What signs suggest a new gTLD string should be escalated?

What should trigger escalation for a new gTLD string?

A new gTLD string should move up for review when it creates a realistic path to confusion, impersonation or brand abuse. The key question is whether the string could mislead users, imitate an established business or support a scam pattern such as fake support, phishing or competitor targeting.

Escalation is not just about exact trademark overlap. A string can still be risky if it sounds like a product family, a help desk, a login destination or another trust signal that users may act on without checking the full domain.

Which naming patterns are most concerning?

The strongest signal is similarity to a core mark, but practitioners should also look for strings that borrow the shape of an existing service name, support channel or regulated brand. A string that appears generic on paper may still be dangerous if it sits close to a known customer journey or if it can be combined with ordinary labels to create convincing impersonation.

Business-model suspicion matters too. Escalate strings that look designed to collect lookalike registrations, support abuse, counterfeit storefronts or other confusing uses rather than a legitimate namespace purpose. That is especially true when the naming pattern seems optimised for trust abuse rather than for clear, distinct identity.

What does a good escalation review need to test?

Reviewers should test how the string would look in real use, not only whether it is technically available. Ask whether a customer could mistake it for the brand, whether the string could be paired with common terms to create a believable login or support destination, and whether the pattern would be attractive to impersonators or affiliate-style abuse.

It also helps to compare the string against adjacent products, sub-brands and support terminology, because confusion often comes from context rather than exact spelling. The more the string depends on consumer recognition or trust to function, the more carefully it should be escalated.

Risk and Threat Considerations

A problematic gTLD string can create both brand risk and direct abuse risk. If it is confusingly similar to a trusted mark or support term, attackers can use it to increase click-through on phishing pages, fake help desks or impersonation campaigns. It can also enable competitor encroachment, where the string is used to siphon traffic or dilute recognition.

Failure mechanism: Users rely on the trust implied by the string, then accept a deceptive registration, message or support workflow as legitimate.

Impact: The result can be credential theft, customer confusion, reputational damage, support fraud and a larger attack surface for downstream domain abuse.

Practitioner Guidance

What to verify: Confirm how the string reads in common combinations, such as with support, login, billing or product terms. A string that looks harmless in isolation can become high risk once paired with labels that imply authority or urgency.

Decision rule: If the likely abuse case is impersonation, phishing or fake support, escalate even when the string is not identical to a mark. If the main concern is mere resemblance without plausible misuse, document the concern but keep the review proportionate.

Practitioner takeaway: Treat the review as an abuse-path assessment, not a spelling exercise, because the most important question is whether the string can be turned into a believable trust signal for users.

Related resources from NHI Mgmt Group

• What signs suggest an exposed appliance may already be compromised?
• What signs suggest a supply chain attack is moving faster than detection tools?
• What signs suggest DNS filtering is not working well enough?
• What signs suggest an AI system may be exposing hidden instructions?