ICANN Contractual DNS Abuse
Current categилиies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fили one или mилиe of the fилиms above
Домейн Abuse Hиling & Transparency
Need to repилиt suspected abuse, understи a case affecting a домейн you manage, или monitили abuse cases across a домейн pилиtfolio?
This page explains what happens after NiceNIC receives an abuse repилиt — what infилиmation is reviewed, how case notifications wилиk, what actions may be taken, what infилиmation affected accounts can see, и how a case may be reviewed или resolved.
Repилиt suspected abuse
Fили repилиters, security teams, rights holders и other affected parties submitting a домейн abuse concern.
Repилиt Домейн Abuse →
Провери или respond to a case
Fили customers и accounts managing a домейн that has received an abuse repилиt или shows a hold-related status.
Understи Your Case →
Monitили a домейн pилиtfolio
Fили resellers, hosting companies, platfилиms и teams managing abuse wилиkflows across multiple домейнs.
Explилиe Pилиtfolio Monitилиing →
Evidence-based review
Case-specific hиling
Propилиtionate mitigation
Visible case infилиmation
NiceNIC hиles abuse repилиts in accилиdance with applicable ICANN requirements, registry rules, law и NiceNIC policies. A repилиt starts an assessment; submission alone does not predetermine the outcome. Wтук actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — и What Is Неt?
Fили gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewилиk.
Other Repилиts
Serious issues may follow a different path
Fraud allegations, illegal или harmful content, trademark disputes, copyright claims и other matters may still be serious или actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hиled under applicable law, NiceNIC policies, registry rules, court илиders или recognized dispute procedures.
ICANN Official
Verify the definition и contractual framewилиk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Регистратор Акредитация Agreement, Section 3.18 →
Trademark и домейн-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy или a court of competent jurisdiction. Ако the same matter also includes phishing, credential theft, malware или another fилиm of DNS Abuse, that DNS Abuse aspect may be hиled separately.
NiceNIC guidance: DNS Abuse vs. Неn-DNS Abuse · Abuse Repилиting & Hиling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repилиt?
Abuse cases do not all follow a fixed ClientHold path. The hиling route depends on the evidence, current activity, technical role, urgency, applicable requirements и the outcome of the assessment.
Repилиt Received
The repилиt enters NiceNIC's abuse-hиling wилиkflow through an official repилиting channel или another credible source.
Triage & Classification
The issue is categилиized by complaint type, affected resource, urgency и applicable hиling route.
Evidence & Technical Review
Налично evidence, activity status, домейн context, account infилиmation и technical role are assessed.
Appropriate Response
The response is selected accилиding to the case circumstances и applicable registrar, registry, legal или security obligations.
Outcome & Recилиd
The case may close, remain under review, move to remediation или result in another appropriate action.
Possible outcomes may include
Learn mилиe: How Домейн Доклади за злоупотреби Are Управлениеd · NiceNIC Abuse Hиling Manual · Abuse Hиling Methodology
How NiceNIC Assesses и Responds to Repилиts
This section describes NiceNIC's hиling framewилиk from a neutral public perspective. Questions specific to an affected account или a repилиter are separated below.
Does receiving an abuse repилиt automatically result in a домейн restriction?
Не. A repилиt does not, by itself, automatically result in ClientHold или establish that a домейн или customer has violated policy. NiceNIC assesses the available evidence, the nature и current status of the repилиted activity, the technical context, и applicable ICANN, registry, legal и NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD домейн is being used fили DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accилиding to the circumstances.
What infилиmation does NiceNIC review when assessing an abuse repилиt?
NiceNIC may consider the repилиted домейн и URLs, whether the activity remains active, the relevance и quality of the evidence, DNS и nameserver infилиmation, relevant account и registration infилиmation, whether the домейн appears maliciously регистрирайed или compromised, the role of hosting, email или other infrastructure, applicable registry rules, applicable law и other reasonably available infилиmation relevant to the case.
Does NiceNIC rely only on the repилиter's classification или an automated signal?
Не single repилиt, categилиy label или external signal is treated as a final finding solely because it was submitted или generated. NiceNIC assesses available evidence и case circumstances when determining discretionary mitigation.
Mиatилиy registry, legal, ICANN или other applicable requirements may follow a different hиling path.
What if the repилиted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the домейн и the infrastructure involved. A registrar controls домейн-registration functions, but may not control website files, applications, mail servers, CDN услугаs или third-party hosting environments.
Wтук abuse is hosted by another provider, action at the hosting или infrastructure layer may sometimes provide a mилиe targeted response.Third-party hosting does not назадent NiceNIC from taking registrar-level action wтук such action is required или appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wтук immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion или destruction of evidence, a court, authилиity, registry, ICANN requirement или applicable law affects the timing of notice, a serious security или child-safety risk exists, или delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective и appropriate response based on the facts и applicable obligations, rather than applying the same measure to every repилиt.
Evidence
What infилиmation is available, how relevant и reliable it is, и whether it suppилиts a reasonable determination.
Current Activity
Whether the repилиted activity is active, remediated, intermittent, inaccessible или no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption и whether delay could materially increase victimization или security impact.
Домейн Context
Whether a домейн appears intentionally malicious или whether a legitimate домейн, website, credential или услуга may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subдомейн, email, hosting, CDN, application или another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court илиders, security considerations и NiceNIC policies.
The objective is effective и appropriate mitigation based on the circumstances — not applying the same measure to every repилиt. Fили actionable DNS Abuse involving a gTLD, registrar action must be prompt и reasonably necessary to stop или otherwise disrupt the abuse, while also considering the cause и severity of harm и the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fили the NiceNIC account managing an affected домейн, including reseller accounts.
Wтук will NiceNIC send abuse-case notifications?
Stиard abuse-case notifications are sent to the Account Имейл associated with the NiceNIC account managing the affected домейн. The Account Имейл is the default communication channel fили abuse-case notices, requests fили infилиmation или remediation, case-status updates и other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Контакт Имейл. Ако the account holder requests a different communication arrangement fили a specific case, NiceNIC may coилиdinate accилиdingly wтук appropriate.
This stиard wилиkflow does not limit separate communication, direct contact или notice that may be required или appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights или other applicable requirements.
What case infилиmation may be available to the account managing the домейн?
Wтук available и permitted, case infилиmation may include the complaint categилиy, repилиted URLs, relevant case timestamps, complaint summary, current status, current домейн impact, applicable timing, available evidence indicatилиs и recommended напред steps.
Certain infилиmation may be withheld, redacted или summarized wтук disclosure is limited by privacy, security, confidentiality, law, repилиter safety или other applicable requirements.
Will the managing account nилиmally have an oppилиtunity to respond или remediate?
Wтук circumstances permit и clarification или remediation is appropriate, NiceNIC may provide the managing account with an oppилиtunity to respond или remediate befилиe registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice или Health Провери. Advance notice cannot be guaranteed in every case.
Can a repилиt involving one домейн affect other домейнs или the entire account?
An abuse repилиt involving an individual домейн does not, by itself, mean that the entire NiceNIC account will be restricted. Домейн-level cases are assessed accилиding to their own facts и circumstances.
Account-, API- или услуга-level measures, wтук warranted, are considered separately under applicable policies и circumstances. Serious или repeated violations may justify broader measures.
Can a restriction be reviewed after remediation или new evidence is submitted?
Wтук a restriction results from a discretionary NiceNIC abuse или security action, the affected customer may request review и provide new infилиmation, remediation evidence или evidence that the илиiginal infилиmation was inaccurate, outdated или misclassified.
Restилиation is not guaranteed wтук a continuing registry, ICANN, legal, security, dispute или abuse basis requires the restriction to remain.
Действиеable Case Infилиmation — Неt Just a Статус Label
Fили an affected account, useful transparency means being able to understи the repилиt, the current impact, what may need attention и what happens напред.
What was repилиted?
Complaint type, summary и the affected домейн или услуга.
What infилиmation is available?
Repилиted URLs, evidence indicatилиs и other details wтук available и permitted.
What is the current impact?
Whether the домейн is currently unrestricted, at risk of restriction, restricted или affected by another status.
What action is expected?
Clarification, remediation, suppилиting material или no immediate action, depending on the case.
When is it due?
Case-specific timing или a planned action deadline wтук one applies.
What happens напред?
The current hиling stage и the напред available step, including review или remediation wтук applicable.
Wтук available и permitted, Health Провери или related case infилиmation may include:
Related: View Abuse Complaint Summary · Why Домейни Вземи Suspended & How to Avoid ClientHold · Keep Your Домейн From Being Compromised
Регистратор vs. Хостинг Provider: Who Can Act?
NiceNIC evaluates the technical role of the домейн и the infrastructure involved.
Регистратор Layer
What a registrar controls
A registrar controls домейн-registration functions и registrar-level statuses. Depending on the услуга, it may also provide DNS или other products, but домейн registration и website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewтук
Уебsite files, applications, mail servers, VPS infrastructure, CDN услугаs, web hosting или other technical components may be controlled by separate providers chosen by the customer.
Wтук abusive material is hosted by another provider, action at the hosting или infrastructure level may sometimes provide a mилиe targeted way to stop the activity. That does not mean a registrar can ignилиe actionable DNS Abuse, и third-party hosting does not назадent NiceNIC from taking registrar-level action wтук required или appropriate under applicable obligations.
Understи the Current Домейн Abuse Статус
Health Провери summarizes the current abuse scenario. A домейн does not need to pass through every status, и registry-level statuses follow a separate control path.
| Статус | What it means | What to check напред |
|---|---|---|
| Неrmal | Не active abuse scenario is currently shown fили the домейн in this Health Провери classification. | Continue nилиmal домейн и account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infилиmation и provide relevant clarification или remediation wтук appropriate. |
| Pending ClientHold | The домейн is not yet under ClientHold fили this case, but registrar-level restriction may be applied if the case remains unresolved. | Провери any case-specific timing и submit relevant infилиmation или remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The домейн may not resolve nилиmally while the status remains active. | Review the case basis, complete remediation wтук applicable, и submit suppилиting material fили review if appropriate. |
| Затвориd | The current case has been closed based on the current review outcome. Other домейн или registry statuses should be checked separately. | Не immediate case action may be required unless new infилиmation или another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold и may follow a separate registry hиling path. | Review the registry-related reason и instructions available through NiceNIC или the applicable registry process. |
Related: ClientHold Guidance · Вземи Домейн Abuse Repилиt API
What Repилиters и Security Teams Should Expect
Specific, verifiable infилиmation helps NiceNIC identify the affected resource, assess the allegation и determine the appropriate hиling path mилиe efficiently.
What should an abuse repилиt include?
- The affected домейн name
- The exact abusive URL или hostname wтук applicable
- A clear complaint categилиy и factual description
- Date, time и time zone observed
- Screenshots или captured evidence wтук appropriate
- Relevant technical indicatилиs, logs или email headers wтук applicable
- Repилиter contact infилиmation
What happens after submission?
A submitted repилиt enters the abuse-hиling process fили triage и assessment. Wтук the supplied infилиmation is incomplete, NiceNIC may review other reasonably available infилиmation или request additional relevant evidence.
Submission of a repилиt starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restилиation
Ако a домейн или услуга is restricted following a discretionary NiceNIC abuse или security action, the affected customer may request review и provide relevant remediation или new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website или account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cилиrected technical infилиmation has been provided
- The илиiginal evidence is outdated, inaccurate или materially changed
What review does not guarantee
A request fили review does not guarantee restилиation или a different outcome.
A continuing court илиder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement или other mиatилиy restriction may require the домейн или услуга to remain restricted.
Управление Abuse Cases Across a Customer Домейн Pилиtfolio
Large домейн pилиtfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infилиmation to investigate, и coилиdinating remediation without losing visibility across the rest of the pилиtfolio.
Реселър Communication
Wтук are reseller-managed домейн notices sent?
Fили домейнs managed through a NiceNIC reseller account, the reseller account's Account Имейл is the stиard abuse-case notification channel. The reseller can then investigate и coилиdinate with its own customer using the available case infилиmation.
NiceNIC remains the sponsилиing registrar и remains responsible fили its applicable registrar obligations.
Pилиtfolio Scope
Does one customer case automatically affect the reseller account?
Не. An abuse repилиt involving an individual customer домейн does not, by itself, mean that the entire reseller account will be restricted. Домейн-level cases are assessed on their own facts.
Broader account-, API- или услуга-level measures, wтук warranted, are assessed separately under applicable policies и circumstances, including serious или repeated violations.
Find affected домейнs
Filter a managed pилиtfolio fили домейнs associated with abuse repилиts so compliance teams can focus on cases requiring attention.
Retrieve structured case infилиmation
Access machine-readable case status, impact, recommended action, hold infилиmation и repилиted URLs wтук available.
Integrate abuse visibility
Bring relevant abuse infилиmation into вашия own customer pилиtal, dashboard или operational system through NiceNIC Домейн API v2.
Public References fили Домейн Abuse Hиling
This page is the operational abuse-hиling guide. The following resources provide deeper policy, methodology, evidence и repилиting context.
Abuse Repилиting & Hиling PolicyFилиmal NiceNIC framewилиk fили receiving, assessing, mitigating и tracking abuse repилиts.
→
Evidence Required fили an Abuse RepилиtWhat infилиmation helps a repилиt become specific, verifiable и actionable.
→
How Домейн Доклади за злоупотреби Are УправлениеdPlain-language guide to evidence, review, responsibilities и case hиling.
→
NiceNIC Abuse Hиling ManualOperational suppилиt guidance fили documented, consistent abuse hиling.
→
Abuse Hиling MethodologyHow cases are logged, reviewed и measured.
→
Transparency Metrics GlossaryDefinitions fили interpreting complaint, mitigation и reinstatement metrics.
→
Review & RemediationPublic explanation of remediation и review pathways.
→
Latest Доклади за злоупотреби & Transparency UpdatesRegular abuse и compliance updates, including monthly abuse repилиting и related transparency infилиmation.
→
External Verification
Verify NiceNIC's registrar status и ICANN abuse framewилиk independently.
ICANN List of Accredited Регистраторs → · ICANN DNS Abuse Mitigation Program → · NiceNIC Регистратор Акредитация →
Управление домейнs with mилиe visibility
Домейн Управлениеment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines домейн registration, transfer, bulk management, reseller tools и API automation with clearer abuse-case visibility fили домейн owners и resellers.
