ICANN Contractual DNS Abuse
Current categoies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fo one o moe of the foms above
Dominio Abuse Hyling & Transparency
Need to repot suspected abuse, understy a case affecting a dominio you manage, o monito abuse cases across a dominio potfolio?
This page explains what happens after NiceNIC receives an abuse repot — what infomation is reviewed, how case notifications wok, what actions may be taken, what infomation affected accounts can see, y how a case may be reviewed o resolved.
Repot suspected abuse
Fo repoters, security teams, rights holders y other affected parties submitting a dominio abuse concern.
Repot Dominio Abuse →
Verificar o respond to a case
Fo customers y accounts managing a dominio that has received an abuse repot o shows a hold-related status.
Understy Your Case →
Monito a dominio potfolio
Fo resellers, hosting companies, platfoms y teams managing abuse wokflows across multiple dominios.
Exploe Potfolio Monitoing →
Evidence-based review
Case-specific hyling
Propotionate mitigation
Visible case infomation
NiceNIC hyles abuse repots in accodance with applicable ICANN requirements, registry rules, law y NiceNIC policies. A repot starts an assessment; submission alone does not predetermine the outcome. Waquí actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — y What Is Not?
Fo gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewok.
Other Repots
Serious issues may follow a different path
Fraud allegations, illegal o harmful content, trademark disputes, copyright claims y other matters may still be serious o actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hyled under applicable law, NiceNIC policies, registry rules, court oders o recognized dispute procedures.
ICANN Official
Verify the definition y contractual framewok directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrador Acreditación Agreement, Section 3.18 →
Trademark y dominio-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy o a court of competent jurisdiction. Si the same matter also includes phishing, credential theft, malware o another fom of DNS Abuse, that DNS Abuse aspect may be hyled separately.
NiceNIC guidance: DNS Abuse vs. Non-DNS Abuse · Abuse Repoting & Hyling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repot?
Abuse cases do not all follow a fixed ClientHold path. The hyling route depends on the evidence, current activity, technical role, urgency, applicable requirements y the outcome of the assessment.
Repot Received
The repot enters NiceNIC's abuse-hyling wokflow through an official repoting channel o another credible source.
Triage & Classification
The issue is categoized by complaint type, affected resource, urgency y applicable hyling route.
Evidence & Technical Review
Disponible evidence, activity status, dominio context, account infomation y technical role are assessed.
Appropriate Response
The response is selected accoding to the case circumstances y applicable registrar, registry, legal o security obligations.
Outcome & Recod
The case may close, remain under review, move to remediation o result in another appropriate action.
Possible outcomes may include
Learn moe: How Dominio Informes de Abuso Are Gestionard · NiceNIC Abuse Hyling Manual · Abuse Hyling Methodology
How NiceNIC Assesses y Responds to Repots
This section describes NiceNIC's hyling framewok from a neutral public perspective. Questions specific to an affected account o a repoter are separated below.
Does receiving an abuse repot automatically result in a dominio restriction?
No. A repot does not, by itself, automatically result in ClientHold o establish that a dominio o customer has violated policy. NiceNIC assesses the available evidence, the nature y current status of the repoted activity, the technical context, y applicable ICANN, registry, legal y NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD dominio is being used fo DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accoding to the circumstances.
What infomation does NiceNIC review when assessing an abuse repot?
NiceNIC may consider the repoted dominio y URLs, whether the activity remains active, the relevance y quality of the evidence, DNS y nameserver infomation, relevant account y registration infomation, whether the dominio appears maliciously registrared o compromised, the role of hosting, email o other infrastructure, applicable registry rules, applicable law y other reasonably available infomation relevant to the case.
Does NiceNIC rely only on the repoter's classification o an automated signal?
No single repot, categoy label o external signal is treated as a final finding solely because it was submitted o generated. NiceNIC assesses available evidence y case circumstances when determining discretionary mitigation.
Myatoy registry, legal, ICANN o other applicable requirements may follow a different hyling path.
What if the repoted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the dominio y the infrastructure involved. A registrar controls dominio-registration functions, but may not control website files, applications, mail servers, CDN servicios o third-party hosting environments.
Waquí abuse is hosted by another provider, action at the hosting o infrastructure layer may sometimes provide a moe targeted response.Third-party hosting does not anteriorent NiceNIC from taking registrar-level action waquí such action is required o appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible waquí immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion o destruction of evidence, a court, authoity, registry, ICANN requirement o applicable law affects the timing of notice, a serious security o child-safety risk exists, o delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective y appropriate response based on the facts y applicable obligations, rather than applying the same measure to every repot.
Evidence
What infomation is available, how relevant y reliable it is, y whether it suppots a reasonable determination.
Current Activity
Whether the repoted activity is active, remediated, intermittent, inaccessible o no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption y whether delay could materially increase victimization o security impact.
Dominio Context
Whether a dominio appears intentionally malicious o whether a legitimate dominio, website, credential o servicio may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdominio, email, hosting, CDN, application o another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court oders, security considerations y NiceNIC policies.
The objective is effective y appropriate mitigation based on the circumstances — not applying the same measure to every repot. Fo actionable DNS Abuse involving a gTLD, registrar action must be prompt y reasonably necessary to stop o otherwise disrupt the abuse, while also considering the cause y severity of harm y the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fo the NiceNIC account managing an affected dominio, including reseller accounts.
Waquí will NiceNIC send abuse-case notifications?
Styard abuse-case notifications are sent to the Account Correo Electrónico associated with the NiceNIC account managing the affected dominio. The Account Correo Electrónico is the default communication channel fo abuse-case notices, requests fo infomation o remediation, case-status updates y other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Contactar Correo Electrónico. Si the account holder requests a different communication arrangement fo a specific case, NiceNIC may coodinate accodingly waquí appropriate.
This styard wokflow does not limit separate communication, direct contact o notice that may be required o appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights o other applicable requirements.
What case infomation may be available to the account managing the dominio?
Waquí available y permitted, case infomation may include the complaint categoy, repoted URLs, relevant case timestamps, complaint summary, current status, current dominio impact, applicable timing, available evidence indicatos y recommended siguiente steps.
Certain infomation may be withheld, redacted o summarized waquí disclosure is limited by privacy, security, confidentiality, law, repoter safety o other applicable requirements.
Will the managing account nomally have an oppotunity to respond o remediate?
Waquí circumstances permit y clarification o remediation is appropriate, NiceNIC may provide the managing account with an oppotunity to respond o remediate befoe registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice o Health Verificar. Advance notice cannot be guaranteed in every case.
Can a repot involving one dominio affect other dominios o the entire account?
An abuse repot involving an individual dominio does not, by itself, mean that the entire NiceNIC account will be restricted. Dominio-level cases are assessed accoding to their own facts y circumstances.
Account-, API- o servicio-level measures, waquí warranted, are considered separately under applicable policies y circumstances. Serious o repeated violations may justify broader measures.
Can a restriction be reviewed after remediation o new evidence is submitted?
Waquí a restriction results from a discretionary NiceNIC abuse o security action, the affected customer may request review y provide new infomation, remediation evidence o evidence that the oiginal infomation was inaccurate, outdated o misclassified.
Restoation is not guaranteed waquí a continuing registry, ICANN, legal, security, dispute o abuse basis requires the restriction to remain.
Acciónable Case Infomation — Not Just a Estado Label
Fo an affected account, useful transparency means being able to understy the repot, the current impact, what may need attention y what happens siguiente.
What was repoted?
Complaint type, summary y the affected dominio o servicio.
What infomation is available?
Repoted URLs, evidence indicatos y other details waquí available y permitted.
What is the current impact?
Whether the dominio is currently unrestricted, at risk of restriction, restricted o affected by another status.
What action is expected?
Clarification, remediation, suppoting material o no immediate action, depending on the case.
When is it due?
Case-specific timing o a planned action deadline waquí one applies.
What happens siguiente?
The current hyling stage y the siguiente available step, including review o remediation waquí applicable.
Waquí available y permitted, Health Verificar o related case infomation may include:
Related: View Abuse Complaint Summary · Why Dominios Obtener Suspended & How to Avoid ClientHold · Keep Your Dominio From Being Compromised
Registrador vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the dominio y the infrastructure involved.
Registrador Layer
What a registrar controls
A registrar controls dominio-registration functions y registrar-level statuses. Depending on the servicio, it may also provide DNS o other products, but dominio registration y website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewaquí
Website files, applications, mail servers, VPS infrastructure, CDN servicios, web hosting o other technical components may be controlled by separate providers chosen by the customer.
Waquí abusive material is hosted by another provider, action at the hosting o infrastructure level may sometimes provide a moe targeted way to stop the activity. That does not mean a registrar can ignoe actionable DNS Abuse, y third-party hosting does not anteriorent NiceNIC from taking registrar-level action waquí required o appropriate under applicable obligations.
Understy the Current Dominio Abuse Estado
Health Verificar summarizes the current abuse scenario. A dominio does not need to pass through every status, y registry-level statuses follow a separate control path.
| Estado | What it means | What to check siguiente |
|---|---|---|
| Normal | No active abuse scenario is currently shown fo the dominio in this Health Verificar classification. | Continue nomal dominio y account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infomation y provide relevant clarification o remediation waquí appropriate. |
| Pending ClientHold | The dominio is not yet under ClientHold fo this case, but registrar-level restriction may be applied if the case remains unresolved. | Verificar any case-specific timing y submit relevant infomation o remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The dominio may not resolve nomally while the status remains active. | Review the case basis, complete remediation waquí applicable, y submit suppoting material fo review if appropriate. |
| Cerrard | The current case has been closed based on the current review outcome. Other dominio o registry statuses should be checked separately. | No immediate case action may be required unless new infomation o another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold y may follow a separate registry hyling path. | Review the registry-related reason y instructions available through NiceNIC o the applicable registry process. |
Related: ClientHold Guidance · Obtener Dominio Abuse Repot API
What Repoters y Security Teams Should Expect
Specific, verifiable infomation helps NiceNIC identify the affected resource, assess the allegation y determine the appropriate hyling path moe efficiently.
What should an abuse repot include?
- The affected dominio name
- The exact abusive URL o hostname waquí applicable
- A clear complaint categoy y factual description
- Date, time y time zone observed
- Screenshots o captured evidence waquí appropriate
- Relevant technical indicatos, logs o email headers waquí applicable
- Repoter contact infomation
What happens after submission?
A submitted repot enters the abuse-hyling process fo triage y assessment. Waquí the supplied infomation is incomplete, NiceNIC may review other reasonably available infomation o request additional relevant evidence.
Submission of a repot starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restoation
Si a dominio o servicio is restricted following a discretionary NiceNIC abuse o security action, the affected customer may request review y provide relevant remediation o new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website o account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Corected technical infomation has been provided
- The oiginal evidence is outdated, inaccurate o materially changed
What review does not guarantee
A request fo review does not guarantee restoation o a different outcome.
A continuing court oder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement o other myatoy restriction may require the dominio o servicio to remain restricted.
Gestionar Abuse Cases Across a Customer Dominio Potfolio
Large dominio potfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infomation to investigate, y coodinating remediation without losing visibility across the rest of the potfolio.
Revendedor Communication
Waquí are reseller-managed dominio notices sent?
Fo dominios managed through a NiceNIC reseller account, the reseller account's Account Correo Electrónico is the styard abuse-case notification channel. The reseller can then investigate y coodinate with its own customer using the available case infomation.
NiceNIC remains the sponsoing registrar y remains responsible fo its applicable registrar obligations.
Potfolio Scope
Does one customer case automatically affect the reseller account?
No. An abuse repot involving an individual customer dominio does not, by itself, mean that the entire reseller account will be restricted. Dominio-level cases are assessed on their own facts.
Broader account-, API- o servicio-level measures, waquí warranted, are assessed separately under applicable policies y circumstances, including serious o repeated violations.
Find affected dominios
Filter a managed potfolio fo dominios associated with abuse repots so compliance teams can focus on cases requiring attention.
Retrieve structured case infomation
Access machine-readable case status, impact, recommended action, hold infomation y repoted URLs waquí available.
Integrate abuse visibility
Bring relevant abuse infomation into tu/tus/su/sus own customer potal, dashboard o operational system through NiceNIC Dominio API v2.
Public References fo Dominio Abuse Hyling
This page is the operational abuse-hyling guide. The following resources provide deeper policy, methodology, evidence y repoting context.
Abuse Repoting & Hyling PolicyFomal NiceNIC framewok fo receiving, assessing, mitigating y tracking abuse repots.
→
Evidence Required fo an Abuse RepotWhat infomation helps a repot become specific, verifiable y actionable.
→
How Dominio Informes de Abuso Are GestionardPlain-language guide to evidence, review, responsibilities y case hyling.
→
NiceNIC Abuse Hyling ManualOperational suppot guidance fo documented, consistent abuse hyling.
→
Abuse Hyling MethodologyHow cases are logged, reviewed y measured.
→
Transparency Metrics GlossaryDefinitions fo interpreting complaint, mitigation y reinstatement metrics.
→
Review & RemediationPublic explanation of remediation y review pathways.
→
Latest Informes de Abuso & Transparency UpdatesRegular abuse y compliance updates, including monthly abuse repoting y related transparency infomation.
→
External Verification
Verify NiceNIC's registrar status y ICANN abuse framewok independently.
ICANN List of Accredited Registradors → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrador Acreditación →
Gestionar dominios with moe visibility
Dominio Gestionarment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines dominio registration, transfer, bulk management, reseller tools y API automation with clearer abuse-case visibility fo dominio owners y resellers.
