TL;DR: String Reveal Day will expose applied-for gTLD strings, applicants and contention sets, according to MarkMonitor, turning brand protection into a time-bound rights review rather than a passive watchlist. The practical test is whether legal, security and brand teams can act before launch windows narrow.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on MarkMonitor's report: String Reveal Day turns gTLD applications into actionable brand and rights-protection intelligence for trademark owners.
Why it matters: Brand, legal, domain and security teams need a repeatable way to evaluate confusingly similar strings before delegation, launch and impersonation risk narrow their options.
Context
ICANN's gTLD application process creates a temporary governance gap between what applicants seek and what rights holders can verify. The reveal stage closes part of that gap by surfacing the applied-for strings, applicants, variants and contention sets that matter to brand owners.
For organisations that manage trademarks, domains and customer trust, the issue is not the existence of more strings. The issue is how quickly they can separate harmless applications from names that may affect brand enforcement, registration strategy or impersonation exposure.
Key questions
Q: What signs suggest a new gTLD string should be escalated?
A: Escalate a new gTLD string when it is identical or confusingly similar to a core mark, resembles a product or support channel, or appears to fit a suspicious business model. The most important signals are likely customer confusion, impersonation potential, competitor encroachment and any naming pattern that could support phishing or fake support activity.
Q: Why does a confusingly similar domain string create brand risk?
A: A confusingly similar domain string creates brand risk because it can impersonate a trusted name, divert traffic, and support phishing or fraud through lookalike registration. The main controls are domain portfolio monitoring, abuse detection, registrar blocking, and rapid takedown or recovery processes. Trademark review also helps identify names likely to confuse users or employees.
Q: How does the Trademark Clearinghouse support new gTLD monitoring?
A: The Trademark Clearinghouse supports new gTLD monitoring by giving trademark holders a central record used for claims notices and sunrise eligibility. When a matching string is registered, it can trigger notification so the rights holder can review misuse, confusion, or potential infringement. It is a monitoring and notice mechanism, not a full enforcement service.
Q: What is the best way to organise cross-functional domain review?
A: The best way to organise cross-functional domain review is to use a single approval workflow that includes legal, brand, security, and DNS or infrastructure owners. That review should check trademark exposure, spoofing risk, delegation changes, registrar access, renewal status, and dispute handling. Clear ownership and a documented escalation path prevent unreviewed registrations and conflicting decisions.
Technical breakdown
How gTLD contention sets shape rights decisions
A gTLD contention set is the group of applications that cannot all proceed as filed because they target the same or confusingly similar string. That matters because the reveal stage does not just show names, it shows where applicants may later switch to eligible replacement strings or enter dispute processes. Brand teams therefore need to treat contention as a moving target, not a static list. The technical and legal question is whether the confirmed string still creates confusion, competition or trust exposure after ICANN's later confirmation step.
Practical implication: Track each high-risk string through confirmation, replacement and objection windows instead of treating the first disclosure as final.
Why the Trademark Clearinghouse is a notification layer, not a veto
The Trademark Clearinghouse is a validated rights database that supports pre-launch notifications, priority access in eligible cases and alerts when matching names are registered. It does not block every application, and it does not automatically stop a harmful string from moving forward. Its value comes from accurate trademark data and a defined internal triage process. Without that workflow, alerts create noise instead of decisions, especially when the namespace contains many near matches and only a small number justify action.
Practical implication: Use TMCH coverage as an intake mechanism and pair it with a clear triage path for monitoring, objection or no action.
Why customer trust teams belong in string review
Brand risk in the gTLD space is not only a trademark question. An applied-for string can also create phishing, impersonation, fake support or customer-authentication exposure if it resembles a brand, a service category or a regulated activity. That is why review should include cybersecurity and fraud perspectives alongside legal and marketing. The relevant test is not whether a term is legally objectionable alone, but whether it could change the way customers interpret a domain, a login flow or a support channel. See the Brand Impersonation and Lookalike Domain Takedown Playbook.
Practical implication: Bring fraud and security reviewers into the assessment so potential impersonation paths are identified before launch decisions harden.
Threat narrative
Attacker objective: Exploit brand recognition in newly delegated or soon-to-be-delegated names to mislead users and capture trust, traffic or credentials.
- Entry occurs when a confusingly similar gTLD string reaches public visibility and gives an attacker or opportunistic registrant a credible basis for lookalike domain creation.
- Escalation follows when the new namespace is used to register domains that resemble a brand, product or support channel closely enough to attract user trust.
- Impact occurs when that resemblance is used for phishing, impersonation, fake support or customer redirection against the brand's audience.
Breaches seen in the wild
- Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
- Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
String reveal is a governance event, not a filing update. The important shift is that rights holders move from speculation to evidence once applicants, variants and contention sets are public. That changes the decision model from broad watching to selective action, because teams can test whether a string creates legal, commercial or trust exposure before launch pressure builds. Practitioners should treat the reveal as the moment to rank risks, not to close them.
Namespace visibility creates a new impersonation planning window. Once applied-for strings are public, the brand problem is no longer only defensive registration. A visible string can signal where phishers, lookalike registrants or support impersonators may aim first, especially when the string resembles a brand or service category. That makes domain governance, fraud review and customer-trust assessment part of the same control conversation. Lookalike domain takedown remains relevant when those signals turn into active abuse.
The Trademark Clearinghouse works only when alerting is operationalised. TMCH coverage is useful only if the organisation knows who receives notifications, who evaluates them and what outcomes are acceptable. Otherwise, the alert stream becomes another unmanaged queue. The deeper issue is governance maturity: rights validation is necessary, but decision ownership is what turns validated rights into timely action. Practitioners should connect TMCH alerts to a defined internal workflow, not a loose inbox.
String review belongs inside broader digital risk governance. MarkMonitor's framing shows that brand protection, domain strategy and cybersecurity now intersect at the namespace layer. A string can influence registration policy, customer confusion and impersonation risk at the same time, which means siloed review will miss material exposure. Organisations should align legal, brand, digital and security stakeholders around one decision path for high-risk terms, with clear escalation authority.
What this signals
Reveal-stage governance is the real control point. Once namespace candidates are public, the organisation's challenge is no longer discovery but prioritisation. The teams that prepare a named decision path for high-risk strings can respond calmly, while others will end up making brand and security calls under compressed timelines.
Namespace visibility also changes the fraud surface. A public string list can reveal where lookalike registrations, fake support sites and customer-trust abuse are most likely to appear. Security and brand teams should therefore assess the naming layer as part of impersonation defence, not only as a legal or DNS matter.
For practitioners
- Define the review universe List the trademarks, product names, brand names and priority terms that will be checked against the revealed strings.
- Assign decision owners early Name the internal reviewers and external advisors who will assess applications, recommend action and approve time-sensitive responses.
- Set escalation thresholds Predefine when a string triggers monitoring, defensive registration, formal objection or no action so decisions stay consistent under deadline pressure.
- Validate TMCH coverage and routing Check that key trademarks are in the Trademark Clearinghouse, that the records are accurate and that notification recipients are current.
- Add security review to brand triage Bring cybersecurity and fraud teams into the process so phishing, impersonation and fake support use cases are evaluated alongside legal risk.
Key takeaways
- Public string disclosure changes brand protection from speculation to evidence-based triage.
- The biggest risk is not every application, but the small set that can affect trust, trademark rights or customer journeys.
- Organisations that predefine reviewers, escalation thresholds and TMCH routing will make better decisions under ICANN timelines.
Related NHI Mgmt Group resources: Brand Impersonation and Lookalike Domain Takedown Playbook · Corporate Domain Registrar · Domain Without Email
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63C — Federation | Trademark notifications and registrant trust depend on federated identity and domain trust signals in the namespace. |
| Recommendation — Review how trusted naming and federation signals shape user trust before allowing brand-adjacent registrations. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Rights protection depends on controlling who can register, claim or validate brand-adjacent names. |
| Recommendation — Apply entitlement governance to domain portfolios and approval workflows for high-risk registrations. | ||
| CIS Controls v8 | CIS-5 — Account Management | Domain and TMCH workflows need clear ownership and account control to avoid missed responses. |
| Recommendation — Assign and review account ownership for domain, registry and notification workflows on a fixed schedule. | ||
| MITRE ATT&CK | TA0001; TA0006 — Initial Access; Credential Access | Lookalike domains are often used to gain initial trust and capture credentials through impersonation. |
| Recommendation — Map lookalike-domain abuse to Initial Access and Credential Access to prioritise detection and takedown. | ||
| GDPR | Art.32 — Security of Processing | Brand impersonation can expose personal data through phishing and fraudulent customer journeys. |
| Recommendation — Assess whether new namespace risks could undermine security of processing for customer data. | ||
Key terms
- gTLD: A gTLD is a generic top-level domain, the part of a domain name that appears after the final dot, such as a common suffix used across many registrants. In DNS, gTLDs are managed under registry rules and can be open or restricted, which affects registration, policy control, and domain governance.
- Contention Set: A contention set is a group of domain or registry applications that cannot all succeed at the same time because they target the same name or mutually exclusive strings. In domain programme processes, the competing applications must be resolved by withdrawal, agreement, auction, or other assignment method before one can proceed.
- Legal Rights Objection: A Legal Rights Objection is a formal challenge to a new domain application based on prior legal rights, usually a trademark or similar protected mark. It is used in domain name dispute processes to argue that the applied-for string would infringe or unfairly exploit an existing right, and a panel decides whether the objection succeeds.
- Trademark Clearinghouse: The Trademark Clearinghouse is a central rights database used in domain name registration and brand protection programmes. Trademark holders submit validated marks to support sunrise registrations and to receive notices when matching or confusingly similar domains are registered under participating top-level domains.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps practitioners connect identity controls to the wider security decisions their programmes depend on.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org