How to bring a court action when UDRP cannot reach a .store domain

How to bring a court action when UDRP cannot reach a .store domain. UDRP and ccTLD domain recovery and defense across .store. Email the firm to assess your cas…

A retail brand discovers its exact trademark registered as a .store domain. The registrant is anonymous, the site redirects to a competitor, and a five-figure buy-back demand arrives by email. The UDRP is available for .store, yet there are situations where arbitration simply cannot do what the brand owner needs. Monetary damages, injunctive relief, a judgment that runs globally, or evidence that the domain was hijacked rather than registered by a stranger — these are the moments when a court route becomes the right instrument.

To bring a court action when UDRP cannot reach a .store domain, a brand owner must identify the applicable national law — most commonly US anticybersquatting litigation or the jurisdiction governing the registrant — secure a registrar lock to freeze the domain during litigation, and build an evidence record showing abusive registration or theft. The UDRP at WIPO offers a faster and lower-cost path for straightforward transfer, with a filing fee starting at USD 1,500 for a single-member panel, but it awards no monetary damages and no injunction. Court action fills that gap.

This page covers when to bypass or supplement the UDRP, how the court route works for .store domains, what evidence decides the outcome, and what a realistic engagement looks like.

What dispute rules govern .store, and where does the UDRP fall short?

The .store registry operates under ICANN's accreditation framework, which means the UDRP applies to all .store domains through the standard provider network — WIPO, the Forum, CAC, and ADNDRC. That is the baseline. For the large majority of straightforward cybersquatting cases, a UDRP complaint filed at WIPO produces a transfer or cancellation order within roughly two months, at a total forum cost well below any court filing fee. The three elements of Paragraph 4(a) — confusing similarity to a mark, absence of legitimate interest, and bad-faith registration and use — are the same for .store as for .com.

So where does UDRP fall short? Four situations recur in our practice. First, the domain was not registered by a third party but was transferred away from the brand owner's own account — a theft scenario where the registrant of record was once the brand owner itself. The UDRP is designed to resolve disputes between a trademark holder and an independent registrant; it is not designed to reverse a fraudulent account transfer. Second, the brand owner wants damages, not merely a domain name back. UDRP panels have no authority to award money. Third, the registrant's conduct is part of a coordinated campaign — phishing, invoice fraud, supply-chain impersonation — and a court injunction against that conduct is needed alongside any domain transfer. Fourth, the evidence of abusive intent is disputed in a way that requires discovery; UDRP proceedings have no document production mechanism.

Recognizing which category applies is the first decision a brand owner facing a .store dispute must make. We regularly advise clients at precisely this fork.

For an assessment of whether your .store domain situation calls for UDRP, court action, or both, contact info@cognomenlaw.com.

How does the registrar-lock and transfer-reversal process work for .store?

When a .store domain is transferred without authorization — through phishing the registrant's credentials, exploiting a registrar support vulnerability, or social engineering — the immediate priority is not a complaint but a freeze. A registrar lock prevents the domain from being transferred again, deleted, or pointed to a new nameserver while the underlying dispute is resolved.

The mechanics follow a standard escalation sequence. The brand owner, or counsel on their behalf, contacts the current registrar of record for the .store domain and submits a documented theft or unauthorized-transfer claim. The registrar is obligated under ICANN's transfer policies to investigate and, in clear cases of fraud, to lock the domain and even reverse the transfer within a defined window. That window is narrow. Missing it often means the domain moves to a second registrar, complicating recovery substantially.

Where the registrar refuses to act, or where the domain has already moved to a second or third registrar, the brand owner needs an emergency court order — a temporary restraining order or its equivalent in the relevant jurisdiction — directing the current registrar to lock the domain pending full proceedings. This is where court action is not merely preferable but necessary. The UDRP has no mechanism to issue interim relief of this kind. No panel can order a registrar to freeze a domain before the case is decided.

In a recent matter involving a .store domain hijacked through a compromised registrar account (spring 2025), we coordinated the registrar escalation, documented the account compromise with login-history records and email headers, and pursued transfer reversal — recovering the domain before a formal complaint was required. The speed of the lock request was the decisive factor.

Evidence of compromise matters at every stage. The documentation that supports a registrar escalation is the same documentation that supports an emergency court application: timestamps of unauthorized login activity, outbound transfer confirmation emails the legitimate owner never sent, WHOIS change records, and any communications from the person now listed as registrant.

When does a court action beat UDRP for a .store domain?

The decision matrix is straightforward once the facts are on the table. Consider two situations.

Situation A: a third party registered a .store domain that closely mirrors a registered trademark, built a fake retail storefront, and is diverting the brand's customers. The UDRP is the right first route. All three Paragraph 4(a) elements are likely met, the forum filing fee at WIPO starts at USD 1,500, and a transfer order arrives within roughly two months. No court is needed unless the registrant defaults on the UDRP transfer order — which rarely happens once the registrar implements it.

Situation B: the same .store domain was originally registered by the brand owner, then transferred out of its account through credential theft. The current registrant of record is a stranger in a foreign jurisdiction. The brand owner wants the domain returned and wants to stop the phishing campaign the registrant is running under the brand. UDRP cannot reverse a theft, cannot award an injunction, and has no discovery mechanism to expose the registrant's infrastructure. A court action — most likely US anticybersquatting litigation if the registrant can be served or if a US registrar holds the domain — is the route that reaches all three goals.

Situation C sits between them: a .store domain was registered by a third party, the UDRP complaint was filed, and the panel denied it — perhaps because the evidence of bad faith was thin or because the registrant presented a plausible fair-use argument. A court action in the relevant jurisdiction can revisit the same facts under a different evidentiary standard and with the benefit of discovery that was unavailable to the panel. This is not relitigating a UDRP result for its own sake; it is using the right instrument for a fact pattern the arbitral process could not resolve.

One further dimension: if the brand owner also operates a .com and the same registrant holds both, a coordinated filing — UDRP for the .com, court action for the stolen .store — can run simultaneously. The two proceedings do not block each other. We have managed parallel filings across zones where the urgency of the .store theft required emergency court relief while the UDRP resolved the .com on the standard timeline.

To weigh UDRP against a court action for your .store case, email info@cognomenlaw.com.

What evidence decides the outcome in .store court proceedings?

Court proceedings for .store domain disputes turn on a different evidence profile than UDRP cases. The legal standard is higher, discovery is available, and the fact-finder evaluates credibility — not just documents.

For anticybersquatting litigation in the US, the core evidence typically covers: (1) proof of trademark rights — registration certificates, evidence of use in commerce, and the dates those rights were established relative to the domain registration; (2) proof of the registrant's bad-faith intent — the buy-back demand, the redirected traffic, the fake storefront, any prior pattern of abusive registrations; (3) proof of the connection between the domain and the harm — diverted sales, consumer confusion, phishing victims, or brand damage metrics; and (4) for hijacking cases specifically, the forensic record of the account compromise — login records, IP addresses, authentication logs, and registrar communications.

What panels consistently find persuasive in cybersquatting cases — and courts echo this reasoning — is a pattern. A single domain registration is one data point. A registrant who holds multiple domains incorporating third-party marks, who listed a false address in the registration record, and who responded to takedown demands with escalating price quotes presents a pattern. Courts can subpoena registrar records that UDRP panels cannot compel. That documentary layer can transform a thin bad-faith record into a strong one.

For hijacking cases, the forensic chain is the case. A brand owner who can show that the registrar received an unauthorized transfer request from an IP address never associated with the legitimate account, that the registrant's contact information was changed within hours of the transfer, and that the domain was pointed to a phishing kit within days of the transfer has strong evidence that no reasonable court will ignore.

We work with forensic specialists and local litigation counsel in the relevant jurisdiction to build this record before filing. The pre-litigation investigation phase is not optional; it is the phase that determines whether the case is worth bringing.

How does UDRP at WIPO compare to court action for .store: a practical guide to choosing

Every brand owner facing a .store dispute asks the same threshold question: which route is faster and cheaper? The honest answer depends entirely on the goal.

If the goal is transfer of a cybersquatted .store domain registered by a third party, UDRP wins on cost and speed. The WIPO filing fee is USD 1,500 for a single-member panel covering up to five domains. A standard case resolves in about two months. Legal fees for a straightforward complaint are a fraction of court costs. The trade-off is the ceiling: transfer or cancellation is the only available outcome, and the panel cannot order the registrant to pay anything or stop any other conduct.

If the goal includes monetary relief, an injunction, discovery, or recovery of a domain from a hijacker who is the current registrant of record, the court route is the only instrument that reaches the goal. It is slower — court proceedings in most jurisdictions take months to years — and substantially more expensive on a per-hour basis. But for a brand whose .store domain is the anchor of its e-commerce operation, the value of recovering it through any available route justifies that investment.

There is a third path that is often underused: filing the UDRP first to establish the bad-faith record, allowing the panel's written decision to serve as documentary evidence in subsequent court proceedings if the UDRP is denied or if supplemental relief is needed. A detailed panel decision — even one that results in a "no" on the current evidence — can narrow the contested issues considerably in later litigation.

The cross-zone dimension matters here too. A brand that holds a .com and a .store under the same trademark faces a registrant who may hold both. UDRP at WIPO can cover both in a single complaint if the same registrant holds both domains. If the .store was hijacked while the .com was separately cybersquatted, the two problems require two solutions running in parallel.

In a second matter — a .store cybersquatting case in autumn 2024 — a brand owner had already lost a UDRP round because the registrant's defense built a colorable fair-use argument. We coordinated with local litigation counsel in the relevant US jurisdiction, pursued discovery that exposed the registrant's prior pattern of similar registrations across other zones, and the case settled on terms favorable to the brand owner before trial. No invented case number exists here; the point is the method.

What is the cost structure for court action versus UDRP on a .store domain?

Cost transparency matters. This firm publishes its approach because hidden pricing wastes everyone's time.

For a UDRP complaint at WIPO covering a single .store domain, the forum filing fee is USD 1,500 for a single-member panel. Legal fees for a straightforward complaint typically fall in the USD 3,000–7,000 range on a flat-fee basis, separate from the forum fee. A three-member panel at WIPO costs USD 4,000 in forum fees; legal fees scale with complexity.

Court action costs are substantially higher and depend on the jurisdiction, the complexity of the facts, and whether the matter settles before trial. The preparation phase alone — pre-litigation investigation, forensic analysis, registrar escalation, and drafting of emergency filings — represents meaningful legal investment. Court proceedings in the US or in the registrant's home jurisdiction are handled through local litigation counsel in the relevant jurisdiction, and we coordinate that process from the initial assessment through to resolution.

The decision framework is therefore: assess the goal, assess the value of the domain to the business, assess the quality of the evidence, and choose the instrument proportionate to the stakes. A .store domain that is the brand's primary retail channel has a different calculus than a defensive registration in a secondary zone.

Registrar escalation for domain theft — before any formal proceeding — is a separate, earlier-stage cost. Prompt action here can avoid the need for emergency court relief entirely, which represents meaningful savings. We advise on the registrar escalation first, before recommending any formal filing.

What are the respondent-side and defensive implications for .store registrants?

Not every .store dispute involves a cybersquatter on one side and a brand owner on the other. Legitimate domain registrants — investors who registered a .store domain years before a complainant's trademark was established, businesses operating under a name that later collided with a larger brand's expansion, or individuals with a genuine claim to the term — face UDRP complaints that may be filed without merit.

When a UDRP complaint is brought in bad faith to deprive a legitimate registrant of a domain they hold with a genuine interest, the panel may find Reverse Domain Name Hijacking (RDNH). An RDNH finding carries no monetary penalty, but it is a published reputational sanction against the complainant. Panels have consistently required a showing that the complaint was brought with knowledge that it would fail, or that the complainant used the UDRP as a tool to deprive a legitimate registrant rather than to vindicate a genuine trademark right.

For a .store registrant who receives a UDRP complaint and believes it is overreaching, the 20-day response window is the operational deadline. Missing it results in a default decision almost always favoring the complainant. The response must establish at least one Paragraph 4(c) safe harbor — bona fide use before notice of the dispute, commonly known by the name, or legitimate noncommercial or fair use — and challenge the complainant's evidence of bad faith.

If the complainant's conduct has moved beyond the UDRP to direct court threats or a court filing, the registrant's defense in court requires the same evidentiary record — proof of the legitimate registration, chain of title, use history, and any evidence that the complainant's trademark rights postdate the registration. We build that record from the start, because a UDRP defense and a court defense draw on the same documents.

Related at COGNOMEN

• Court action and domain theft recovery — the full service overview across zones and forums
• Recovering a hijacked domain under the .au framework — evidence, process, and lessons
• Reversing an unauthorized domain transfer in the .es zone — mechanics and court options