Views:71
Time:2026-08-06 11:46:51 Author: windy 
Reporting Period
July 1, 2026 to July 31, 2026
Introduction
NiceNIC is publishing this monthly abuse report as part of its ongoing effort to improve transparency around abuse handling, case review activity, and DNS abuse mitigation.
The purpose of this report is to provide a factual summary of abuse-related reports recorded during July 2026. It is intended to help customers, partners, security researchers, and the wider community better understand the volume and general distribution of reports received, as well as certain operational metrics related to response timing and mitigation activity.
As with previous monthly reports, the figures below reflect reports recorded in our internal workflow during the reporting period. These figures should be read as operational reporting data. They do not mean that every report was ultimately confirmed in the same way, and they should not be interpreted as a legal finding regarding any registrant, website, or domain name.
Methodology and Definitions
This report summarizes abuse-related complaints recorded by NiceNIC during the reporting period. A complaint does not automatically mean confirmed DNS Abuse, and one domain may receive multiple reports.
For the purpose of ICANN contracted-party DNS Abuse obligations, DNS Abuse is generally understood to cover malware, botnets, phishing, pharming, and spam when spam is used as a delivery mechanism for those forms of DNS Abuse. Other report categories in this article, including trademark, fraud, drugs, and content-related complaints, are included for transparency but may follow different review paths depending on the evidence, applicable policy, domain role, hosting involvement, and whether registrar-level mitigation is appropriate.
"Paused domains" refers to domains that entered a paused or comparable mitigation status during review, based on the information available at the time and the applicable handling standard. "Recovered domains" refers to domains restored after remediation, clarification, further review, or other valid recovery conditions were met.
This report does not describe individual domain cases and should not be used to infer the status, outcome, or handling reason for any specific domain name.
Monthly Overview
During July 2026, NiceNIC recorded:
Total Complaints: 23,316
Total Domains Involved: 9,644
Average Response Time: 2.6 days
Total Paused Domains: 4,955
Pause Rate: 51.38%
Recovered Domains: 178
Recovery Rate: 3.59%
The July data shows that phishing remained the largest complaint category, accounting for more than half of all complaints recorded during the month.
The top five categories: Phishing, Drugs, Other, Fraud, and Pharming accounted for the vast majority of the monthly complaint volume. This shows that July complaint activity was concentrated in a limited number of categories rather than evenly distributed across all abuse types.
The pause rate for July was 51.38%. This means that domain-level action was taken where the available evidence met the required handling threshold. A lower pause rate does not mean reduced enforcement. It reflects the specific mix of complaint quality, evidence strength, domain status, duplicate submissions, remediation outcomes, and case classification during the reporting period.
Complaint Categories
The complaint categories recorded in July 2026 were as follows:
1. Phishing
12,734 cases
54.61% of total complaints
Phishing remained the largest abuse category in July. NiceNIC continues to prioritize timely review and mitigation where phishing activity is confirmed by credible evidence.
2. Drugs
3,560 cases
15.27%
Drug-related complaints represented the second largest category in July. These reports are reviewed based on the evidence provided, the domain's role in the reported activity, and whether registrar-level mitigation is appropriate.
3. Other
2,202 cases
9.44%
This category may include reports that do not fit neatly into the main abuse classifications, reports with incomplete categorization, or cases where further review is needed before a more specific classification can be assigned.
NiceNIC will continue improving internal classification accuracy so future reporting can provide more precise segmentation wherever possible.
4. Fraud
1,787 cases
7.66%
Fraud reports often require careful review because the reported issue may involve website content, third-party hosting, payment behavior, customer disputes, or evidence outside the domain registration layer.
5. Pharming
1,633 cases
7.00%
Pharming complaints accounted for 7.00% of July complaints. Because pharming can affect DNS integrity and user safety, confirmed cases are subject to strict review and mitigation procedures.
6. Trademark
915 cases
3.92%
These cases are reviewed carefully because not every trademark-related dispute qualifies as DNS abuse. Some cases may require formal dispute resolution, court process, UDRP/URS procedures, or additional evidence before registrar-level action is appropriate.
7. Spam
240 cases
1.03%
Spam complaints represented 1.03% of the monthly total.
Spam-related reports are reviewed based on the role of the domain in the reported activity. Where spam is connected to phishing, malware distribution, botnet activity, or other qualifying abuse patterns, the case may require escalation.
8. Malware
188 cases
0.81%
Malware-related complaints represented a smaller portion of July's total complaint volume.
9. Botnet
41 cases
0.18%
Botnet-related reports were limited in volume during July but remain operationally important.
10. CSAM
15 cases
0.06%
CSAM-related reports are handled with strict escalation and high sensitivity. These reports require careful handling, proper documentation, and appropriate action based on the evidence and applicable procedures.
11. Unclassified Internal Category
1 case
Less than 0.01%
One item was recorded under an internal placeholder category during the reporting period. It is included here for completeness and will continue to be reviewed as part of NiceNIC's reporting and classification improvement process.
Response Time Analysis
The average response time in July was 2.6 days, the same as June.
This means NiceNIC maintained the same average response timing while handling a higher number of recorded complaints. Response time may vary by case depending on evidence quality, whether the reported content is still active, duplicate reports, third-party hosting involvement, reseller-managed domains, or whether additional verification is required.
NiceNIC's goal is to process reports efficiently while keeping review evidence-based and proportionate. For security researchers, brand owners, hosting providers, or affected users, abuse reports can be submitted through NiceNIC's abuse reporting channel.
Paused Domains and Recovery
In July 2026, NiceNIC recorded 4,955 paused domains, representing a 51.38% pause rate.
A paused domain means that the domain entered a paused or comparable mitigation status during review, based on the information available at the time and the applicable handling standard. This may include cases involving phishing, malware, pharming, botnet activity, or other serious abuse patterns where domain-level mitigation was considered appropriate.
July also recorded 178 recovered domains, with a 3.59% recovery rate.
Recovery remains an important part of responsible abuse handling. A domain may be restored after remediation, cleanup, clarification, corrected DNS or hosting settings, updated evidence, or further review. This helps ensure that abuse mitigation does not become a one-way process where legitimate domain holders have no path to resolve issues.
Operational and Compliance Perspective
The July data shows three important operational points.
First, complaint volume increased. NiceNIC recorded more complaints and more involved domains in July than in June, while maintaining the same average response time of 2.6 days.
Second, phishing continued to dominate the monthly report mix. More than half of all July complaints were categorized as phishing, which reinforces the need for fast intake, evidence validation, and appropriate domain-level mitigation where supported.
Third, more domains completed recovery review in July. The number of recovered domains increased from 133 in June to 178 in July. This matters because abuse handling must include both mitigation and review. Domains that are cleaned, corrected, clarified, or reassessed should have a documented path toward recovery where appropriate.
NiceNIC's abuse handling workflow continues to focus on:
What NiceNIC Will Continue Improving
The July data highlights several areas NiceNIC will continue to improve.
First, phishing remains the largest complaint category and will continue to receive high-priority review.
Second, pharming increased in July and will be monitored closely because these cases may involve technical abuse patterns that require careful validation.
Third, the "Other" category still represents a meaningful number of reports. NiceNIC will continue improving classification accuracy so future reports can provide clearer category visibility.
Fourth, recovery review remains important. The increase in recovered domains shows that remediation, clarification, and reassessment are active parts of the process.
Closing Note
The July 2026 report shows higher complaint volume, stable average response timing, continued concentration in phishing-related reports, and increased recovery activity.
NiceNIC publishes monthly abuse reports to provide a clearer view of real operational data, not to present selective or simplified claims. Abuse handling requires timely review, evidence assessment, documentation, proportionate action, and a fair path for remediation where appropriate.
NiceNIC will continue publishing abuse reports as part of our commitment to transparency, accountability, and safer domain management.
Readers can also review NiceNIC June 2026 Abuse Report to compare monthly handling trends and category changes.
July 1, 2026 to July 31, 2026
Introduction
NiceNIC is publishing this monthly abuse report as part of its ongoing effort to improve transparency around abuse handling, case review activity, and DNS abuse mitigation.
The purpose of this report is to provide a factual summary of abuse-related reports recorded during July 2026. It is intended to help customers, partners, security researchers, and the wider community better understand the volume and general distribution of reports received, as well as certain operational metrics related to response timing and mitigation activity.
As with previous monthly reports, the figures below reflect reports recorded in our internal workflow during the reporting period. These figures should be read as operational reporting data. They do not mean that every report was ultimately confirmed in the same way, and they should not be interpreted as a legal finding regarding any registrant, website, or domain name.
This report summarizes abuse-related complaints recorded by NiceNIC during the reporting period. A complaint does not automatically mean confirmed DNS Abuse, and one domain may receive multiple reports.
For the purpose of ICANN contracted-party DNS Abuse obligations, DNS Abuse is generally understood to cover malware, botnets, phishing, pharming, and spam when spam is used as a delivery mechanism for those forms of DNS Abuse. Other report categories in this article, including trademark, fraud, drugs, and content-related complaints, are included for transparency but may follow different review paths depending on the evidence, applicable policy, domain role, hosting involvement, and whether registrar-level mitigation is appropriate.
"Paused domains" refers to domains that entered a paused or comparable mitigation status during review, based on the information available at the time and the applicable handling standard. "Recovered domains" refers to domains restored after remediation, clarification, further review, or other valid recovery conditions were met.
This report does not describe individual domain cases and should not be used to infer the status, outcome, or handling reason for any specific domain name.
Monthly Overview
During July 2026, NiceNIC recorded:
Total Complaints: 23,316
Total Domains Involved: 9,644
Average Response Time: 2.6 days
Total Paused Domains: 4,955
Pause Rate: 51.38%
Recovered Domains: 178
Recovery Rate: 3.59%
The July data shows that phishing remained the largest complaint category, accounting for more than half of all complaints recorded during the month.
The top five categories: Phishing, Drugs, Other, Fraud, and Pharming accounted for the vast majority of the monthly complaint volume. This shows that July complaint activity was concentrated in a limited number of categories rather than evenly distributed across all abuse types.
The pause rate for July was 51.38%. This means that domain-level action was taken where the available evidence met the required handling threshold. A lower pause rate does not mean reduced enforcement. It reflects the specific mix of complaint quality, evidence strength, domain status, duplicate submissions, remediation outcomes, and case classification during the reporting period.
Complaint Categories
The complaint categories recorded in July 2026 were as follows:
1. Phishing
12,734 cases
54.61% of total complaints
Phishing remained the largest abuse category in July. NiceNIC continues to prioritize timely review and mitigation where phishing activity is confirmed by credible evidence.
2. Drugs
3,560 cases
15.27%
Drug-related complaints represented the second largest category in July. These reports are reviewed based on the evidence provided, the domain's role in the reported activity, and whether registrar-level mitigation is appropriate.
3. Other
2,202 cases
9.44%
This category may include reports that do not fit neatly into the main abuse classifications, reports with incomplete categorization, or cases where further review is needed before a more specific classification can be assigned.
NiceNIC will continue improving internal classification accuracy so future reporting can provide more precise segmentation wherever possible.
4. Fraud
1,787 cases
7.66%
Fraud reports often require careful review because the reported issue may involve website content, third-party hosting, payment behavior, customer disputes, or evidence outside the domain registration layer.
5. Pharming
1,633 cases
7.00%
Pharming complaints accounted for 7.00% of July complaints. Because pharming can affect DNS integrity and user safety, confirmed cases are subject to strict review and mitigation procedures.
6. Trademark
915 cases
3.92%
These cases are reviewed carefully because not every trademark-related dispute qualifies as DNS abuse. Some cases may require formal dispute resolution, court process, UDRP/URS procedures, or additional evidence before registrar-level action is appropriate.
7. Spam
240 cases
1.03%
Spam complaints represented 1.03% of the monthly total.
Spam-related reports are reviewed based on the role of the domain in the reported activity. Where spam is connected to phishing, malware distribution, botnet activity, or other qualifying abuse patterns, the case may require escalation.
8. Malware
188 cases
0.81%
Malware-related complaints represented a smaller portion of July's total complaint volume.
9. Botnet
41 cases
0.18%
Botnet-related reports were limited in volume during July but remain operationally important.
10. CSAM
15 cases
0.06%
CSAM-related reports are handled with strict escalation and high sensitivity. These reports require careful handling, proper documentation, and appropriate action based on the evidence and applicable procedures.
11. Unclassified Internal Category
1 case
Less than 0.01%
One item was recorded under an internal placeholder category during the reporting period. It is included here for completeness and will continue to be reviewed as part of NiceNIC's reporting and classification improvement process.
Response Time Analysis
The average response time in July was 2.6 days, the same as June.
This means NiceNIC maintained the same average response timing while handling a higher number of recorded complaints. Response time may vary by case depending on evidence quality, whether the reported content is still active, duplicate reports, third-party hosting involvement, reseller-managed domains, or whether additional verification is required.
NiceNIC's goal is to process reports efficiently while keeping review evidence-based and proportionate. For security researchers, brand owners, hosting providers, or affected users, abuse reports can be submitted through NiceNIC's abuse reporting channel.
In July 2026, NiceNIC recorded 4,955 paused domains, representing a 51.38% pause rate.
A paused domain means that the domain entered a paused or comparable mitigation status during review, based on the information available at the time and the applicable handling standard. This may include cases involving phishing, malware, pharming, botnet activity, or other serious abuse patterns where domain-level mitigation was considered appropriate.
July also recorded 178 recovered domains, with a 3.59% recovery rate.
Recovery remains an important part of responsible abuse handling. A domain may be restored after remediation, cleanup, clarification, corrected DNS or hosting settings, updated evidence, or further review. This helps ensure that abuse mitigation does not become a one-way process where legitimate domain holders have no path to resolve issues.
Operational and Compliance Perspective
The July data shows three important operational points.
First, complaint volume increased. NiceNIC recorded more complaints and more involved domains in July than in June, while maintaining the same average response time of 2.6 days.
Second, phishing continued to dominate the monthly report mix. More than half of all July complaints were categorized as phishing, which reinforces the need for fast intake, evidence validation, and appropriate domain-level mitigation where supported.
Third, more domains completed recovery review in July. The number of recovered domains increased from 133 in June to 178 in July. This matters because abuse handling must include both mitigation and review. Domains that are cleaned, corrected, clarified, or reassessed should have a documented path toward recovery where appropriate.
NiceNIC's abuse handling workflow continues to focus on:
- structured complaint intake,
- evidence review,
- complaint classification,
- prioritization of high-risk categories,
- domain-level mitigation where supported,
- documentation of handling outcomes,
- and recovery review where remediation or clarification is valid.
What NiceNIC Will Continue Improving
The July data highlights several areas NiceNIC will continue to improve.
First, phishing remains the largest complaint category and will continue to receive high-priority review.
Second, pharming increased in July and will be monitored closely because these cases may involve technical abuse patterns that require careful validation.
Third, the "Other" category still represents a meaningful number of reports. NiceNIC will continue improving classification accuracy so future reports can provide clearer category visibility.
Fourth, recovery review remains important. The increase in recovered domains shows that remediation, clarification, and reassessment are active parts of the process.
Closing Note
The July 2026 report shows higher complaint volume, stable average response timing, continued concentration in phishing-related reports, and increased recovery activity.
NiceNIC publishes monthly abuse reports to provide a clearer view of real operational data, not to present selective or simplified claims. Abuse handling requires timely review, evidence assessment, documentation, proportionate action, and a fair path for remediation where appropriate.
NiceNIC will continue publishing abuse reports as part of our commitment to transparency, accountability, and safer domain management.
Readers can also review NiceNIC June 2026 Abuse Report to compare monthly handling trends and category changes.
OTHER NEWS:
Last News:
How to Identify a Real Domain Verification Email vs. a Phishing Email
Next News: NiceNIC June 2026 Abuse Report: Data Transparency and DNS Abuse Mitigation Overview
Next News: NiceNIC June 2026 Abuse Report: Data Transparency and DNS Abuse Mitigation Overview
