Reporting Period
August 1, 2026 to August 31, 2026
Introduction
NiceNIC continues to publish monthly abuse handling data to provide clearer visibility into how abuse-related reports are recorded, reviewed, and handled over time.
This August 2026 report covers complaint volume, involved domains, category distribution, response timing, domain pausing activity, recovery outcomes, and source-level reporting data.
August showed a different pattern from July. The total number of recorded complaints increased, but the number of involved domains slightly decreased. This suggests that more reports were recorded across a similar domain base, instead of a simple month-over-month increase in unique domains involved.
The figures in this report should be read as operational reporting data. A complaint does not automatically mean confirmed DNS Abuse, and this report should not be interpreted as a legal finding about any registrant, website, or domain name.
NiceNIC will continue to make abuse handling data more visible through regular reporting and public transparency updates.
Methodology and Definitions
This report is based on abuse-related complaints recorded in NiceNIC’s internal handling workflow during August 2026.
A “complaint” refers to a report received and recorded during the reporting period. A single domain may receive multiple complaints, and different reports may require different review paths depending on the report type, available evidence, domain role, hosting involvement, applicable policy, or legal process.
For the purpose of ICANN contracted-party DNS Abuse obligations, DNS Abuse is generally understood to cover malware, botnets, phishing, pharming, and spam when spam is used as a delivery mechanism for those forms of DNS Abuse. Other categories in this report, including trademark, fraud, drugs, and content-related complaints, are included for transparency but may not follow the same handling path as DNS Abuse categories.
“Paused domains” refers to domains that entered a paused or comparable mitigation status during review, based on the information available at the time and the applicable handling standard.
“Recovered domains” refers to domains restored after remediation, clarification, further review, or other valid recovery conditions were met.
This report does not describe individual domain cases and should not be used to infer the status, outcome, or handling reason for any specific domain name.
Monthly Overview
During August 2026, NiceNIC recorded:
Total Complaints: 30,450
Total Domains Involved: 9,539
Average Response Time: 2.3 days
Total Paused Domains: 4,691
Pause Rate: 49.18%
Recovered Domains: 149
Recovery Rate: 3.18%
Compared with July 2026, recorded complaints increased from 23,316 to 30,450. At the same time, involved domains slightly decreased from 9,644 to 9,539.
This is the main August change. The higher complaint count did not come with a higher number of unique domains involved. This may indicate more repeated, overlapping, or multi-source reports involving a similar group of domains.
Paused domains decreased from 4,955 in July to 4,691 in August. The pause rate also moved from 51.38% to 49.18%.
A lower pause rate should not be read as reduced enforcement. It may reflect duplicate reports, evidence quality, prior actions, domain status, remediation, or cases where registrar-level mitigation was not the appropriate path.
The average response time decreased from 2.6 days in July to 2.3 days in August.
Recovered domains decreased from 178 in July to 149 in August, while the recovery rate moved from 3.59% to 3.18%.
Complaint Categories
The complaint categories recorded in August 2026 were as follows:
The August category mix was more diversified than July.
Phishing remained the largest category, but its share decreased from 54.61% in July to 46.49% in August. This means phishing still represented the largest part of the monthly workload, but it was less dominant than in the previous month.
Several other categories became more visible in August. “Other” increased from 9.44% to 14.46%. Fraud increased from 7.66% to 10.63%. Trademark increased from 3.92% to 8.07%. Malware increased from 0.81% to 3.56%.
Drug-related complaints moved in the opposite direction, decreasing from 15.27% in July to 9.61% in August.
This change in category distribution is important because different report types may require different review methods. A phishing report may involve user harm and credential theft concerns, while a trademark complaint, fraud report, drug-related allegation, or content-related complaint may require additional review before determining whether registrar-level action is appropriate.
Category Review
Phishing
Phishing remained the largest complaint category in August, with 14,156 recorded complaints, representing 46.49% of the monthly total.
Although phishing complaints increased in count compared with July, their share of the total complaint mix decreased. This shows that August was not only a phishing-heavy month. Other complaint types also took up a larger part of the overall workload.
Phishing reports continue to receive high-priority review where the evidence is complete, active, and actionable.
Other
The “Other” category recorded 4,402 complaints, or 14.46% of the August total.
This category increased in both count and share compared with July. It may include reports that do not fit neatly into the main classifications at intake, reports with incomplete categorization, or cases that require further review before a more specific classification can be assigned.
NiceNIC will continue improving classification accuracy so future reports can provide clearer category visibility.
Fraud
Fraud-related complaints reached 3,236, representing 10.63% of the August total.
This was a larger share than in July. Fraud reports often require careful review because the issue may involve website content, payment behavior, third-party services, customer disputes, impersonation, or evidence outside the domain registration layer.
Drugs
Drug-related complaints totaled 2,925, or 9.61% of all recorded complaints.
This category decreased compared with July. These reports are reviewed based on the evidence provided, the domain’s role in the reported activity, and whether registrar-level mitigation is appropriate.
Trademark
Trademark-related complaints reached 2,458, representing 8.07% of the August total.
This category increased compared with July. Trademark-related matters require careful review because not every trademark dispute qualifies as DNS Abuse. Some cases may require brand owner documentation, UDRP, URS, court process, or another appropriate legal or procedural channel.
Pharming
Pharming complaints totaled 1,998, or 6.56% of recorded complaints.
The count increased compared with July, while the percentage share slightly decreased. Because pharming may involve DNS-related redirection, user destination manipulation, or other technical indicators, these reports require evidence-based technical review.
Malware
Malware-related complaints reached 1,083, representing 3.56% of the August total.
This was a clear increase from July. Malware remains an important DNS Abuse category and may require priority review where the reported activity is active, verifiable, and connected to the domain.
Spam, Botnet, and CSAM
Spam, botnet, and CSAM reports remained lower-volume categories in August.
Spam accounted for 153 complaints, botnet accounted for 31 complaints, and CSAM accounted for 8 complaints.
Lower volume does not mean lower importance. Botnet and CSAM-related reports in particular may require careful escalation, documentation, and handling according to applicable procedures.
Response Time Analysis
The average response time in August was 2.3 days, compared with 2.6 days in July.
This means the average response time decreased while the total number of recorded complaints increased.
Response time can vary by case. Some reports can be reviewed quickly when they include active URLs, clear evidence, and a direct connection between the domain and the reported activity. Other reports may require additional checks because of duplicate submissions, inactive content, third-party hosting, reseller-managed domains, redirect chains, incomplete evidence, or disputes that require a different handling path.
NiceNIC’s goal is to keep the review process timely, evidence-based, and proportionate.
Security researchers, brand owners, hosting providers, affected users, and other reporting parties may submit abuse reports through NiceNIC's abuse reporting channel.
Paused Domains and Recovery
In August 2026, NiceNIC recorded 4,691 paused domains, representing a 49.18% pause rate.
A paused domain means that the domain entered a paused or comparable mitigation status during review, based on the information available at the time and the applicable handling standard.
The number of paused domains decreased compared with July, even though recorded complaints increased. This should be read together with the fact that involved domains also slightly decreased. It may reflect duplicate reports, overlapping reports, previous handling actions, domain status, remediation, evidence quality, or cases where registrar-level mitigation was not the appropriate path.
August also recorded 149 recovered domains, with a 3.18% recovery rate.
Recovery does not necessarily mean that the original report was incorrect. Pausing also does not necessarily mean a final determination. Recovery means that a domain completed a valid recovery path, such as remediation, cleanup, clarification, further review, or updated evidence.
A recovery process is important because abuse handling should include both mitigation and a documented path for legitimate domain holders where recovery conditions are met.
Operational and Compliance Perspective
The August data shows a different operational pattern from July.
First, complaint volume increased, but involved domains slightly decreased. This may point to more repeated or overlapping reports across a similar number of domains.
Second, phishing remained the largest category, but the overall category mix became less concentrated. Other, fraud, trademark, and malware-related reports represented a larger share of the August workload.
Third, the average response time decreased from 2.6 days to 2.3 days.
Fourth, paused domains and recovered domains both decreased compared with July. These changes should not be interpreted in isolation. They need to be considered together with report duplication, evidence quality, prior actions, domain status, remediation activity, and whether registrar-level mitigation was appropriate for each report type.
NiceNIC’s abuse handling workflow continues to focus on structured complaint intake, evidence review, complaint classification, high-risk category prioritization, domain-level mitigation where supported, outcome documentation, and recovery review where remediation or clarification is valid.
This approach is intended to support DNS abuse mitigation while also allowing fair review for legitimate registrants and resellers.
What NiceNIC Will Continue Improving
The August data highlights several areas for continued improvement.
First, phishing remains the largest category and will continue to receive high-priority review where the evidence is complete and actionable.
Second, the higher share of Other, fraud, trademark, and malware-related reports shows the need for more precise classification and careful evidence assessment.
Third, the decrease in average response time is useful, but speed alone is not the only goal. NiceNIC will continue improving workflow efficiency while avoiding unsupported or mechanical action.
Fourth, recovery review remains part of responsible abuse handling. Legitimate domain holders should have a clear path to provide remediation, clarification, or updated evidence where appropriate.
Closing Note
The August 2026 report shows higher recorded complaint volume, slightly fewer involved domains, a shorter average response time, fewer paused domains, fewer recovered domains, and a more diversified complaint mix compared with July.
NiceNIC publishes monthly abuse reports to provide a clearer view of real operational data. The purpose is not to present selective claims, but to show complaint volume, category distribution, response timing, pausing activity, and recovery outcomes in a consistent format.
Abuse handling requires timely review, evidence assessment, documentation, proportionate action, and a fair path for remediation where appropriate.
NiceNIC will continue publishing abuse reports as part of our commitment to transparency, accountability, and safer domain management.
Readers can also review NiceNIC July 2026 Abuse Report to compare monthly handling trends and category changes.
