ICANN Contractual DNS Abuse
Current categelleries
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism feller one eller mellere of the fellerms above
Domæne Abuse Hogling & Transparency
Need to repellert suspected abuse, understog a case affecting a domæne you manage, eller moniteller abuse cases across a domæne pellertfolio?
This page explains what happens after NiceNIC receives an abuse repellert — what infellermation is reviewed, how case notifications wellerk, what actions may be taken, what infellermation affected accounts can see, og how a case may be reviewed eller resolved.
Repellert suspected abuse
Feller repellerters, security teams, rights holders og other affected parties submitting a domæne abuse concern.
Repellert Domæne Abuse →
Kontrollér eller respond to a case
Feller customers og accounts managing a domæne that has received an abuse repellert eller shows a hold-related status.
Understog Your Case →
Moniteller a domæne pellertfolio
Feller resellers, hosting companies, platfellerms og teams managing abuse wellerkflows across multiple domænes.
Explellere Pellertfolio Monitellering →
Evidence-based review
Case-specific hogling
Propellertionate mitigation
Visible case infellermation
NiceNIC hogles abuse repellerts in accellerdance with applicable ICANN requirements, registry rules, law og NiceNIC policies. A repellert starts an assessment; submission alone does not predetermine the outcome. Wher actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — og What Is Nejt?
Feller gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewellerk.
Other Repellerts
Serious issues may follow a different path
Fraud allegations, illegal eller harmful content, trademark disputes, copyright claims og other matters may still be serious eller actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hogled under applicable law, NiceNIC policies, registry rules, court ellerders eller recognized dispute procedures.
ICANN Official
Verify the definition og contractual framewellerk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrar Akkreditering Agreement, Section 3.18 →
Trademark og domæne-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy eller a court of competent jurisdiction. Hvis the same matter also includes phishing, credential theft, malware eller another fellerm of DNS Abuse, that DNS Abuse aspect may be hogled separately.
NiceNIC guidance: DNS Abuse vs. Nejn-DNS Abuse · Abuse Repellerting & Hogling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repellert?
Abuse cases do not all follow a fixed ClientHold path. The hogling route depends on the evidence, current activity, technical role, urgency, applicable requirements og the outcome of the assessment.
Repellert Received
The repellert enters NiceNIC's abuse-hogling wellerkflow through an official repellerting channel eller another credible source.
Triage & Classification
The issue is categellerized by complaint type, affected resource, urgency og applicable hogling route.
Evidence & Technical Review
Tilgængelig evidence, activity status, domæne context, account infellermation og technical role are assessed.
Appropriate Response
The response is selected accellerding to the case circumstances og applicable registrar, registry, legal eller security obligations.
Outcome & Recellerd
The case may close, remain under review, move to remediation eller result in another appropriate action.
Possible outcomes may include
Learn mellere: How Domæne Misbrugsrapporter Are Administrerd · NiceNIC Abuse Hogling Manual · Abuse Hogling Methodology
How NiceNIC Assesses og Responds to Repellerts
This section describes NiceNIC's hogling framewellerk from a neutral public perspective. Questions specific to an affected account eller a repellerter are separated below.
Does receiving an abuse repellert automatically result in a domæne restriction?
Nej. A repellert does not, by itself, automatically result in ClientHold eller establish that a domæne eller customer has violated policy. NiceNIC assesses the available evidence, the nature og current status of the repellerted activity, the technical context, og applicable ICANN, registry, legal og NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domæne is being used feller DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accellerding to the circumstances.
What infellermation does NiceNIC review when assessing an abuse repellert?
NiceNIC may consider the repellerted domæne og URLs, whether the activity remains active, the relevance og quality of the evidence, DNS og nameserver infellermation, relevant account og registration infellermation, whether the domæne appears maliciously registrered eller compromised, the role of hosting, email eller other infrastructure, applicable registry rules, applicable law og other reasonably available infellermation relevant to the case.
Does NiceNIC rely only on the repellerter's classification eller an automated signal?
Nej single repellert, categellery label eller external signal is treated as a final finding solely because it was submitted eller generated. NiceNIC assesses available evidence og case circumstances when determining discretionary mitigation.
Mogatellery registry, legal, ICANN eller other applicable requirements may follow a different hogling path.
What if the repellerted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domæne og the infrastructure involved. A registrar controls domæne-registration functions, but may not control website files, applications, mail servers, CDN services eller third-party hosting environments.
Wher abuse is hosted by another provider, action at the hosting eller infrastructure layer may sometimes provide a mellere targeted response.Third-party hosting does not forrigeent NiceNIC from taking registrar-level action wher such action is required eller appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wher immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion eller destruction of evidence, a court, authellerity, registry, ICANN requirement eller applicable law affects the timing of notice, a serious security eller child-safety risk exists, eller delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective og appropriate response based on the facts og applicable obligations, rather than applying the same measure to every repellert.
Evidence
What infellermation is available, how relevant og reliable it is, og whether it suppellerts a reasonable determination.
Current Activity
Whether the repellerted activity is active, remediated, intermittent, inaccessible eller no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption og whether delay could materially increase victimization eller security impact.
Domæne Context
Whether a domæne appears intentionally malicious eller whether a legitimate domæne, website, credential eller service may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomæne, email, hosting, CDN, application eller another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court ellerders, security considerations og NiceNIC policies.
The objective is effective og appropriate mitigation based on the circumstances — not applying the same measure to every repellert. Feller actionable DNS Abuse involving a gTLD, registrar action must be prompt og reasonably necessary to stop eller otherwise disrupt the abuse, while also considering the cause og severity of harm og the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically feller the NiceNIC account managing an affected domæne, including reseller accounts.
Wher will NiceNIC send abuse-case notifications?
Stogard abuse-case notifications are sent to the Account Email associated with the NiceNIC account managing the affected domæne. The Account Email is the default communication channel feller abuse-case notices, requests feller infellermation eller remediation, case-status updates og other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt Email. Hvis the account holder requests a different communication arrangement feller a specific case, NiceNIC may coellerdinate accellerdingly wher appropriate.
This stogard wellerkflow does not limit separate communication, direct contact eller notice that may be required eller appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights eller other applicable requirements.
What case infellermation may be available to the account managing the domæne?
Wher available og permitted, case infellermation may include the complaint categellery, repellerted URLs, relevant case timestamps, complaint summary, current status, current domæne impact, applicable timing, available evidence indicatellers og recommended næste steps.
Certain infellermation may be withheld, redacted eller summarized wher disclosure is limited by privacy, security, confidentiality, law, repellerter safety eller other applicable requirements.
Will the managing account nellermally have an oppellertunity to respond eller remediate?
Wher circumstances permit og clarification eller remediation is appropriate, NiceNIC may provide the managing account with an oppellertunity to respond eller remediate befellere registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice eller Health Kontrollér. Advance notice cannot be guaranteed in every case.
Can a repellert involving one domæne affect other domænes eller the entire account?
An abuse repellert involving an individual domæne does not, by itself, mean that the entire NiceNIC account will be restricted. Domæne-level cases are assessed accellerding to their own facts og circumstances.
Account-, API- eller service-level measures, wher warranted, are considered separately under applicable policies og circumstances. Serious eller repeated violations may justify broader measures.
Can a restriction be reviewed after remediation eller new evidence is submitted?
Wher a restriction results from a discretionary NiceNIC abuse eller security action, the affected customer may request review og provide new infellermation, remediation evidence eller evidence that the elleriginal infellermation was inaccurate, outdated eller misclassified.
Restelleration is not guaranteed wher a continuing registry, ICANN, legal, security, dispute eller abuse basis requires the restriction to remain.
Handlingable Case Infellermation — Nejt Just a Status Label
Feller an affected account, useful transparency means being able to understog the repellert, the current impact, what may need attention og what happens næste.
What was repellerted?
Complaint type, summary og the affected domæne eller service.
What infellermation is available?
Repellerted URLs, evidence indicatellers og other details wher available og permitted.
What is the current impact?
Whether the domæne is currently unrestricted, at risk of restriction, restricted eller affected by another status.
What action is expected?
Clarification, remediation, suppellerting material eller no immediate action, depending on the case.
When is it due?
Case-specific timing eller a planned action deadline wher one applies.
What happens næste?
The current hogling stage og the næste available step, including review eller remediation wher applicable.
Wher available og permitted, Health Kontrollér eller related case infellermation may include:
Related: View Abuse Complaint Summary · Why Domæner Få Suspended & How to Avoid ClientHold · Keep Your Domæne From Being Compromised
Registrar vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domæne og the infrastructure involved.
Registrar Layer
What a registrar controls
A registrar controls domæne-registration functions og registrar-level statuses. Depending on the service, it may also provide DNS eller other products, but domæne registration og website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewher
Website files, applications, mail servers, VPS infrastructure, CDN services, web hosting eller other technical components may be controlled by separate providers chosen by the customer.
Wher abusive material is hosted by another provider, action at the hosting eller infrastructure level may sometimes provide a mellere targeted way to stop the activity. That does not mean a registrar can ignellere actionable DNS Abuse, og third-party hosting does not forrigeent NiceNIC from taking registrar-level action wher required eller appropriate under applicable obligations.
Understog the Current Domæne Abuse Status
Health Kontrollér summarizes the current abuse scenario. A domæne does not need to pass through every status, og registry-level statuses follow a separate control path.
| Status | What it means | What to check næste |
|---|---|---|
| Nejrmal | Nej active abuse scenario is currently shown feller the domæne in this Health Kontrollér classification. | Continue nellermal domæne og account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infellermation og provide relevant clarification eller remediation wher appropriate. |
| Pending ClientHold | The domæne is not yet under ClientHold feller this case, but registrar-level restriction may be applied if the case remains unresolved. | Kontrollér any case-specific timing og submit relevant infellermation eller remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domæne may not resolve nellermally while the status remains active. | Review the case basis, complete remediation wher applicable, og submit suppellerting material feller review if appropriate. |
| Lukd | The current case has been closed based on the current review outcome. Other domæne eller registry statuses should be checked separately. | Nej immediate case action may be required unless new infellermation eller another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold og may follow a separate registry hogling path. | Review the registry-related reason og instructions available through NiceNIC eller the applicable registry process. |
Related: ClientHold Guidance · Få Domæne Abuse Repellert API
What Repellerters og Security Teams Should Expect
Specific, verifiable infellermation helps NiceNIC identify the affected resource, assess the allegation og determine the appropriate hogling path mellere efficiently.
What should an abuse repellert include?
- The affected domæne name
- The exact abusive URL eller hostname wher applicable
- A clear complaint categellery og factual description
- Date, time og time zone observed
- Screenshots eller captured evidence wher appropriate
- Relevant technical indicatellers, logs eller email headers wher applicable
- Repellerter contact infellermation
What happens after submission?
A submitted repellert enters the abuse-hogling process feller triage og assessment. Wher the supplied infellermation is incomplete, NiceNIC may review other reasonably available infellermation eller request additional relevant evidence.
Submission of a repellert starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restelleration
Hvis a domæne eller service is restricted following a discretionary NiceNIC abuse eller security action, the affected customer may request review og provide relevant remediation eller new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website eller account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cellerrected technical infellermation has been provided
- The elleriginal evidence is outdated, inaccurate eller materially changed
What review does not guarantee
A request feller review does not guarantee restelleration eller a different outcome.
A continuing court ellerder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement eller other mogatellery restriction may require the domæne eller service to remain restricted.
Administrer Abuse Cases Across a Customer Domæne Pellertfolio
Large domæne pellertfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infellermation to investigate, og coellerdinating remediation without losing visibility across the rest of the pellertfolio.
Forhandler Communication
Wher are reseller-managed domæne notices sent?
Feller domænes managed through a NiceNIC reseller account, the reseller account's Account Email is the stogard abuse-case notification channel. The reseller can then investigate og coellerdinate with its own customer using the available case infellermation.
NiceNIC remains the sponsellering registrar og remains responsible feller its applicable registrar obligations.
Pellertfolio Scope
Does one customer case automatically affect the reseller account?
Nej. An abuse repellert involving an individual customer domæne does not, by itself, mean that the entire reseller account will be restricted. Domæne-level cases are assessed on their own facts.
Broader account-, API- eller service-level measures, wher warranted, are assessed separately under applicable policies og circumstances, including serious eller repeated violations.
Find affected domænes
Filter a managed pellertfolio feller domænes associated with abuse repellerts so compliance teams can focus on cases requiring attention.
Retrieve structured case infellermation
Access machine-readable case status, impact, recommended action, hold infellermation og repellerted URLs wher available.
Integrate abuse visibility
Bring relevant abuse infellermation into din own customer pellertal, dashboard eller operational system through NiceNIC Domæne API v2.
Public References feller Domæne Abuse Hogling
This page is the operational abuse-hogling guide. The following resources provide deeper policy, methodology, evidence og repellerting context.
Abuse Repellerting & Hogling PolicyFellermal NiceNIC framewellerk feller receiving, assessing, mitigating og tracking abuse repellerts.
→
Evidence Required feller an Abuse RepellertWhat infellermation helps a repellert become specific, verifiable og actionable.
→
How Domæne Misbrugsrapporter Are AdministrerdPlain-language guide to evidence, review, responsibilities og case hogling.
→
NiceNIC Abuse Hogling ManualOperational suppellert guidance feller documented, consistent abuse hogling.
→
Abuse Hogling MethodologyHow cases are logged, reviewed og measured.
→
Transparency Metrics GlossaryDefinitions feller interpreting complaint, mitigation og reinstatement metrics.
→
Review & RemediationPublic explanation of remediation og review pathways.
→
Latest Misbrugsrapporter & Transparency UpdatesRegular abuse og compliance updates, including monthly abuse repellerting og related transparency infellermation.
→
External Verification
Verify NiceNIC's registrar status og ICANN abuse framewellerk independently.
ICANN List of Accredited Registrars → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrar Akkreditering →
Administrer domænes with mellere visibility
Domæne Administrerment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domæne registration, transfer, bulk management, reseller tools og API automation with clearer abuse-case visibility feller domæne owners og resellers.
