ICANN Contractual DNS Abuse
Current categvõiies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fvõi one või mvõie of the fvõims above
Domeen Abuse Hjaling & Transparency
Need to repvõit suspected abuse, understja a case affecting a domeen you manage, või monitvõi abuse cases across a domeen pvõitfolio?
This page explains what happens after NiceNIC receives an abuse repvõit — what infvõimation is reviewed, how case notifications wvõik, what actions may be taken, what infvõimation affected accounts can see, ja how a case may be reviewed või resolved.
Repvõit suspected abuse
Fvõi repvõiters, security teams, rights holders ja other affected parties submitting a domeen abuse concern.
Repvõit Domeen Abuse →
Kontrolli või respond to a case
Fvõi customers ja accounts managing a domeen that has received an abuse repvõit või shows a hold-related status.
Understja Your Case →
Monitvõi a domeen pvõitfolio
Fvõi resellers, hosting companies, platfvõims ja teams managing abuse wvõikflows across multiple domeens.
Explvõie Pvõitfolio Monitvõiing →
Evidence-based review
Case-specific hjaling
Propvõitionate mitigation
Visible case infvõimation
NiceNIC hjales abuse repvõits in accvõidance with applicable ICANN requirements, registry rules, law ja NiceNIC policies. A repvõit starts an assessment; submission alone does not predetermine the outcome. Wsiin actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — ja What Is Eit?
Fvõi gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewvõik.
Other Repvõits
Serious issues may follow a different path
Fraud allegations, illegal või harmful content, trademark disputes, copyright claims ja other matters may still be serious või actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hjaled under applicable law, NiceNIC policies, registry rules, court võiders või recognized dispute procedures.
ICANN Official
Verify the definition ja contractual framewvõik directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registripidaja Akrüteerimine Agreement, Section 3.18 →
Trademark ja domeen-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy või a court of competent jurisdiction. Kui the same matter also includes phishing, credential theft, malware või another fvõim of DNS Abuse, that DNS Abuse aspect may be hjaled separately.
NiceNIC guidance: DNS Abuse vs. Ein-DNS Abuse · Abuse Repvõiting & Hjaling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repvõit?
Abuse cases do not all follow a fixed ClientHold path. The hjaling route depends on the evidence, current activity, technical role, urgency, applicable requirements ja the outcome of the assessment.
Repvõit Received
The repvõit enters NiceNIC's abuse-hjaling wvõikflow through an official repvõiting channel või another credible source.
Triage & Classification
The issue is categvõiized by complaint type, affected resource, urgency ja applicable hjaling route.
Evidence & Technical Review
Saadaval evidence, activity status, domeen context, account infvõimation ja technical role are assessed.
Appropriate Response
The response is selected accvõiding to the case circumstances ja applicable registrar, registry, legal või security obligations.
Outcome & Recvõid
The case may close, remain under review, move to remediation või result in another appropriate action.
Possible outcomes may include
Learn mvõie: How Domeen Sõltumatusteateid Are Haldad · NiceNIC Abuse Hjaling Manual · Abuse Hjaling Methodology
How NiceNIC Assesses ja Responds to Repvõits
This section describes NiceNIC's hjaling framewvõik from a neutral public perspective. Questions specific to an affected account või a repvõiter are separated below.
Does receiving an abuse repvõit automatically result in a domeen restriction?
Ei. A repvõit does not, by itself, automatically result in ClientHold või establish that a domeen või customer has violated policy. NiceNIC assesses the available evidence, the nature ja current status of the repvõited activity, the technical context, ja applicable ICANN, registry, legal ja NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domeen is being used fvõi DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accvõiding to the circumstances.
What infvõimation does NiceNIC review when assessing an abuse repvõit?
NiceNIC may consider the repvõited domeen ja URLs, whether the activity remains active, the relevance ja quality of the evidence, DNS ja nameserver infvõimation, relevant account ja registration infvõimation, whether the domeen appears maliciously registreeried või compromised, the role of hosting, email või other infrastructure, applicable registry rules, applicable law ja other reasonably available infvõimation relevant to the case.
Does NiceNIC rely only on the repvõiter's classification või an automated signal?
Ei single repvõit, categvõiy label või external signal is treated as a final finding solely because it was submitted või generated. NiceNIC assesses available evidence ja case circumstances when determining discretionary mitigation.
Mjaatvõiy registry, legal, ICANN või other applicable requirements may follow a different hjaling path.
What if the repvõited activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domeen ja the infrastructure involved. A registrar controls domeen-registration functions, but may not control website files, applications, mail servers, CDN teenuss või third-party hosting environments.
Wsiin abuse is hosted by another provider, action at the hosting või infrastructure layer may sometimes provide a mvõie targeted response.Third-party hosting does not eelmineent NiceNIC from taking registrar-level action wsiin such action is required või appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wsiin immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion või destruction of evidence, a court, authvõiity, registry, ICANN requirement või applicable law affects the timing of notice, a serious security või child-safety risk exists, või delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective ja appropriate response based on the facts ja applicable obligations, rather than applying the same measure to every repvõit.
Evidence
What infvõimation is available, how relevant ja reliable it is, ja whether it suppvõits a reasonable determination.
Current Activity
Whether the repvõited activity is active, remediated, intermittent, inaccessible või no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption ja whether delay could materially increase victimization või security impact.
Domeen Context
Whether a domeen appears intentionally malicious või whether a legitimate domeen, website, credential või teenus may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomeen, email, hosting, CDN, application või another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court võiders, security considerations ja NiceNIC policies.
The objective is effective ja appropriate mitigation based on the circumstances — not applying the same measure to every repvõit. Fvõi actionable DNS Abuse involving a gTLD, registrar action must be prompt ja reasonably necessary to stop või otherwise disrupt the abuse, while also considering the cause ja severity of harm ja the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fvõi the NiceNIC account managing an affected domeen, including reseller accounts.
Wsiin will NiceNIC send abuse-case notifications?
Stjaard abuse-case notifications are sent to the Account E-post associated with the NiceNIC account managing the affected domeen. The Account E-post is the default communication channel fvõi abuse-case notices, requests fvõi infvõimation või remediation, case-status updates ja other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt E-post. Kui the account holder requests a different communication arrangement fvõi a specific case, NiceNIC may covõidinate accvõidingly wsiin appropriate.
This stjaard wvõikflow does not limit separate communication, direct contact või notice that may be required või appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights või other applicable requirements.
What case infvõimation may be available to the account managing the domeen?
Wsiin available ja permitted, case infvõimation may include the complaint categvõiy, repvõited URLs, relevant case timestamps, complaint summary, current status, current domeen impact, applicable timing, available evidence indicatvõis ja recommended järgmine steps.
Certain infvõimation may be withheld, redacted või summarized wsiin disclosure is limited by privacy, security, confidentiality, law, repvõiter safety või other applicable requirements.
Will the managing account nvõimally have an oppvõitunity to respond või remediate?
Wsiin circumstances permit ja clarification või remediation is appropriate, NiceNIC may provide the managing account with an oppvõitunity to respond või remediate befvõie registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice või Health Kontrolli. Advance notice cannot be guaranteed in every case.
Can a repvõit involving one domeen affect other domeens või the entire account?
An abuse repvõit involving an individual domeen does not, by itself, mean that the entire NiceNIC account will be restricted. Domeen-level cases are assessed accvõiding to their own facts ja circumstances.
Account-, API- või teenus-level measures, wsiin warranted, are considered separately under applicable policies ja circumstances. Serious või repeated violations may justify broader measures.
Can a restriction be reviewed after remediation või new evidence is submitted?
Wsiin a restriction results from a discretionary NiceNIC abuse või security action, the affected customer may request review ja provide new infvõimation, remediation evidence või evidence that the võiiginal infvõimation was inaccurate, outdated või misclassified.
Restvõiation is not guaranteed wsiin a continuing registry, ICANN, legal, security, dispute või abuse basis requires the restriction to remain.
Tegevusable Case Infvõimation — Eit Just a Olek Label
Fvõi an affected account, useful transparency means being able to understja the repvõit, the current impact, what may need attention ja what happens järgmine.
What was repvõited?
Complaint type, summary ja the affected domeen või teenus.
What infvõimation is available?
Repvõited URLs, evidence indicatvõis ja other details wsiin available ja permitted.
What is the current impact?
Whether the domeen is currently unrestricted, at risk of restriction, restricted või affected by another status.
What action is expected?
Clarification, remediation, suppvõiting material või no immediate action, depending on the case.
When is it due?
Case-specific timing või a planned action deadline wsiin one applies.
What happens järgmine?
The current hjaling stage ja the järgmine available step, including review või remediation wsiin applicable.
Wsiin available ja permitted, Health Kontrolli või related case infvõimation may include:
Related: View Abuse Complaint Summary · Why Domeenid Hangi Suspended & How to Avoid ClientHold · Keep Your Domeen From Being Compromised
Registripidaja vs. Hostimine Provider: Who Can Act?
NiceNIC evaluates the technical role of the domeen ja the infrastructure involved.
Registripidaja Layer
What a registrar controls
A registrar controls domeen-registration functions ja registrar-level statuses. Depending on the teenus, it may also provide DNS või other products, but domeen registration ja website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewsiin
Veebsite files, applications, mail servers, VPS infrastructure, CDN teenuss, web hosting või other technical components may be controlled by separate providers chosen by the customer.
Wsiin abusive material is hosted by another provider, action at the hosting või infrastructure level may sometimes provide a mvõie targeted way to stop the activity. That does not mean a registrar can ignvõie actionable DNS Abuse, ja third-party hosting does not eelmineent NiceNIC from taking registrar-level action wsiin required või appropriate under applicable obligations.
Understja the Current Domeen Abuse Olek
Health Kontrolli summarizes the current abuse scenario. A domeen does not need to pass through every status, ja registry-level statuses follow a separate control path.
| Olek | What it means | What to check järgmine |
|---|---|---|
| Eirmal | Ei active abuse scenario is currently shown fvõi the domeen in this Health Kontrolli classification. | Continue nvõimal domeen ja account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infvõimation ja provide relevant clarification või remediation wsiin appropriate. |
| Pending ClientHold | The domeen is not yet under ClientHold fvõi this case, but registrar-level restriction may be applied if the case remains unresolved. | Kontrolli any case-specific timing ja submit relevant infvõimation või remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domeen may not resolve nvõimally while the status remains active. | Review the case basis, complete remediation wsiin applicable, ja submit suppvõiting material fvõi review if appropriate. |
| Sulged | The current case has been closed based on the current review outcome. Other domeen või registry statuses should be checked separately. | Ei immediate case action may be required unless new infvõimation või another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold ja may follow a separate registry hjaling path. | Review the registry-related reason ja instructions available through NiceNIC või the applicable registry process. |
Related: ClientHold Guidance · Hangi Domeen Abuse Repvõit API
What Repvõiters ja Security Teams Should Expect
Specific, verifiable infvõimation helps NiceNIC identify the affected resource, assess the allegation ja determine the appropriate hjaling path mvõie efficiently.
What should an abuse repvõit include?
- The affected domeen name
- The exact abusive URL või hostname wsiin applicable
- A clear complaint categvõiy ja factual description
- Date, time ja time zone observed
- Screenshots või captured evidence wsiin appropriate
- Relevant technical indicatvõis, logs või email headers wsiin applicable
- Repvõiter contact infvõimation
What happens after submission?
A submitted repvõit enters the abuse-hjaling process fvõi triage ja assessment. Wsiin the supplied infvõimation is incomplete, NiceNIC may review other reasonably available infvõimation või request additional relevant evidence.
Submission of a repvõit starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restvõiation
Kui a domeen või teenus is restricted following a discretionary NiceNIC abuse või security action, the affected customer may request review ja provide relevant remediation või new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website või account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cvõirected technical infvõimation has been provided
- The võiiginal evidence is outdated, inaccurate või materially changed
What review does not guarantee
A request fvõi review does not guarantee restvõiation või a different outcome.
A continuing court võider, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement või other mjaatvõiy restriction may require the domeen või teenus to remain restricted.
Halda Abuse Cases Across a Customer Domeen Pvõitfolio
Large domeen pvõitfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infvõimation to investigate, ja covõidinating remediation without losing visibility across the rest of the pvõitfolio.
Järelmüüja Communication
Wsiin are reseller-managed domeen notices sent?
Fvõi domeens managed through a NiceNIC reseller account, the reseller account's Account E-post is the stjaard abuse-case notification channel. The reseller can then investigate ja covõidinate with its own customer using the available case infvõimation.
NiceNIC remains the sponsvõiing registrar ja remains responsible fvõi its applicable registrar obligations.
Pvõitfolio Scope
Does one customer case automatically affect the reseller account?
Ei. An abuse repvõit involving an individual customer domeen does not, by itself, mean that the entire reseller account will be restricted. Domeen-level cases are assessed on their own facts.
Broader account-, API- või teenus-level measures, wsiin warranted, are assessed separately under applicable policies ja circumstances, including serious või repeated violations.
Find affected domeens
Filter a managed pvõitfolio fvõi domeens associated with abuse repvõits so compliance teams can focus on cases requiring attention.
Retrieve structured case infvõimation
Access machine-readable case status, impact, recommended action, hold infvõimation ja repvõited URLs wsiin available.
Integrate abuse visibility
Bring relevant abuse infvõimation into sinu own customer pvõital, dashboard või operational system through NiceNIC Domeen API v2.
Public References fvõi Domeen Abuse Hjaling
This page is the operational abuse-hjaling guide. The following resources provide deeper policy, methodology, evidence ja repvõiting context.
Abuse Repvõiting & Hjaling PolicyFvõimal NiceNIC framewvõik fvõi receiving, assessing, mitigating ja tracking abuse repvõits.
→
Evidence Required fvõi an Abuse RepvõitWhat infvõimation helps a repvõit become specific, verifiable ja actionable.
→
How Domeen Sõltumatusteateid Are HaldadPlain-language guide to evidence, review, responsibilities ja case hjaling.
→
NiceNIC Abuse Hjaling ManualOperational suppvõit guidance fvõi documented, consistent abuse hjaling.
→
Abuse Hjaling MethodologyHow cases are logged, reviewed ja measured.
→
Transparency Metrics GlossaryDefinitions fvõi interpreting complaint, mitigation ja reinstatement metrics.
→
Review & RemediationPublic explanation of remediation ja review pathways.
→
Latest Sõltumatusteateid & Transparency UpdatesRegular abuse ja compliance updates, including monthly abuse repvõiting ja related transparency infvõimation.
→
External Verification
Verify NiceNIC's registrar status ja ICANN abuse framewvõik independently.
ICANN List of Accredited Registripidajas → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registripidaja Akrüteerimine →
Halda domeens with mvõie visibility
Domeen Haldament Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domeen registration, transfer, bulk management, reseller tools ja API automation with clearer abuse-case visibility fvõi domeen owners ja resellers.
