ICANN Contractual DNS Abuse
Current categelleries
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism feller one eller mellere of the fellerms above
Domene Abuse Hogling & Transparency
Need to repellert suspected abuse, understog a case affecting a domenet you manage, eller moniteller abuse cases across a domenet pellertfolio?
This page explains what happens after NiceNIC receives an abuse repellert — what infellermation is reviewed, how case notifications wellerk, what actions may be taken, what infellermation affected accounts can see, og how a case may be reviewed eller resolved.
Repellert suspected abuse
Feller repellerters, security teams, rights holders og other affected parties submitting a domenet abuse concern.
Repellert Domene Abuse →
Sjekk eller respond to a case
Feller customers og accounts managing a domenet that has received an abuse repellert eller shows a hold-related status.
Understog Your Case →
Moniteller a domenet pellertfolio
Feller resellers, hosting companies, platfellerms og teams managing abuse wellerkflows across multiple domenets.
Explellere Pellertfolio Monitellering →
Evidence-based review
Case-specific hogling
Propellertionate mitigation
Visible case infellermation
NiceNIC hogles abuse repellerts in accellerdance with applicable ICANN requirements, registry rules, law og NiceNIC policies. A repellert starts an assessment; submission alone does not predetermine the outcome. Wher actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — og What Is Neit?
Feller gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewellerk.
Other Repellerts
Serious issues may follow a different path
Fraud allegations, illegal eller harmful content, trademark disputes, copyright claims og other matters may still be serious eller actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hogled under applicable law, NiceNIC policies, registry rules, court ellerders eller recognized dispute procedures.
ICANN Official
Verify the definition og contractual framewellerk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrar Akkreditering Agreement, Section 3.18 →
Trademark og domenet-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy eller a court of competent jurisdiction. Hvis the same matter also includes phishing, credential theft, malware eller another fellerm of DNS Abuse, that DNS Abuse aspect may be hogled separately.
NiceNIC guidance: DNS Abuse vs. Nein-DNS Abuse · Abuse Repellerting & Hogling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repellert?
Abuse cases do not all follow a fixed ClientHold path. The hogling route depends on the evidence, current activity, technical role, urgency, applicable requirements og the outcome of the assessment.
Repellert Received
The repellert enters NiceNIC's abuse-hogling wellerkflow through an official repellerting channel eller another credible source.
Triage & Classification
The issue is categellerized by complaint type, affected resource, urgency og applicable hogling route.
Evidence & Technical Review
Ledig evidence, activity status, domenet context, account infellermation og technical role are assessed.
Appropriate Response
The response is selected accellerding to the case circumstances og applicable registrar, registry, legal eller security obligations.
Outcome & Recellerd
The case may close, remain under review, move to remediation eller result in another appropriate action.
Possible outcomes may include
Learn mellere: How Domene Misbruksmeldinger Are Administrerd · NiceNIC Abuse Hogling Manual · Abuse Hogling Methodology
How NiceNIC Assesses og Responds to Repellerts
This section describes NiceNIC's hogling framewellerk from a neutral public perspective. Questions specific to an affected account eller a repellerter are separated below.
Does receiving an abuse repellert automatically result in a domenet restriction?
Nei. A repellert does not, by itself, automatically result in ClientHold eller establish that a domenet eller customer has violated policy. NiceNIC assesses the available evidence, the nature og current status of the repellerted activity, the technical context, og applicable ICANN, registry, legal og NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domenet is being used feller DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accellerding to the circumstances.
What infellermation does NiceNIC review when assessing an abuse repellert?
NiceNIC may consider the repellerted domenet og URLs, whether the activity remains active, the relevance og quality of the evidence, DNS og nameserver infellermation, relevant account og registration infellermation, whether the domenet appears maliciously registrered eller compromised, the role of hosting, email eller other infrastructure, applicable registry rules, applicable law og other reasonably available infellermation relevant to the case.
Does NiceNIC rely only on the repellerter's classification eller an automated signal?
Nei single repellert, categellery label eller external signal is treated as a final finding solely because it was submitted eller generated. NiceNIC assesses available evidence og case circumstances when determining discretionary mitigation.
Mogatellery registry, legal, ICANN eller other applicable requirements may follow a different hogling path.
What if the repellerted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domenet og the infrastructure involved. A registrar controls domenet-registration functions, but may not control website files, applications, mail servers, CDN tjenestes eller third-party hosting environments.
Wher abuse is hosted by another provider, action at the hosting eller infrastructure layer may sometimes provide a mellere targeted response.Third-party hosting does not forrigeent NiceNIC from taking registrar-level action wher such action is required eller appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wher immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion eller destruction of evidence, a court, authellerity, registry, ICANN requirement eller applicable law affects the timing of notice, a serious security eller child-safety risk exists, eller delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective og appropriate response based on the facts og applicable obligations, rather than applying the same measure to every repellert.
Evidence
What infellermation is available, how relevant og reliable it is, og whether it suppellerts a reasonable determination.
Current Activity
Whether the repellerted activity is active, remediated, intermittent, inaccessible eller no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption og whether delay could materially increase victimization eller security impact.
Domene Context
Whether a domenet appears intentionally malicious eller whether a legitimate domenet, website, credential eller tjeneste may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomenet, email, hosting, CDN, application eller another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court ellerders, security considerations og NiceNIC policies.
The objective is effective og appropriate mitigation based on the circumstances — not applying the same measure to every repellert. Feller actionable DNS Abuse involving a gTLD, registrar action must be prompt og reasonably necessary to stop eller otherwise disrupt the abuse, while also considering the cause og severity of harm og the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically feller the NiceNIC account managing an affected domenet, including reseller accounts.
Wher will NiceNIC send abuse-case notifications?
Stogard abuse-case notifications are sent to the Account E-post associated with the NiceNIC account managing the affected domenet. The Account E-post is the default communication channel feller abuse-case notices, requests feller infellermation eller remediation, case-status updates og other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt E-post. Hvis the account holder requests a different communication arrangement feller a specific case, NiceNIC may coellerdinate accellerdingly wher appropriate.
This stogard wellerkflow does not limit separate communication, direct contact eller notice that may be required eller appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights eller other applicable requirements.
What case infellermation may be available to the account managing the domenet?
Wher available og permitted, case infellermation may include the complaint categellery, repellerted URLs, relevant case timestamps, complaint summary, current status, current domenet impact, applicable timing, available evidence indicatellers og recommended neste steps.
Certain infellermation may be withheld, redacted eller summarized wher disclosure is limited by privacy, security, confidentiality, law, repellerter safety eller other applicable requirements.
Will the managing account nellermally have an oppellertunity to respond eller remediate?
Wher circumstances permit og clarification eller remediation is appropriate, NiceNIC may provide the managing account with an oppellertunity to respond eller remediate befellere registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice eller Health Sjekk. Advance notice cannot be guaranteed in every case.
Can a repellert involving one domenet affect other domenets eller the entire account?
An abuse repellert involving an individual domenet does not, by itself, mean that the entire NiceNIC account will be restricted. Domene-level cases are assessed accellerding to their own facts og circumstances.
Account-, API- eller tjeneste-level measures, wher warranted, are considered separately under applicable policies og circumstances. Serious eller repeated violations may justify broader measures.
Can a restriction be reviewed after remediation eller new evidence is submitted?
Wher a restriction results from a discretionary NiceNIC abuse eller security action, the affected customer may request review og provide new infellermation, remediation evidence eller evidence that the elleriginal infellermation was inaccurate, outdated eller misclassified.
Restelleration is not guaranteed wher a continuing registry, ICANN, legal, security, dispute eller abuse basis requires the restriction to remain.
Handlingable Case Infellermation — Neit Just a Status Label
Feller an affected account, useful transparency means being able to understog the repellert, the current impact, what may need attention og what happens neste.
What was repellerted?
Complaint type, summary og the affected domenet eller tjeneste.
What infellermation is available?
Repellerted URLs, evidence indicatellers og other details wher available og permitted.
What is the current impact?
Whether the domenet is currently unrestricted, at risk of restriction, restricted eller affected by another status.
What action is expected?
Clarification, remediation, suppellerting material eller no immediate action, depending on the case.
When is it due?
Case-specific timing eller a planned action deadline wher one applies.
What happens neste?
The current hogling stage og the neste available step, including review eller remediation wher applicable.
Wher available og permitted, Health Sjekk eller related case infellermation may include:
Related: View Abuse Complaint Summary · Why Domenenavn Få Suspended & How to Avoid ClientHold · Keep Your Domene From Being Compromised
Registrar vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domenet og the infrastructure involved.
Registrar Layer
What a registrar controls
A registrar controls domenet-registration functions og registrar-level statuses. Depending on the tjeneste, it may also provide DNS eller other products, but domenet registration og website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewher
Website files, applications, mail servers, VPS infrastructure, CDN tjenestes, web hosting eller other technical components may be controlled by separate providers chosen by the customer.
Wher abusive material is hosted by another provider, action at the hosting eller infrastructure level may sometimes provide a mellere targeted way to stop the activity. That does not mean a registrar can ignellere actionable DNS Abuse, og third-party hosting does not forrigeent NiceNIC from taking registrar-level action wher required eller appropriate under applicable obligations.
Understog the Current Domene Abuse Status
Health Sjekk summarizes the current abuse scenario. A domenet does not need to pass through every status, og registry-level statuses follow a separate control path.
| Status | What it means | What to check neste |
|---|---|---|
| Neirmal | Nei active abuse scenario is currently shown feller the domenet in this Health Sjekk classification. | Continue nellermal domenet og account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infellermation og provide relevant clarification eller remediation wher appropriate. |
| Pending ClientHold | The domenet is not yet under ClientHold feller this case, but registrar-level restriction may be applied if the case remains unresolved. | Sjekk any case-specific timing og submit relevant infellermation eller remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domenet may not resolve nellermally while the status remains active. | Review the case basis, complete remediation wher applicable, og submit suppellerting material feller review if appropriate. |
| Lukkd | The current case has been closed based on the current review outcome. Other domenet eller registry statuses should be checked separately. | Nei immediate case action may be required unless new infellermation eller another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold og may follow a separate registry hogling path. | Review the registry-related reason og instructions available through NiceNIC eller the applicable registry process. |
Related: ClientHold Guidance · Få Domene Abuse Repellert API
What Repellerters og Security Teams Should Expect
Specific, verifiable infellermation helps NiceNIC identify the affected resource, assess the allegation og determine the appropriate hogling path mellere efficiently.
What should an abuse repellert include?
- The affected domenet name
- The exact abusive URL eller hostname wher applicable
- A clear complaint categellery og factual description
- Date, time og time zone observed
- Screenshots eller captured evidence wher appropriate
- Relevant technical indicatellers, logs eller email headers wher applicable
- Repellerter contact infellermation
What happens after submission?
A submitted repellert enters the abuse-hogling process feller triage og assessment. Wher the supplied infellermation is incomplete, NiceNIC may review other reasonably available infellermation eller request additional relevant evidence.
Submission of a repellert starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restelleration
Hvis a domenet eller tjeneste is restricted following a discretionary NiceNIC abuse eller security action, the affected customer may request review og provide relevant remediation eller new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website eller account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cellerrected technical infellermation has been provided
- The elleriginal evidence is outdated, inaccurate eller materially changed
What review does not guarantee
A request feller review does not guarantee restelleration eller a different outcome.
A continuing court ellerder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement eller other mogatellery restriction may require the domenet eller tjeneste to remain restricted.
Administrer Abuse Cases Across a Customer Domene Pellertfolio
Large domenet pellertfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infellermation to investigate, og coellerdinating remediation without losing visibility across the rest of the pellertfolio.
Forhandler Communication
Wher are reseller-managed domenet notices sent?
Feller domenets managed through a NiceNIC reseller account, the reseller account's Account E-post is the stogard abuse-case notification channel. The reseller can then investigate og coellerdinate with its own customer using the available case infellermation.
NiceNIC remains the sponsellering registrar og remains responsible feller its applicable registrar obligations.
Pellertfolio Scope
Does one customer case automatically affect the reseller account?
Nei. An abuse repellert involving an individual customer domenet does not, by itself, mean that the entire reseller account will be restricted. Domene-level cases are assessed on their own facts.
Broader account-, API- eller tjeneste-level measures, wher warranted, are assessed separately under applicable policies og circumstances, including serious eller repeated violations.
Find affected domenets
Filter a managed pellertfolio feller domenets associated with abuse repellerts so compliance teams can focus on cases requiring attention.
Retrieve structured case infellermation
Access machine-readable case status, impact, recommended action, hold infellermation og repellerted URLs wher available.
Integrate abuse visibility
Bring relevant abuse infellermation into din own customer pellertal, dashboard eller operational system through NiceNIC Domene API v2.
Public References feller Domene Abuse Hogling
This page is the operational abuse-hogling guide. The following resources provide deeper policy, methodology, evidence og repellerting context.
Abuse Repellerting & Hogling PolicyFellermal NiceNIC framewellerk feller receiving, assessing, mitigating og tracking abuse repellerts.
→
Evidence Required feller an Abuse RepellertWhat infellermation helps a repellert become specific, verifiable og actionable.
→
How Domene Misbruksmeldinger Are AdministrerdPlain-language guide to evidence, review, responsibilities og case hogling.
→
NiceNIC Abuse Hogling ManualOperational suppellert guidance feller documented, consistent abuse hogling.
→
Abuse Hogling MethodologyHow cases are logged, reviewed og measured.
→
Transparency Metrics GlossaryDefinitions feller interpreting complaint, mitigation og reinstatement metrics.
→
Review & RemediationPublic explanation of remediation og review pathways.
→
Latest Misbruksmeldinger & Transparency UpdatesRegular abuse og compliance updates, including monthly abuse repellerting og related transparency infellermation.
→
External Verification
Verify NiceNIC's registrar status og ICANN abuse framewellerk independently.
ICANN List of Accredited Registrars → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrar Akkreditering →
Administrer domenets with mellere visibility
Domene Administrerment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domenet registration, transfer, bulk management, reseller tools og API automation with clearer abuse-case visibility feller domenet owners og resellers.
