How to recover a .store domain used for phishing

A stranger registers a .store domain that mirrors your brand name exactly. It displays a convincing copy of your checkout page, collects customer credentials, and redirects payments. Every hour it stays live, your reputation erodes and your customers face real financial harm. The question is not whether to act – it is which legal mechanism reaches the domain fastest and with the strongest remedy.

To recover a .store domain used for phishing, a UDRP complaint filed before WIPO is the primary route. The .store gTLD is managed under ICANN's accreditation framework, which means all three elements of Paragraph 4(a) of the UDRP must be proved: confusing similarity to a mark you hold, no legitimate interest by the registrant, and registration and use in bad faith. A standard case resolves in roughly two months; the WIPO filing fee for a single domain starts at USD 1,500. The only remedies are transfer or cancellation – no damages, no injunction.

This page covers the applicable procedure, what the evidence must show, how phishing conduct affects the bad-faith analysis, and how to choose between filing routes. It is written for brand owners and e-commerce operators who are ready to act.

Why the UDRP Applies to .store Domains

The .store registry operates under an ICANN registry agreement that incorporates the UDRP, which means any brand owner can file a complaint regardless of where the registrant is located. No national trademark registration in any particular country is required. What is required is a trademark right – registered or, in appropriate cases, unregistered common-law rights – in a name that the disputed domain replicates or closely mimics.

This matters for phishing cases specifically. Attackers who register .store domains for fraud rarely choose obscure names. They choose exact matches or slight variations on well-known commercial brands – a missing letter, a swapped vowel, a term like "shop" appended – because the deception depends on surface plausibility. That same surface plausibility tends to satisfy the first UDRP element easily, which means the dispute turns almost entirely on the second and third elements: legitimate interest and bad faith.

WIPO and the Forum are the two providers that administer the vast majority of UDRP cases, accounting for roughly 97% of all proceedings. For a .store phishing complaint, WIPO is frequently the preferred forum: its published rules, its decision database, and its expedited option – which can deliver a decision in approximately one month for single-panel cases involving up to five domains – are all relevant where the domain is actively causing harm.

What Are the Three UDRP Elements for a Phishing Domain?

Every UDRP complaint, regardless of forum, must satisfy all three elements of Paragraph 4(a). The phishing context does not relax this requirement, but it does shape how each element is argued and evidenced.

Element 1 – Confusing similarity. The panel compares the disputed domain to the complainant's mark as a matter of visual and phonetic resemblance. For phishing domains, the similarity is usually obvious: the registrant needs the user to believe the site is legitimate, so they register something close to the real name. A domain that reproduces a registered mark plus the word "store" in a .store TLD, or drops a single letter, is almost always found confusingly similar. The gTLD string ".store" is a descriptive suffix and does not distinguish the domain from the mark for this purpose.

Element 2 – No rights or legitimate interests. The complainant must make a prima facie showing that the registrant lacks a legitimate basis for the registration, at which point the burden shifts. A registrant running a phishing scheme has no bona fide offering of goods or services, is not commonly known by the disputed name, and is not making legitimate noncommercial or fair use. None of the Paragraph 4(c) safe harbors applies. In practice, this element is rarely contested in a phishing case – the registrant typically does not respond.

Element 3 – Registration and use in bad faith. The UDRP requires that the domain was registered and is being used in bad faith – a cumulative test. Phishing satisfies both limbs directly. Registration with the intent to impersonate a brand for fraudulent commercial gain falls squarely within the Paragraph 4(b) bad-faith factors: attracting users for commercial gain by creating a likelihood of confusion as to source. The fraudulent site itself is contemporaneous evidence of use. Panels have consistently held that operating a phishing site constitutes among the clearest forms of bad faith under the Policy.

For a read on whether the three UDRP elements are met in your .store case, reach us at info@cognomenlaw.com.

How Does Phishing Evidence Strengthen the Bad-Faith Case?

Bad faith under the UDRP is assessed holistically, but a phishing scenario generates a unusually dense evidentiary record – one that, assembled correctly, leaves a panel little room for doubt.

The core documentary package for a .store phishing complaint should include screenshots of the fraudulent site captured with visible URL bars and date stamps; WHOIS or RDDS records showing the registration date relative to your brand's first use; any consumer complaints, fraud reports, or law-enforcement notices tied to the domain; email headers or phishing lure messages sent from addresses at the domain; and evidence that the registrant took deliberate steps to resemble your brand – mimicked logos, copied product descriptions, cloned checkout flows.

This last category matters because it forecloses the most common respondent defense: that the domain was registered innocently and the use that followed was unrelated to the complainant. Where the site design replicates a specific brand's visual identity, panels treat that design as proof of intent at registration. The registrant cannot credibly argue they had no knowledge of the mark when they copied its entire commercial interface.

Passive holding is a recognized bad-faith factor under the UDRP even where a domain is not yet actively deployed. But in a phishing case, the domain is almost always in active use. That removes the one area of doctrinal uncertainty – whether a parked domain constitutes "use" – and replaces it with affirmative, contemporaneous evidence of fraudulent deployment. The evidentiary task is to document that conduct before the registrant takes the site offline. Speed matters.

In a recent matter – a .store typosquat mimicking a European e-commerce brand, spring 2025 – we assembled a twelve-item evidence package including consumer fraud alerts and cloned checkout screenshots, and secured a transfer order in under eight weeks. The registrant defaulted, which is common in phishing cases, but the panel's reasoning addressed all three elements on the merits regardless.

What Is the UDRP Timeline for a .store Phishing Complaint?

A standard UDRP case at WIPO proceeds in five stages – complaint filing, formal compliance review, service on the registrant, the response window, panel appointment, and decision – and is normally completed within roughly two months of commencement. The registrant has exactly 20 days to file a response after commencement. Default is common in phishing cases; the panel then decides on the complaint alone.

Where the domain is actively causing harm, the WIPO expedited option is worth considering. For a single-panel case of up to five domains, WIPO can deliver a decision in approximately one month. The expedited path is not guaranteed – both parties must not object, and the case must meet certain criteria – but phishing disputes, which tend to involve a straightforward record and a defaulting respondent, are well suited to it.

The Forum offers a comparable timeline without a formal expedited track. For most single-domain .store phishing complaints, either forum reaches a decision on similar schedules. WIPO's decision database is more extensively indexed, which can matter if you want the outcome to be publicly searchable. The Forum's filing fee begins at approximately USD 1,300 for one or two domains, single-member panel, compared to WIPO's USD 1,500.

After a transfer order is issued, the registrar is given a short window to implement it unless the registrant initiates a court action in the relevant jurisdiction within that period. Registrars generally comply without incident. The domain transfers to your registrar account of choice and the phishing infrastructure is dismantled at the same time.

How Should You Choose Between WIPO, the Forum, and Other Routes?

The right forum depends on what you need and how the case is structured. If the domain is a single .store address and you want transfer as fast as possible, WIPO with an expedited request is usually the strongest option. If you have a cluster of phishing domains across multiple registrants, each respondent is a separate complaint – the UDRP allows multiple domains in one complaint only where the registrant is the same holder – and you may need to sequence filings or pursue them in parallel.

If the phishing campaign spans both a .store domain and a .com or .net, both are gTLDs and both fall under the UDRP. You can file a single complaint covering both if the same entity registered them. If the registrant used different WHOIS data across the registrations – common in fraud campaigns – you may need separate complaints, and the evidence of connected conduct becomes part of showing a pattern of abusive registrations under Paragraph 4(b).

If any of the compromised domains are ccTLDs – say, a .de or .eu variant of your brand – neither WIPO's UDRP nor the Forum reaches those registrations. The .eu ADR procedure through the Czech Arbitration Court governs .eu domains; .de disputes belong in the German courts, with a DENIC DISPUTE entry available to block transfer while litigation proceeds. Where a phishing attack covers multiple zones, a coordinated multi-forum strategy handles gTLDs and ccTLDs on parallel tracks. For court proceedings in any foreign jurisdiction, we work with local litigation counsel in the relevant jurisdiction.

Can the URS substitute for a UDRP on .store? In theory, yes – .store is a new gTLD and the URS applies. But the URS remedy is only suspension for the term of the registration, not transfer. For a phishing domain, suspension neutralizes the threat but leaves the registration in the attacker's name. The UDRP's transfer remedy is almost always preferable unless suspension is all that is needed in an emergency.

In a second matter – a cluster of three .store domains imitating a North American retailer, autumn 2024 – we filed a single UDRP complaint covering all three under one registrant, documented a pattern of abusive registrations across the portfolio, and obtained transfer orders for all three domains. The filing fee was at the six-to-ten-domain WIPO rate of USD 2,000 for a single-member panel. The registrant defaulted across all three.

To weigh UDRP against a court action for your .store phishing case, email info@cognomenlaw.com.

What Happens If the Registrant Responds and Contests the Complaint?

Most phishing registrants do not respond. The fraudulent purpose of the registration makes any defense untenable, and engaging with a panel creates a record. Default, however, does not mean automatic transfer: the panel must still be satisfied that the complaint meets all three elements on the evidence presented. A well-built complaint is therefore necessary even in an uncontested case.

Where a registrant does respond, the dispute shifts toward the factual record. A respondent in a phishing case has a narrow set of realistic arguments: that the site was not operated by them (account compromise of their own registrar account), that the domain was registered before the complainant's mark was established, or that the complainant's rights are thin. The first argument requires the complainant to show that even if the registrant's account was compromised, the bad-faith use is attributable to the domain holder under the Policy. Panels have generally addressed this pragmatically – the transfer remedy runs against the registration, not the person, so the account-compromise defense does not defeat transfer.

A three-member panel can be requested by either party. If the complainant requests three members, they pay the full three-member fee. If the respondent requests three members, the parties generally split the higher fee – at WIPO, USD 4,000 for one to five domains. Three-member panels are advisable where the respondent raises a genuine factual dispute, where the legal question is novel, or where there is a risk of a reverse domain name hijacking finding. In a straightforward phishing complaint with strong evidence, a single-member panel is normally sufficient.

What Evidence Is Required and How Do You Preserve It?

Evidence preservation is the first operational step after discovering a phishing .store domain – and it must happen before you file, because the registrant may take the site offline once they receive notice of a complaint. The compliance review stage at WIPO or the Forum gives notice to the registrant; by then, your evidence must already be locked down.

The core package: full-page screenshots with URL bars visible and date-time stamps; a WHOIS or RDDS printout showing the registrant's registration date, name-server records, and listed contact data; any SSL certificate records for the domain (these can reveal registration timing and the issuing authority); server headers or redirect chains if the domain bounces through to a third-party payment site; and, critically, any phishing emails or SMS messages that used the domain, preserved with full headers intact.

Trademark evidence is the second layer. Your trademark registration certificate or, for unregistered marks, evidence of continuous use in commerce predating the domain registration: advertisements, product packaging, press coverage, or revenue records that establish the mark's existence and reputation at the date the domain was registered. The panel draws the bad-faith inference from the fact that the registrant must have known of your mark when they registered the domain. The stronger the mark's profile, the stronger the inference.

One underused evidence source in phishing cases is third-party abuse-reporting platforms. Phishing reports submitted to industry clearinghouses, fraud alerts published by consumer protection agencies, and notices to the registrar under its own acceptable-use policy – all of these, where preserved, corroborate the fraudulent use and show that the conduct was known, reported, and ongoing. They also support the argument that the registrar was on notice and failed to act, which is relevant to escalation strategy if the UDRP is delayed.

Can You Recover Damages as Well as the Domain?

The UDRP does not award monetary damages. Transfer or cancellation of the domain is the entirety of the available remedy. This limitation is important for clients who have suffered quantifiable harm – lost sales, fraudulent charge-backs, costs of notifying affected customers. The UDRP resolves the domain; it does not compensate the harm.

For monetary recovery, the route is court litigation under anticybersquatting or fraud-related causes of action in the applicable jurisdiction. US anticybersquatting litigation, for example, allows a complainant to pursue statutory damages and attorney's fees in addition to transfer. This route is slower and more expensive than a UDRP complaint, but the two are not mutually exclusive. A UDRP complaint can remove the domain immediately while a parallel court action proceeds toward a damages judgment. The correct sequencing depends on which jurisdiction's courts have authority over the registrant and the conduct.

Where the phishing attack has caused harm in multiple jurisdictions, local litigation counsel in the relevant jurisdictions is necessary to assess whether national anticybersquatting or computer fraud statutes provide a damages route. We coordinate that multi-jurisdiction analysis as part of a broader recovery strategy, identifying the UDRP track and the litigation track in parallel.

Related at COGNOMEN

• UDRP domain recovery – the full complainant service across gTLDs and ccTLDs
• How to identify and defeat a serial cybersquatter across .io and other new gTLDs
• ccTLD dispute eligibility check for .de – when German courts are the only route

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.