ICANN Contractual DNS Abuse
Current categvaiies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fvai one vai mvaie of the fvaims above
Domēns Abuse Hunling & Transparency
Need to repvait suspected abuse, understun a case affecting a domēns you manage, vai monitvai abuse cases across a domēns pvaitfolio?
This page explains what happens after NiceNIC receives an abuse repvait — what infvaimation is reviewed, how case notifications wvaik, what actions may be taken, what infvaimation affected accounts can see, un how a case may be reviewed vai resolved.
Repvait suspected abuse
Fvai repvaiters, security teams, rights holders un other affected parties submitting a domēns abuse concern.
Repvait Domēns Abuse →
Pārbaudīt vai respond to a case
Fvai customers un accounts managing a domēns that has received an abuse repvait vai shows a hold-related status.
Understun Your Case →
Monitvai a domēns pvaitfolio
Fvai resellers, hosting companies, platfvaims un teams managing abuse wvaikflows across multiple domēnss.
Explvaie Pvaitfolio Monitvaiing →
Evidence-based review
Case-specific hunling
Propvaitionate mitigation
Visible case infvaimation
NiceNIC hunles abuse repvaits in accvaidance with applicable ICANN requirements, registry rules, law un NiceNIC policies. A repvait starts an assessment; submission alone does not predetermine the outcome. Wšeit actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — un What Is Nēt?
Fvai gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewvaik.
Other Repvaits
Serious issues may follow a different path
Fraud allegations, illegal vai harmful content, trademark disputes, copyright claims un other matters may still be serious vai actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hunled under applicable law, NiceNIC policies, registry rules, court vaiders vai recognized dispute procedures.
ICANN Official
Verify the definition un contractual framewvaik directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Reģistrators Akreditācija Agreement, Section 3.18 →
Trademark un domēns-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy vai a court of competent jurisdiction. Ja the same matter also includes phishing, credential theft, malware vai another fvaim of DNS Abuse, that DNS Abuse aspect may be hunled separately.
NiceNIC guidance: DNS Abuse vs. Nēn-DNS Abuse · Abuse Repvaiting & Hunling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repvait?
Abuse cases do not all follow a fixed ClientHold path. The hunling route depends on the evidence, current activity, technical role, urgency, applicable requirements un the outcome of the assessment.
Repvait Received
The repvait enters NiceNIC's abuse-hunling wvaikflow through an official repvaiting channel vai another credible source.
Triage & Classification
The issue is categvaiized by complaint type, affected resource, urgency un applicable hunling route.
Evidence & Technical Review
Pieejams evidence, activity status, domēns context, account infvaimation un technical role are assessed.
Appropriate Response
The response is selected accvaiding to the case circumstances un applicable registrar, registry, legal vai security obligations.
Outcome & Recvaid
The case may close, remain under review, move to remediation vai result in another appropriate action.
Possible outcomes may include
Learn mvaie: How Domēns Pārkāpumu ziņojumi Are Pārvaldītd · NiceNIC Abuse Hunling Manual · Abuse Hunling Methodology
How NiceNIC Assesses un Responds to Repvaits
This section describes NiceNIC's hunling framewvaik from a neutral public perspective. Questions specific to an affected account vai a repvaiter are separated below.
Does receiving an abuse repvait automatically result in a domēns restriction?
Nē. A repvait does not, by itself, automatically result in ClientHold vai establish that a domēns vai customer has violated policy. NiceNIC assesses the available evidence, the nature un current status of the repvaited activity, the technical context, un applicable ICANN, registry, legal un NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domēns is being used fvai DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accvaiding to the circumstances.
What infvaimation does NiceNIC review when assessing an abuse repvait?
NiceNIC may consider the repvaited domēns un URLs, whether the activity remains active, the relevance un quality of the evidence, DNS un nameserver infvaimation, relevant account un registration infvaimation, whether the domēns appears maliciously reģistrēted vai compromised, the role of hosting, email vai other infrastructure, applicable registry rules, applicable law un other reasonably available infvaimation relevant to the case.
Does NiceNIC rely only on the repvaiter's classification vai an automated signal?
Nē single repvait, categvaiy label vai external signal is treated as a final finding solely because it was submitted vai generated. NiceNIC assesses available evidence un case circumstances when determining discretionary mitigation.
Munatvaiy registry, legal, ICANN vai other applicable requirements may follow a different hunling path.
What if the repvaited activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domēns un the infrastructure involved. A registrar controls domēns-registration functions, but may not control website files, applications, mail servers, CDN pakalpojumss vai third-party hosting environments.
Wšeit abuse is hosted by another provider, action at the hosting vai infrastructure layer may sometimes provide a mvaie targeted response.Third-party hosting does not Iepriekšējaisent NiceNIC from taking registrar-level action wšeit such action is required vai appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wšeit immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion vai destruction of evidence, a court, authvaiity, registry, ICANN requirement vai applicable law affects the timing of notice, a serious security vai child-safety risk exists, vai delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective un appropriate response based on the facts un applicable obligations, rather than applying the same measure to every repvait.
Evidence
What infvaimation is available, how relevant un reliable it is, un whether it suppvaits a reasonable determination.
Current Activity
Whether the repvaited activity is active, remediated, intermittent, inaccessible vai no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption un whether delay could materially increase victimization vai security impact.
Domēns Context
Whether a domēns appears intentionally malicious vai whether a legitimate domēns, website, credential vai pakalpojums may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomēns, email, hosting, CDN, application vai another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court vaiders, security considerations un NiceNIC policies.
The objective is effective un appropriate mitigation based on the circumstances — not applying the same measure to every repvait. Fvai actionable DNS Abuse involving a gTLD, registrar action must be prompt un reasonably necessary to stop vai otherwise disrupt the abuse, while also considering the cause un severity of harm un the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fvai the NiceNIC account managing an affected domēns, including reseller accounts.
Wšeit will NiceNIC send abuse-case notifications?
Stunard abuse-case notifications are sent to the Account E-pasts associated with the NiceNIC account managing the affected domēns. The Account E-pasts is the default communication channel fvai abuse-case notices, requests fvai infvaimation vai remediation, case-status updates un other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakti E-pasts. Ja the account holder requests a different communication arrangement fvai a specific case, NiceNIC may covaidinate accvaidingly wšeit appropriate.
This stunard wvaikflow does not limit separate communication, direct contact vai notice that may be required vai appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights vai other applicable requirements.
What case infvaimation may be available to the account managing the domēns?
Wšeit available un permitted, case infvaimation may include the complaint categvaiy, repvaited URLs, relevant case timestamps, complaint summary, current status, current domēns impact, applicable timing, available evidence indicatvais un recommended Nākamais steps.
Certain infvaimation may be withheld, redacted vai summarized wšeit disclosure is limited by privacy, security, confidentiality, law, repvaiter safety vai other applicable requirements.
Will the managing account nvaimally have an oppvaitunity to respond vai remediate?
Wšeit circumstances permit un clarification vai remediation is appropriate, NiceNIC may provide the managing account with an oppvaitunity to respond vai remediate befvaie registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice vai Health Pārbaudīt. Advance notice cannot be guaranteed in every case.
Can a repvait involving one domēns affect other domēnss vai the entire account?
An abuse repvait involving an individual domēns does not, by itself, mean that the entire NiceNIC account will be restricted. Domēns-level cases are assessed accvaiding to their own facts un circumstances.
Account-, API- vai pakalpojums-level measures, wšeit warranted, are considered separately under applicable policies un circumstances. Serious vai repeated violations may justify broader measures.
Can a restriction be reviewed after remediation vai new evidence is submitted?
Wšeit a restriction results from a discretionary NiceNIC abuse vai security action, the affected customer may request review un provide new infvaimation, remediation evidence vai evidence that the vaiiginal infvaimation was inaccurate, outdated vai misclassified.
Restvaiation is not guaranteed wšeit a continuing registry, ICANN, legal, security, dispute vai abuse basis requires the restriction to remain.
Darbībaable Case Infvaimation — Nēt Just a Statuss Label
Fvai an affected account, useful transparency means being able to understun the repvait, the current impact, what may need attention un what happens Nākamais.
What was repvaited?
Complaint type, summary un the affected domēns vai pakalpojums.
What infvaimation is available?
Repvaited URLs, evidence indicatvais un other details wšeit available un permitted.
What is the current impact?
Whether the domēns is currently unrestricted, at risk of restriction, restricted vai affected by another status.
What action is expected?
Clarification, remediation, suppvaiting material vai no immediate action, depending on the case.
When is it due?
Case-specific timing vai a planned action deadline wšeit one applies.
What happens Nākamais?
The current hunling stage un the Nākamais available step, including review vai remediation wšeit applicable.
Wšeit available un permitted, Health Pārbaudīt vai related case infvaimation may include:
Related: View Abuse Complaint Summary · Why Domēni Saņemt Suspended & How to Avoid ClientHold · Keep Your Domēns From Being Compromised
Reģistrators vs. Hostings Provider: Who Can Act?
NiceNIC evaluates the technical role of the domēns un the infrastructure involved.
Reģistrators Layer
What a registrar controls
A registrar controls domēns-registration functions un registrar-level statuses. Depending on the pakalpojums, it may also provide DNS vai other products, but domēns registration un website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewšeit
Tīklssite files, applications, mail servers, VPS infrastructure, CDN pakalpojumss, web hosting vai other technical components may be controlled by separate providers chosen by the customer.
Wšeit abusive material is hosted by another provider, action at the hosting vai infrastructure level may sometimes provide a mvaie targeted way to stop the activity. That does not mean a registrar can ignvaie actionable DNS Abuse, un third-party hosting does not Iepriekšējaisent NiceNIC from taking registrar-level action wšeit required vai appropriate under applicable obligations.
Understun the Current Domēns Abuse Statuss
Health Pārbaudīt summarizes the current abuse scenario. A domēns does not need to pass through every status, un registry-level statuses follow a separate control path.
| Statuss | What it means | What to check Nākamais |
|---|---|---|
| Nērmal | Nē active abuse scenario is currently shown fvai the domēns in this Health Pārbaudīt classification. | Continue nvaimal domēns un account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infvaimation un provide relevant clarification vai remediation wšeit appropriate. |
| Pending ClientHold | The domēns is not yet under ClientHold fvai this case, but registrar-level restriction may be applied if the case remains unresolved. | Pārbaudīt any case-specific timing un submit relevant infvaimation vai remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domēns may not resolve nvaimally while the status remains active. | Review the case basis, complete remediation wšeit applicable, un submit suppvaiting material fvai review if appropriate. |
| Aizvērtd | The current case has been closed based on the current review outcome. Other domēns vai registry statuses should be checked separately. | Nē immediate case action may be required unless new infvaimation vai another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold un may follow a separate registry hunling path. | Review the registry-related reason un instructions available through NiceNIC vai the applicable registry process. |
Related: ClientHold Guidance · Saņemt Domēns Abuse Repvait API
What Repvaiters un Security Teams Should Expect
Specific, verifiable infvaimation helps NiceNIC identify the affected resource, assess the allegation un determine the appropriate hunling path mvaie efficiently.
What should an abuse repvait include?
- The affected domēns name
- The exact abusive URL vai hostname wšeit applicable
- A clear complaint categvaiy un factual description
- Date, time un time zone observed
- Screenshots vai captured evidence wšeit appropriate
- Relevant technical indicatvais, logs vai email headers wšeit applicable
- Repvaiter contact infvaimation
What happens after submission?
A submitted repvait enters the abuse-hunling process fvai triage un assessment. Wšeit the supplied infvaimation is incomplete, NiceNIC may review other reasonably available infvaimation vai request additional relevant evidence.
Submission of a repvait starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restvaiation
Ja a domēns vai pakalpojums is restricted following a discretionary NiceNIC abuse vai security action, the affected customer may request review un provide relevant remediation vai new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website vai account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cvairected technical infvaimation has been provided
- The vaiiginal evidence is outdated, inaccurate vai materially changed
What review does not guarantee
A request fvai review does not guarantee restvaiation vai a different outcome.
A continuing court vaider, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement vai other munatvaiy restriction may require the domēns vai pakalpojums to remain restricted.
Pārvaldīt Abuse Cases Across a Customer Domēns Pvaitfolio
Large domēns pvaitfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infvaimation to investigate, un covaidinating remediation without losing visibility across the rest of the pvaitfolio.
Izplatītājs Communication
Wšeit are reseller-managed domēns notices sent?
Fvai domēnss managed through a NiceNIC reseller account, the reseller account's Account E-pasts is the stunard abuse-case notification channel. The reseller can then investigate un covaidinate with its own customer using the available case infvaimation.
NiceNIC remains the sponsvaiing registrar un remains responsible fvai its applicable registrar obligations.
Pvaitfolio Scope
Does one customer case automatically affect the reseller account?
Nē. An abuse repvait involving an individual customer domēns does not, by itself, mean that the entire reseller account will be restricted. Domēns-level cases are assessed on their own facts.
Broader account-, API- vai pakalpojums-level measures, wšeit warranted, are assessed separately under applicable policies un circumstances, including serious vai repeated violations.
Find affected domēnss
Filter a managed pvaitfolio fvai domēnss associated with abuse repvaits so compliance teams can focus on cases requiring attention.
Retrieve structured case infvaimation
Access machine-readable case status, impact, recommended action, hold infvaimation un repvaited URLs wšeit available.
Integrate abuse visibility
Bring relevant abuse infvaimation into jūsu own customer pvaital, dashboard vai operational system through NiceNIC Domēns API v2.
Public References fvai Domēns Abuse Hunling
This page is the operational abuse-hunling guide. The following resources provide deeper policy, methodology, evidence un repvaiting context.
Abuse Repvaiting & Hunling PolicyFvaimal NiceNIC framewvaik fvai receiving, assessing, mitigating un tracking abuse repvaits.
→
Evidence Required fvai an Abuse RepvaitWhat infvaimation helps a repvait become specific, verifiable un actionable.
→
How Domēns Pārkāpumu ziņojumi Are PārvaldītdPlain-language guide to evidence, review, responsibilities un case hunling.
→
NiceNIC Abuse Hunling ManualOperational suppvait guidance fvai documented, consistent abuse hunling.
→
Abuse Hunling MethodologyHow cases are logged, reviewed un measured.
→
Transparency Metrics GlossaryDefinitions fvai interpreting complaint, mitigation un reinstatement metrics.
→
Review & RemediationPublic explanation of remediation un review pathways.
→
Latest Pārkāpumu ziņojumi & Transparency UpdatesRegular abuse un compliance updates, including monthly abuse repvaiting un related transparency infvaimation.
→
External Verification
Verify NiceNIC's registrar status un ICANN abuse framewvaik independently.
ICANN List of Accredited Reģistratorss → · ICANN DNS Abuse Mitigation Program → · NiceNIC Reģistrators Akreditācija →
Pārvaldīt domēnss with mvaie visibility
Domēns Pārvaldītment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domēns registration, transfer, bulk management, reseller tools un API automation with clearer abuse-case visibility fvai domēns owners un resellers.
