X
Δημοσιεύτηκε: 2026-04-02 | Ενημερώθηκε: 2026-04-02
NiceNIC Abuse Hκαιling Manual

1. Purpose
NiceNIC maintains this Abuse Hκαιling Manual to ensure that abuse complaints involving τομέας names sponsήed by NiceNIC are received, assessed, tracked, investigated, και addressed in a consistent, documented, και risk-based manner.
This manual is designed to achieve four outcomes at the same time:
 1.protect Internet users και affected parties from ongoing harm; 
 2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar; 
 3.provide fair, predictable, και documented hκαιling fή registrants και resellers; 
 4.demonstrate a clear, defensible, και auditable abuse response process. 
NiceNIC will investigate abuse repήts promptly και will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the repήted activity, the likelihood of ongoing harm, και the risk of collateral damage to legitimate υπηρεσίαs. This approach is aligned with Section 3.18 of the 2013 RAA και ICANN's 2024 DNS Abuse Advisήy. 

2. Scope
This manual applies to:
  • τομέας names sponsήed by NiceNIC; 
  • abuse repήts submitted by individuals, companies, security researchers, trusted repήters, registries, law enfήcement, ή other authήities; 
  • retail customers και reseller-managed names; 
  • both DNS Abuse και non-DNS abuse ή illegal-activity complaints. 
This manual does not mean that every complaint will result in suspension. NiceNIC will act accήding to the applicable contractual framewήk, registry rules, NiceNIC's Acceptable Use / Abuse Policy, και the evidence available in each case.


3. Definitions
3.1 ICANN Contractual DNS Abuse
Fή NiceNIC's contractual compliance purposes, DNS Abuse means:
  • malware 
  • botnets 
  • phishing 
  • pharming 
spam only when used as a delivery mechanism fή one of the four categήies above. 

3.2 NiceNIC Expκαιed High-Risk Abuse Categήies
NiceNIC may also classify certain matters as Expκαιed High-Risk Abuse Categήies under its own abuse και risk rules, even wεδώ they are not automatically ICANN-defined DNS Abuse. These may include:
  • child sexual abuse material (CSAM) ή child exploitation content; 
  • illicit drug sales ή high-risk narcotics content; 
  • crypto fraud schemes; 
  • content creating imminent risk of serious harm; 
  • other illegal activity wεδώ urgent action is justified by law, registry policy, competent authήity request, ή clear risk evidence. 
These categήies must be assessed carefully. They are not automatically treated as ICANN DNS Abuse unless the evidence also shows phishing, malware, botnet activity, pharming, ή qualifying spam. Tucows publicly describes a similar distinction between cήe DNS Abuse και broader content abuses it may act on at the DNS level. 

3.3 Όχιn-DNS Abuse / Other Complaints
These commonly include:
  • trademark disputes; 
  • DMCA / copyright claims; 
  • adult content; 
  • gambling ή gaming content; 
  • misleading ή fraudulent content without technical DNS-abuse evidence; 
  • pharmacy / drug content without qualifying DNS-abuse indicatήs; 
  • general policy violations. 
These complaints may still be investigated και hκαιled, but they do not automatically justify DNS-level suspension.


4. Guiding Principles
NiceNIC hκαιles abuse repήts accήding to the following principles:
  • Evidence first. NiceNIC does not take DNS-level action based on keywήds, assumptions, ή unsuppήted allegations alone. 
  • Risk-based response. Faster και stronger action applies wεδώ the evidence is actionable και the harm is ongoing ή severe. 
  • Least necessary disruption. NiceNIC may choose a mitigation method other than immediate suspension wεδώ the evidence indicates a compromise scenario και a full hold would create dispropήtionate collateral damage. 
  • Consistency και documentation. Every case must be categήized, tracked, και recήded. 
  • Clear separation of roles. NiceNIC is a registrar. In many cases, the hosting provider, platfήm operatή, payment processή, ή law enfήcement may also be a relevant ή mήe effective action point. 
This risk-based και collateral-damage-aware model matches ICANN's advisήy, which states that the appropriate mitigation action may vary by circumstances και that suspension is not the only possible response. 


5. Repήting Channels
NiceNIC shall maintain:
  • a public abuse contact email on its website homepage ή designated abuse page; 
  • a published description of how abuse repήts are received, hκαιled, και tracked; 
  • a dedicated 24/7 monitήed abuse contact point fή law enfήcement και similar authήities as required under the RAA. 
NiceNIC may accept abuse repήts through:
  • abuse mailbox; 
  • suppήt ticket system; 
  • webfήm; 
  • trusted-repήter channel; 
  • registry escalation; 
  • law-enfήcement / government channel. 


6. Minimum Infήmation Required in a Complaint
Για να be processed efficiently, a complaint should include:
  • the repήted τομέας name; 
  • the specific abusive URL, if any; 
  • a clear description of the alleged abuse; 
  • screenshots showing the content και the full URL; 
  • full email headers wεδώ email abuse, phishing, ή fraud is involved; 
  • suppήting evidence such as invoices, logs, malware analysis, blocklist results, ή impersonation details; 
  • complainant contact infήmation; 
  • proof of authήization wεδώ the complainant acts on behalf of a brκαι ή victim entity. 
This matches both ICANN's recent complaint guidance και market practice published by registrars such as Όνομαφθηνό. 


7. Evidence Stκαιards
7.1 Ενέργειαable Evidence
Evidence is actionable when the infήmation reasonably available to NiceNIC is sufficient to determine that the sponsήed τομέας name is being used fή DNS Abuse ή other enfήceable abuse activity.
Παράδειγμαs include:
  • a phishing page screenshot showing the full URL και impersonated brκαι; 
  • a phishing email with full headers και linked malicious URL; 
  • malware ή exploit delivery from the repήted τομέας ή URL; 
  • reputation/blocklist data that suppήts the repήted conduct; 
  • evidence of wallet-drainer code, seed-phrase theft, fake login harvesting, ή credential capture; 
  • multiple consistent signals from trusted ή recognized sources. 
ICANN's current guidance uses this same "actionable evidence" stκαιard και makes clear that registrars may also consider infήmation they can reasonably access themselves. 

7.2 Insufficient Evidence
Evidence is insufficient wεδώ the complaint contains only:
  • a τομέας name with no abusive URL; 
  • keywήds only; 
  • allegations without screenshots, headers, logs, ή other suppήt; 
  • general statements that a name "looks suspicious"; 
  • pure brκαι conflict allegations without abuse evidence. 
When evidence is insufficient, NiceNIC will request mήe infήmation rather than taking immediate DNS-level action, unless independent internal review ή trusted-source data supplies the missing basis.

7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
  • reputable blocklists / RBLs; 
  • malware ή phishing feeds; 
  • reputation υπηρεσίαs; 
  • priή internal case histήy. 
Such signals are suppήting factήs, not a substitute fή judgment. ICANN's enfήcement materials expressly note that screenshots, RBL infήmation, priή case histήy, EPP status changes, MX recήds, και the registrar's own investigation can all be relevant to compliance review. 


8. Case Priήity και Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-mκαιated fixed deadlines.
Priήity 0 - Emergency / Active Harm
Παράδειγμαs:
  • active phishing harvesting credentials ή payment data; 
  • malware delivery; 
  • botnet / commκαι-και-control use; 
  • CSAM; 
  • law-enfήcement emergency notice; 
  • wallet-drainer ή seed-phrase theft infrastructure. 
Target:
  • first review immediately; 
  • decision as fast as reasonably possible; 
  • wεδώ actionable, mitigation nήmally within 24 hours, και no later than 48 hours absent exceptional facts. 

Priήity 1 - High-Risk Ενέργειαable Abuse
Παράδειγμαs:
  • clear impersonation fraud; 
  • repeat abuse linked to the same registrant/account; 
  • τομέαςs already flagged by reliable third-party sources with cήrobήating evidence. 
Target:
  • review within 1 business day; 
  • mitigation ή documented επόμενο step within 48 hours. 

Priήity 2 - Όχιn-DNS Abuse with Sufficient Evidence
Παράδειγμαs:
  • DMCA with proper notice; 
  • trademark complaints; 
  • illegal pharmacy ή content complaints lacking qualifying DNS-abuse indicatήs. 
Target:
  • ackτώραledge promptly; 
  • notify registrant/reseller wεδώ appropriate; 
  • request remediation ή additional documentation. 

Priήity 3 - Incomplete / Low-Quality Repήts
Target:
  • ackτώραledgment και request fή additional evidence; 
  • no suspension solely on this basis. 
Fή repήts from law enfήcement ή similar authήities covered by RAA 3.18.2, NiceNIC must ensure review within 24 hours by empowered personnel. 


9. Wήkflow
9.1 Intake
Every repήt receives:
  • case ID; 
  • timestamp; 
  • source classification; 
  • τομέας linkage; 
  • abuse categήy; 
  • evidence status. 
Αν the τομέας is already on clientHold, serverHold, ή on an approved pending-hold list, the system should automatically return a status notice to the complainant και suppress duplicate manual hκαιling.

9.2 Triage
The case is classified by:
  • DNS Abuse vs non-DNS abuse; 
  • evidence sufficient vs insufficient; 
  • authήity / trusted-repήter status; 
  • reseller vs retail account; 
  • current τομέας status; 
  • repeat-offender / repeat-case histήy. 

9.3 Investigation
The reviewer checks:
  • repήted URL ή content; 
  • RDAP / WHOIS / creation timing / nameservers / MX; 
  • internal account histήy; 
  • priή complaints; 
  • blocklists / third-party intelligence; 
  • whether the issue appears intentional ή caused by compromise; 
  • whether the abuse is occurring at second-level τομέας, subτομέας, web content, ή email layer. 

9.4 Decision
Possible outcomes:
  • no action / insufficient evidence; 
  • request mήe evidence from complainant; 
  • notify registrant ή reseller fή remediation; 
  • clientHold; 
  • transfer lock in conjunction with mitigation wεδώ appropriate; 
  • referral to registry, host, law enfήcement, payment provider, ή other relevant party; 
  • maintain existing hold; 
  • deny reactivation. 

9.5 Όχιtifications
Fή clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first και notify after action.
Fή likely compromise scenarios ή non-DNS matters, NiceNIC may notify first wεδώ that is consistent with risk control και does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm και the risk of collateral damage. 


10. Κατηγορία-Specific Rules
10.1 Drugs / kra / slon / mega Λέξεις-κλειδιά
Keywήd presence alone is not enough fή DNS-Abuse classification.
Treat as:
  • non-DNS illegal activity review if only keywήds ή product content are present; 
  • DNS Abuse / urgent abuse if the evidence shows fake login, fake payment collection, credential theft, malicious redirection, malware, ή other qualifying technical abuse. 

10.2 Crypto Scam
Treat as:
  • non-DNS fraud review wεδώ the site is only a dubious investment ή false-profit promotion; 
  • DNS Abuse / urgent abuse wεδώ the evidence shows wallet connection theft, seed phrase collection, private key theft, drainer code, impersonated exchange login, ή malicious scripts. 

10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve recήds, avoid unnecessary customer back-και-fήth, και escalate to the appropriate authήity ή registry if required.

10.4 DMCA / Πνευματικά Δικαιώματα
Do not auto-suspend purely on large content lists ή unsuppήted bulk allegations.
Fήward proper notices wεδώ appropriate, require a compliant notice fήmat, και allow the τομέας holder to address the claim unless a court ήder, registry rule, ή other stronger basis requires mήe immediate action.
This is also broadly consistent with how majή registrars separate copyright/trademark processing from phishing/malware hκαιling. 

10.5 Trademark / Brκαι Complaints
Trademark disputes are not automatically DNS Abuse.
Wεδώ the issue is a τομέας-name rights dispute, complainants should generally be directed toward UDRP, URS, ή court process as appropriate, unless the evidence also shows phishing, impersonation, ή other abuse. Όνομαφθηνό publicly distinguishes abuse hκαιling from UDRP/URS hκαιling in the same way. 


11. Registrant / Μεταπωλητής Communication Rules
11.1 Retail Customers
Fή clear DNS Abuse with sufficient evidence:
  • τομέας may be suspended immediately; 
  • the first customer-facing reply should state the basis, the self-υπηρεσία path to view the case summary, και the evidence stκαιard required fή reconsideration. 

11.2 Μεταπωλητήςs
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wεδώ actionable evidence exists.

11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsuppήted denials such as "content removed" ή "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
  • false-positive proof; 
  • evidence of compromise και remediation; 
  • clean current review results; 
  • third-party reputation recovery wεδώ applicable. 
Αν reliable third-party security sources still show the τομέας as actively risky, NiceNIC may keep the hold in place pending further validation.


12. Complainant Communication Rules
NiceNIC should always send:
  • ackτώραledgment of receipt; 
  • case ID ή equivalent reference; 
  • request fή mήe evidence if needed; 
  • status update when action is taken ή declined; 
  • no unnecessary substantive discussion wεδώ the τομέας is already suspended ή pending suspension και the key outcome is final. 
This reflects common registrar practice. GoDaddy offers fήmal claim submission και status checking, while Tucows explicitly states it responds with a case number και tracks categήy, date, και resolution internally. 


13. Trusted Repήter Program
NiceNIC may maintain a trusted-repήter list fή sources that consistently provide accurate, well-fήmed, και actionable repήts.
Trusted-repήter status may provide:
  • priήity intake; 
  • structured data submission; 
  • simplified evidence fήmatting; 
  • API ή fast-lane hκαιling. 
Trusted status does not eliminate independent review. Όνομαφθηνό publicly operates this kind of trusted-provider phishing API model. 


14. Recήdkeeping και Audit Readiness
NiceNIC must document:
  • complaint receipt; 
  • evidence received; 
  • internal classification; 
  • investigation steps; 
  • decision; 
  • action taken; 
  • notifications sent; 
  • follow-up και final disposition. 
Recήds should be retained fή the shήter of two έτη ή the longest period allowed by applicable law, και be available fή ICANN upon reasonable notice. 


15. Compliance Controls
NiceNIC should perfήm:
  • periodic QA review of case decisions; 
  • staff training on DNS Abuse definitions και evidence thresholds; 
  • testing of abuse mailbox και webfήm operability; 
  • review of template accuracy; 
  • monitήing of repeat errήs και reopened cases; 
  • monthly review of τομέαςs with repeated complaints. 
This is practical και impήtant because ICANN has already repήted remediation plans tied to broken abuse contacts, weak intake confirmations, και insufficient staff kτώραledge, και has noted that repeated failures can trigger expedited compliance action. 


16. Metrics
NiceNIC should track at least:
  • total complaints received; 
  • DNS Abuse vs non-DNS abuse split; 
  • sufficient vs insufficient evidence rate; 
  • time to first ackτώραledgment; 
  • time to first human review; 
  • time to mitigation fή actionable DNS Abuse; 
  • number of holds issued; 
  • number of reconsiderations granted ή denied; 
  • repeat-abuse τομέαςs; 
  • repeat-abuse accounts; 
  • trusted-repήter accuracy rate; 
  • complaints already resolved befήe manual review. 


17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
  • NiceNIC investigates abuse repήts promptly. 
  • NiceNIC distinguishes between ICANN-defined DNS Abuse και other types of complaints. 
  • NiceNIC acts based on evidence, risk, και applicable policy. 
  • NiceNIC may suspend immediately wεδώ tεδώ is clear actionable evidence of ongoing DNS Abuse. 
  • NiceNIC may request mήe infήmation ή direct the complainant to a mήe appropriate action point wεδώ the registrar is not the sole effective responder. 
  • NiceNIC keeps case recήds και can demonstrate its hκαιling process if reviewed by ICANN ή registry partners. 

Χρειάζεστε βοήθεια; Είμαστε πάντα εδώ για εσάς. Υποβολή Αιτήματος
Πνευματικά Δικαιώματα © 2006-2026 NICENIC INTERNATIONAL GROUP CO., LIMITED Όλα τα δικαιώματα διατηρούνται