At ICANN87 in Bali, Indonesia, NiceNIC CEO Helen met with Alban Kwan, Co-Founder and CEO of the Trusted Notifier Network (TNN), to discuss stronger cooperation on trusted abuse reporting, responsible security responses, and the protection of legitimate domain users.
The discussion addressed a practical challenge for the domain industry: how to act effectively against phishing, malware, and other online threats while reducing the risk of mistaken decisions that disrupt legitimate businesses.
For NiceNIC, these priorities belong together. Victims need harmful activity to be investigated and stopped. Domain holders need decisions grounded in evidence, clear communication, and a meaningful opportunity to provide relevant information.
The meeting took place during the ICANN87 Annual General Meeting, held from October 17 to 22, 2026. It formed part of NiceNIC's continuing engagement with international security organizations on improving domain abuse handling.
Why Report Quality Was Central to the Discussion
A domain abuse report can set an important investigation in motion. Its usefulness depends on whether it identifies the harmful activity clearly, provides relevant evidence, and gives the receiving team enough context to assess what is happening.
For a registrar, an incomplete report can leave critical questions unanswered. Which page is involved? Is the reported activity still occurring? Has an otherwise legitimate website been compromised? Who can take the most effective action?
For the affected business, an incorrect report can create a different problem: time spent explaining legitimate activity, responding to a mistaken classification, or resolving avoidable service disruption.
These concerns make the quality and accountability of reporting a valuable area for cooperation between NiceNIC and TNN.
Alban brings approximately 18 years of experience across domain management, brand protection, and Internet governance. His APNIC 62 biography describes work across China, Japan, Korea, and the wider Asia-Pacific region. In his public account of his time at CSC, he also describes helping develop CSC's Greater China and Japan businesses and supporting corporate domain initiatives across APAC.
That background connects the concerns of brand owners seeking protection with the operational realities of the organizations receiving their reports.
What TNN Brings to Trusted Abuse Reporting
The Trusted Notifier Network's published model addresses both the reliability of notices and responsibility for the claims they contain. Its approach combines several elements:
- Confirmation with the affected party. A report is supported by verification with the victim or organization concerned.
- Human judgment. Verification includes a human decision on confirmation with the affected party.
- Accountability for reporting standards. Participating notifiers are subject to requirements and review, including the possibility of losing their status.
- Contractual responsibility. Indemnity arrangements connect the parties involved in submitting and acting on a notice.
TNN's explanation of its indemnity structure describes a chain involving the affected party, the notifier, TNN, and the intermediary receiving the report. The purpose is to attach responsibility to the information on which an intermediary is asked to act.
The scope of any indemnity protection depends on the applicable agreements between participating parties.
For the NiceNIC discussion, the useful question was how stronger verification and clearer responsibility could support more dependable cooperation. A well-supported report can help a security team explain the threat and help a registrar assess an appropriate response.
This also gives reporting organizations a constructive role beyond initial detection. Supplying context, responding to questions, and correcting information when circumstances change can all contribute to better case handling.
Protecting Victims and Legitimate Domain Holders
The need for prompt action is clear when a domain is being used to steal credentials or distribute malware. Delays can expose more people to harm.
At the same time, the circumstances of the domain matter. Consider an illustrative case: a legitimate business website is compromised and a phishing page is added without the owner’s knowledge. The malicious page needs to be addressed, while the business may also need help identifying and fixing the compromise.
ICANN's guidance on DNS abuse mitigation obligations recognizes this distinction. For covered gTLD registrations, actionable evidence of DNS abuse requires prompt, appropriate mitigation. The circumstances, severity of harm, and potential disruption to legitimate services inform that response.
The guidance also explains that suspending a compromised domain can affect its legitimate website, email, and other services. Depending on the case, coordination with the registrant or hosting provider may offer a more targeted way to address the problem.
NiceNIC’s objective is to strengthen that combination of effective action and careful judgment. Protecting legitimate customers includes helping distinguish malicious use from compromise, considering relevant remediation evidence, and correcting decisions when new information warrants a different assessment.
Keeping Public Reporting Accessible
Cooperation with specialist organizations is one part of a responsible reporting system. Individuals, businesses, security researchers, and other affected parties also need a clear way to raise concerns.
NiceNIC's domain abuse reporting page accepts reports involving domains sponsored by NiceNIC without requiring the reporter to hold a NiceNIC account.
Useful submissions identify the domain, the relevant URLs, and the activity being reported. Depending on the incident, supporting material may include screenshots, message headers, timestamps, or other technical evidence. For phishing reports, the affected brand or legitimate website can provide essential context.
Details about how the content was observed can also help. NiceNIC’s reporting guidance specifically asks for information such as the observer’s country, device, or browser where these affect what a website displays.
NiceNIC aims to keep improving how reports are acknowledged, reviewed, and followed up. Reporters should be able to understand what additional information would help, while case communication must respect applicable confidentiality and security limits.
The purpose of stronger cooperation is to make credible information easier to assess and use. Public reporting remains an essential source of that information.
Clearer Communication for Customers and Resellers
NiceNIC's Domain Abuse Handling and Transparency guide explains that an incoming report begins an assessment. Submission alone does not establish a violation or automatically trigger a domain restriction.
The guide also identifies the managing account’s Account Email as the default channel for abuse-case notifications. This is especially relevant to resellers managing domains for their customers.
For a reseller, a useful operational practice is to assign responsibility for monitoring that inbox and coordinating with the affected customer. A notice should reach someone who can identify the domain, contact the site operator or hosting provider, and supply relevant information.
When a customer disputes a report or has completed remediation, a clear account of what happened helps the review. NiceNIC's appeals and remediation guidance describes submitting the domain name, an explanation, actions taken, and supporting evidence through official support or case communications.
Where NiceNIC has imposed a discretionary abuse or security restriction, customers may request review. Restoration remains subject to the case circumstances and any continuing registry, legal, security, or other applicable requirements. Urgent cases can also require action without advance notice.
The goal for further improvement is practical: customers and resellers should understand the issue, know what information is needed, and have an appropriate channel for clarification or review.
Transparency That Can Be Examined
NiceNIC’s work on abuse handling also includes publishing monthly operational information.
The September 2026 Abuse Report records 26,608 complaints involving 9,659 domains. Those are different measures: multiple complaints can concern the same domain, and a recorded complaint does not itself establish confirmed abuse.
The report also covers complaint categories, response timing, domain pauses, and recovery activity. These records provide a basis for examining handling patterns over time, with the definitions and limitations needed to interpret them.
For NiceNIC, continued transparency is a way to make its work open to scrutiny and identify where processes need improvement. It gives customers, resellers, and security organizations more concrete information than a general promise to take abuse seriously.
The ICANN87 discussion with TNN adds another perspective to that work: the quality and accountability of incoming reports deserve attention alongside the decisions and actions taken after they arrive.
Continuing Cooperation Beyond Bali
The meeting with TNN builds on NiceNIC’s ongoing engagement with organizations including NetBeacon, ChainPatrol, and CleanDNS. These exchanges address related needs across the handling process, from threat reporting and evidence verification to communication and the review of disputed cases.
NiceNIC’s priorities for further cooperation include improving the usefulness of reports, responding appropriately to verified threats, strengthening opportunities for clarification and review, and helping resellers manage affected customer domains.
Progress in these areas depends on sustained work between the organizations that detect threats, those that manage domain registrations, and the people operating legitimate online services.
With 20 years of industry experience, NiceNIC continues to invest in those relationships. Its ICANN-accredited registrar entity is NICENIC INTERNATIONAL GROUP CO., LIMITED, listed under IANA Registrar ID 3765 in the IANA Registrar IDs registry.
Customers, resellers, and reporting organizations can use the NiceNIC Trust Center to review public information about registrar verification, reporting channels, and abuse handling.
NiceNIC’s commitment is to take credible reports seriously, act against substantiated threats, and treat legitimate domain holders fairly as its security processes continue to develop.
NiceNIC - Strong Against Abuse. Fair to Every Legitimate Domain Owner.
Primary Sources
The meeting account is based on NiceNIC’s ICANN87 participation materials and on-site photographs. Background information and public handling references were checked on October 22, 2026.
- ICANN87 Annual General Meeting - Conference location and dates.
- APNIC 62: Alban Kwan - Professional experience and Internet governance background.
- Alban Kwan's public CSC career statement - First-person account of his CSC experience.
- Trusted Notifier Network: The Model - Verification, accountability, and contractual responsibility.
- TNN: A Structured Chain of Indemnity - Explanation of the network's indemnity approach.
- ICANN: DNS Abuse Obligations Advisory - Registrar mitigation obligations and consideration of collateral damage.
- NiceNIC Domain Abuse Handling and Transparency - Current public handling framework and related guidance.
- NiceNIC September 2026 Abuse Report - Published operational statistics and definitions.
- IANA Registrar IDs - Registrar entity and identifier.
