts are clean and the only goal is transfer.

If the domain is being used actively — running a competing store, operating a phishing scheme, or diverting customers — and you want that stopped today, a court-filed interim injunction can produce relief within days rather than months. The UDRP cannot do that. A court action is substantially more expensive on an hourly basis, and timelines depend on the jurisdiction. But where the ongoing harm is acute, the comparison is not UDRP vs. court; it is injunction now vs. transfer in two months.

If the domain was stolen and is now held by a third party unrelated to any trademark dispute, the UDRP is simply the wrong tool. File in court, pursue the registrar-lock pathway in parallel, and engage local litigation counsel in the relevant jurisdiction for the procedural steps.

If you want damages in addition to transfer — compensation for diverted sales, brand damage, or fraud losses — only a court can give you that. File the court action, and consider whether a parallel UDRP is worth the additional cost for the transfer remedy specifically.

One scenario that often surprises brand owners: the UDRP and a court action are not mutually exclusive. The UDRP may be stayed if a court action is filed, or the parties may proceed in parallel if the timing and jurisdiction permit. In practice, we advise on sequencing — which forum to reach first for which remedy — as part of the initial case assessment.

What are the realistic costs and timelines for a court action?

Court anticybersquatting litigation is substantially more resource-intensive than a UDRP filing. That is the candid comparison every brand owner should hear before deciding.

Filing fees in most national courts are modest — typically a small fixed fee or a percentage of the claimed amount. The significant cost is legal: hourly rates for litigation counsel, plus local litigation counsel in the relevant jurisdiction if the domain is registered with a foreign registrar or the registrant is based abroad. Total legal spend for a straightforward single-domain action in a well-resourced jurisdiction commonly runs well above the UDRP flat-fee range, and contested cases can run substantially higher. We are transparent about that range at the assessment stage.

Timelines vary widely. An interim injunction or temporary restraining order can be obtained in days in an urgent theft or phishing scenario. A full merits decision — establishing liability and awarding damages — typically takes months to over a year depending on the jurisdiction, docket, and whether the respondent contests. Default judgments, where the registrant fails to appear, can arrive faster.

The cost and timeline comparison does not automatically favor arbitration. A UDRP transfer order costs less and arrives faster, but it gives you only the domain. A court judgment that also awards damages — and potentially attorney's fees under the applicable national statute — may recover more than the cost of litigation in a high-value brand-infringement matter. The analysis is case-specific.

What myth stops brand owners from filing a court action — and is it true?

The most common misconception we encounter is that a court action requires you to know the registrant's identity before filing. In fact, most anticybersquatting statutes include provisions for in rem jurisdiction against the domain name itself — meaning you can file against the domain as the defendant when the registrant's identity is unknown or the registrant cannot be found for service. The court can then compel discovery from the registrar to identify the registrant, and personal jurisdiction over an individual respondent is not a prerequisite to obtaining a transfer order.

A related myth: "The UDRP failed, so court will too." That logic does not follow. A panel may deny a UDRP complaint because the complainant failed to meet the cumulative bad-faith test — both registration and use — even where current use is clearly infringing. A court claim under anticybersquatting legislation may succeed on a different standard. The procedural record from the UDRP — including the panel's reasoning — can itself become useful evidence in the court proceeding, documenting the registrant's conduct and the timeline of the dispute.

COGNOMEN handles both sides of domain disputes. Where a UDRP complaint was denied and the complainant is considering next steps, we assess the panel's reasoning, identify the element that failed, and advise on whether a court route addresses that gap. We also defend registrants against overreaching court actions — including cases where the underlying UDRP was itself an attempt at reverse domain name hijacking (RDNH), a finding available under the Policy when a complaint is brought in bad faith.

Related at COGNOMEN

• Court action and domain theft recovery — full service overview
• Recovering a hijacked domain under German law and the DENIC dispute entry
• New gTLD launch protection — analysis of registration strategies across new zones

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.