You can either buy the .com or not worry about it.

By starting your company with a .st domain, you were making an implied statement that you weren't concerned with being mistaken for the .com version of your site. You were always going to leak a substantial portion of your traffic to urlist.com because that's the first thing anybody would think to type in to their browser when they heard your name. That's the world you set up for yourself.

Until this guy wrote you, you were (presumably) perfectly happy with that situation. Why then is it a concern today? That is, why is it suddenly worrying you that you don't control urlist.com, when it was never your intention to control it?