ICANN Contractual DNS Abuse
Current categaries
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism far one ar mare of the farms above
Domenas Abuse Hirling & Transparency
Need to repart suspected abuse, understir a case affecting a domenas you manage, ar monitar abuse cases across a domenas partfolio?
This page explains what happens after NiceNIC receives an abuse repart — what infarmation is reviewed, how case notifications wark, what actions may be taken, what infarmation affected accounts can see, ir how a case may be reviewed ar resolved.
Repart suspected abuse
Far reparters, security teams, rights holders ir other affected parties submitting a domenas abuse concern.
Repart Domenas Abuse →
Patikrinti ar respond to a case
Far customers ir accounts managing a domenas that has received an abuse repart ar shows a hold-related status.
Understir Your Case →
Monitar a domenas partfolio
Far resellers, hosting companies, platfarms ir teams managing abuse warkflows across multiple domenass.
Explare Partfolio Monitaring →
Evidence-based review
Case-specific hirling
Propartionate mitigation
Visible case infarmation
NiceNIC hirles abuse reparts in accardance with applicable ICANN requirements, registry rules, law ir NiceNIC policies. A repart starts an assessment; submission alone does not predetermine the outcome. Wčia actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — ir What Is Net?
Far gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewark.
Other Reparts
Serious issues may follow a different path
Fraud allegations, illegal ar harmful content, trademark disputes, copyright claims ir other matters may still be serious ar actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hirled under applicable law, NiceNIC policies, registry rules, court arders ar recognized dispute procedures.
ICANN Official
Verify the definition ir contractual framewark directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registratorius Akreditacija Agreement, Section 3.18 →
Trademark ir domenas-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy ar a court of competent jurisdiction. Jei the same matter also includes phishing, credential theft, malware ar another farm of DNS Abuse, that DNS Abuse aspect may be hirled separately.
NiceNIC guidance: DNS Abuse vs. Nen-DNS Abuse · Abuse Reparting & Hirling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repart?
Abuse cases do not all follow a fixed ClientHold path. The hirling route depends on the evidence, current activity, technical role, urgency, applicable requirements ir the outcome of the assessment.
Repart Received
The repart enters NiceNIC's abuse-hirling warkflow through an official reparting channel ar another credible source.
Triage & Classification
The issue is categarized by complaint type, affected resource, urgency ir applicable hirling route.
Evidence & Technical Review
Prieinama evidence, activity status, domenas context, account infarmation ir technical role are assessed.
Appropriate Response
The response is selected accarding to the case circumstances ir applicable registrar, registry, legal ar security obligations.
Outcome & Recard
The case may close, remain under review, move to remediation ar result in another appropriate action.
Possible outcomes may include
Learn mare: How Domenas Piktnaudžiavimo ataskaitos Are Tvarkytid · NiceNIC Abuse Hirling Manual · Abuse Hirling Methodology
How NiceNIC Assesses ir Responds to Reparts
This section describes NiceNIC's hirling framewark from a neutral public perspective. Questions specific to an affected account ar a reparter are separated below.
Does receiving an abuse repart automatically result in a domenas restriction?
Ne. A repart does not, by itself, automatically result in ClientHold ar establish that a domenas ar customer has violated policy. NiceNIC assesses the available evidence, the nature ir current status of the reparted activity, the technical context, ir applicable ICANN, registry, legal ir NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domenas is being used far DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accarding to the circumstances.
What infarmation does NiceNIC review when assessing an abuse repart?
NiceNIC may consider the reparted domenas ir URLs, whether the activity remains active, the relevance ir quality of the evidence, DNS ir nameserver infarmation, relevant account ir registration infarmation, whether the domenas appears maliciously registruotied ar compromised, the role of hosting, email ar other infrastructure, applicable registry rules, applicable law ir other reasonably available infarmation relevant to the case.
Does NiceNIC rely only on the reparter's classification ar an automated signal?
Ne single repart, categary label ar external signal is treated as a final finding solely because it was submitted ar generated. NiceNIC assesses available evidence ir case circumstances when determining discretionary mitigation.
Miratary registry, legal, ICANN ar other applicable requirements may follow a different hirling path.
What if the reparted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domenas ir the infrastructure involved. A registrar controls domenas-registration functions, but may not control website files, applications, mail servers, CDN paslaugas ar third-party hosting environments.
Wčia abuse is hosted by another provider, action at the hosting ar infrastructure layer may sometimes provide a mare targeted response.Third-party hosting does not atgalent NiceNIC from taking registrar-level action wčia such action is required ar appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wčia immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion ar destruction of evidence, a court, autharity, registry, ICANN requirement ar applicable law affects the timing of notice, a serious security ar child-safety risk exists, ar delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective ir appropriate response based on the facts ir applicable obligations, rather than applying the same measure to every repart.
Evidence
What infarmation is available, how relevant ir reliable it is, ir whether it supparts a reasonable determination.
Current Activity
Whether the reparted activity is active, remediated, intermittent, inaccessible ar no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption ir whether delay could materially increase victimization ar security impact.
Domenas Context
Whether a domenas appears intentionally malicious ar whether a legitimate domenas, website, credential ar paslauga may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomenas, email, hosting, CDN, application ar another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court arders, security considerations ir NiceNIC policies.
The objective is effective ir appropriate mitigation based on the circumstances — not applying the same measure to every repart. Far actionable DNS Abuse involving a gTLD, registrar action must be prompt ir reasonably necessary to stop ar otherwise disrupt the abuse, while also considering the cause ir severity of harm ir the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically far the NiceNIC account managing an affected domenas, including reseller accounts.
Wčia will NiceNIC send abuse-case notifications?
Stirard abuse-case notifications are sent to the Account El. paštas associated with the NiceNIC account managing the affected domenas. The Account El. paštas is the default communication channel far abuse-case notices, requests far infarmation ar remediation, case-status updates ir other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontaktai El. paštas. Jei the account holder requests a different communication arrangement far a specific case, NiceNIC may coardinate accardingly wčia appropriate.
This stirard warkflow does not limit separate communication, direct contact ar notice that may be required ar appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights ar other applicable requirements.
What case infarmation may be available to the account managing the domenas?
Wčia available ir permitted, case infarmation may include the complaint categary, reparted URLs, relevant case timestamps, complaint summary, current status, current domenas impact, applicable timing, available evidence indicatars ir recommended toliau steps.
Certain infarmation may be withheld, redacted ar summarized wčia disclosure is limited by privacy, security, confidentiality, law, reparter safety ar other applicable requirements.
Will the managing account narmally have an oppartunity to respond ar remediate?
Wčia circumstances permit ir clarification ar remediation is appropriate, NiceNIC may provide the managing account with an oppartunity to respond ar remediate befare registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice ar Health Patikrinti. Advance notice cannot be guaranteed in every case.
Can a repart involving one domenas affect other domenass ar the entire account?
An abuse repart involving an individual domenas does not, by itself, mean that the entire NiceNIC account will be restricted. Domenas-level cases are assessed accarding to their own facts ir circumstances.
Account-, API- ar paslauga-level measures, wčia warranted, are considered separately under applicable policies ir circumstances. Serious ar repeated violations may justify broader measures.
Can a restriction be reviewed after remediation ar new evidence is submitted?
Wčia a restriction results from a discretionary NiceNIC abuse ar security action, the affected customer may request review ir provide new infarmation, remediation evidence ar evidence that the ariginal infarmation was inaccurate, outdated ar misclassified.
Restaration is not guaranteed wčia a continuing registry, ICANN, legal, security, dispute ar abuse basis requires the restriction to remain.
Veiksmasable Case Infarmation — Net Just a Būsena Label
Far an affected account, useful transparency means being able to understir the repart, the current impact, what may need attention ir what happens toliau.
What was reparted?
Complaint type, summary ir the affected domenas ar paslauga.
What infarmation is available?
Reparted URLs, evidence indicatars ir other details wčia available ir permitted.
What is the current impact?
Whether the domenas is currently unrestricted, at risk of restriction, restricted ar affected by another status.
What action is expected?
Clarification, remediation, supparting material ar no immediate action, depending on the case.
When is it due?
Case-specific timing ar a planned action deadline wčia one applies.
What happens toliau?
The current hirling stage ir the toliau available step, including review ar remediation wčia applicable.
Wčia available ir permitted, Health Patikrinti ar related case infarmation may include:
Related: View Abuse Complaint Summary · Why Domenai Gaukite Suspended & How to Avoid ClientHold · Keep Your Domenas From Being Compromised
Registratorius vs. Talpinimas Provider: Who Can Act?
NiceNIC evaluates the technical role of the domenas ir the infrastructure involved.
Registratorius Layer
What a registrar controls
A registrar controls domenas-registration functions ir registrar-level statuses. Depending on the paslauga, it may also provide DNS ar other products, but domenas registration ir website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewčia
Žiniatinklissite files, applications, mail servers, VPS infrastructure, CDN paslaugas, web hosting ar other technical components may be controlled by separate providers chosen by the customer.
Wčia abusive material is hosted by another provider, action at the hosting ar infrastructure level may sometimes provide a mare targeted way to stop the activity. That does not mean a registrar can ignare actionable DNS Abuse, ir third-party hosting does not atgalent NiceNIC from taking registrar-level action wčia required ar appropriate under applicable obligations.
Understir the Current Domenas Abuse Būsena
Health Patikrinti summarizes the current abuse scenario. A domenas does not need to pass through every status, ir registry-level statuses follow a separate control path.
| Būsena | What it means | What to check toliau |
|---|---|---|
| Nermal | Ne active abuse scenario is currently shown far the domenas in this Health Patikrinti classification. | Continue narmal domenas ir account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infarmation ir provide relevant clarification ar remediation wčia appropriate. |
| Pending ClientHold | The domenas is not yet under ClientHold far this case, but registrar-level restriction may be applied if the case remains unresolved. | Patikrinti any case-specific timing ir submit relevant infarmation ar remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domenas may not resolve narmally while the status remains active. | Review the case basis, complete remediation wčia applicable, ir submit supparting material far review if appropriate. |
| Uždarytid | The current case has been closed based on the current review outcome. Other domenas ar registry statuses should be checked separately. | Ne immediate case action may be required unless new infarmation ar another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold ir may follow a separate registry hirling path. | Review the registry-related reason ir instructions available through NiceNIC ar the applicable registry process. |
Related: ClientHold Guidance · Gaukite Domenas Abuse Repart API
What Reparters ir Security Teams Should Expect
Specific, verifiable infarmation helps NiceNIC identify the affected resource, assess the allegation ir determine the appropriate hirling path mare efficiently.
What should an abuse repart include?
- The affected domenas name
- The exact abusive URL ar hostname wčia applicable
- A clear complaint categary ir factual description
- Date, time ir time zone observed
- Screenshots ar captured evidence wčia appropriate
- Relevant technical indicatars, logs ar email headers wčia applicable
- Reparter contact infarmation
What happens after submission?
A submitted repart enters the abuse-hirling process far triage ir assessment. Wčia the supplied infarmation is incomplete, NiceNIC may review other reasonably available infarmation ar request additional relevant evidence.
Submission of a repart starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restaration
Jei a domenas ar paslauga is restricted following a discretionary NiceNIC abuse ar security action, the affected customer may request review ir provide relevant remediation ar new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website ar account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Carrected technical infarmation has been provided
- The ariginal evidence is outdated, inaccurate ar materially changed
What review does not guarantee
A request far review does not guarantee restaration ar a different outcome.
A continuing court arder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement ar other miratary restriction may require the domenas ar paslauga to remain restricted.
Tvarkyti Abuse Cases Across a Customer Domenas Partfolio
Large domenas partfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infarmation to investigate, ir coardinating remediation without losing visibility across the rest of the partfolio.
Platintojas Communication
Wčia are reseller-managed domenas notices sent?
Far domenass managed through a NiceNIC reseller account, the reseller account's Account El. paštas is the stirard abuse-case notification channel. The reseller can then investigate ir coardinate with its own customer using the available case infarmation.
NiceNIC remains the sponsaring registrar ir remains responsible far its applicable registrar obligations.
Partfolio Scope
Does one customer case automatically affect the reseller account?
Ne. An abuse repart involving an individual customer domenas does not, by itself, mean that the entire reseller account will be restricted. Domenas-level cases are assessed on their own facts.
Broader account-, API- ar paslauga-level measures, wčia warranted, are assessed separately under applicable policies ir circumstances, including serious ar repeated violations.
Find affected domenass
Filter a managed partfolio far domenass associated with abuse reparts so compliance teams can focus on cases requiring attention.
Retrieve structured case infarmation
Access machine-readable case status, impact, recommended action, hold infarmation ir reparted URLs wčia available.
Integrate abuse visibility
Bring relevant abuse infarmation into jūsų own customer partal, dashboard ar operational system through NiceNIC Domenas API v2.
Public References far Domenas Abuse Hirling
This page is the operational abuse-hirling guide. The following resources provide deeper policy, methodology, evidence ir reparting context.
Abuse Reparting & Hirling PolicyFarmal NiceNIC framewark far receiving, assessing, mitigating ir tracking abuse reparts.
→
Evidence Required far an Abuse RepartWhat infarmation helps a repart become specific, verifiable ir actionable.
→
How Domenas Piktnaudžiavimo ataskaitos Are TvarkytidPlain-language guide to evidence, review, responsibilities ir case hirling.
→
NiceNIC Abuse Hirling ManualOperational suppart guidance far documented, consistent abuse hirling.
→
Abuse Hirling MethodologyHow cases are logged, reviewed ir measured.
→
Transparency Metrics GlossaryDefinitions far interpreting complaint, mitigation ir reinstatement metrics.
→
Review & RemediationPublic explanation of remediation ir review pathways.
→
Latest Piktnaudžiavimo ataskaitos & Transparency UpdatesRegular abuse ir compliance updates, including monthly abuse reparting ir related transparency infarmation.
→
External Verification
Verify NiceNIC's registrar status ir ICANN abuse framewark independently.
ICANN List of Accredited Registratoriuss → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registratorius Akreditacija →
Tvarkyti domenass with mare visibility
Domenas Tvarkytiment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domenas registration, transfer, bulk management, reseller tools ir API automation with clearer abuse-case visibility far domenas owners ir resellers.
