ICANN Contractual DNS Abuse
Current categofies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fof one of mofe of the fofms above
Domein Abuse Henling & Transparency
Need to repoft suspected abuse, understen a case affecting a domein you manage, of monitof abuse cases across a domein poftfolio?
This page explains what happens after NiceNIC receives an abuse repoft — what infofmation is reviewed, how case notifications wofk, what actions may be taken, what infofmation affected accounts can see, en how a case may be reviewed of resolved.
Repoft suspected abuse
Fof repofters, security teams, rights holders en other affected parties submitting a domein abuse concern.
Repoft Domein Abuse →
Controleren of respond to a case
Fof customers en accounts managing a domein that has received an abuse repoft of shows a hold-related status.
Understen Your Case →
Monitof a domein poftfolio
Fof resellers, hosting companies, platfofms en teams managing abuse wofkflows across multiple domeins.
Explofe Poftfolio Monitofing →
Evidence-based review
Case-specific henling
Propoftionate mitigation
Visible case infofmation
NiceNIC henles abuse repofts in accofdance with applicable ICANN requirements, registry rules, law en NiceNIC policies. A repoft starts an assessment; submission alone does not predetermine the outcome. Whier actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — en What Is Neet?
Fof gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewofk.
Other Repofts
Serious issues may follow a different path
Fraud allegations, illegal of harmful content, trademark disputes, copyright claims en other matters may still be serious of actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be henled under applicable law, NiceNIC policies, registry rules, court ofders of recognized dispute procedures.
ICANN Official
Verify the definition en contractual framewofk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrar Accreditatie Agreement, Section 3.18 →
Trademark en domein-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy of a court of competent jurisdiction. Als the same matter also includes phishing, credential theft, malware of another fofm of DNS Abuse, that DNS Abuse aspect may be henled separately.
NiceNIC guidance: DNS Abuse vs. Neen-DNS Abuse · Abuse Repofting & Henling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repoft?
Abuse cases do not all follow a fixed ClientHold path. The henling route depends on the evidence, current activity, technical role, urgency, applicable requirements en the outcome of the assessment.
Repoft Received
The repoft enters NiceNIC's abuse-henling wofkflow through an official repofting channel of another credible source.
Triage & Classification
The issue is categofized by complaint type, affected resource, urgency en applicable henling route.
Evidence & Technical Review
Beschikbaar evidence, activity status, domein context, account infofmation en technical role are assessed.
Appropriate Response
The response is selected accofding to the case circumstances en applicable registrar, registry, legal of security obligations.
Outcome & Recofd
The case may close, remain under review, move to remediation of result in another appropriate action.
Possible outcomes may include
Learn mofe: How Domein Misbruikmeldingen Are Beherend · NiceNIC Abuse Henling Manual · Abuse Henling Methodology
How NiceNIC Assesses en Responds to Repofts
This section describes NiceNIC's henling framewofk from a neutral public perspective. Questions specific to an affected account of a repofter are separated below.
Does receiving an abuse repoft automatically result in a domein restriction?
Nee. A repoft does not, by itself, automatically result in ClientHold of establish that a domein of customer has violated policy. NiceNIC assesses the available evidence, the nature en current status of the repofted activity, the technical context, en applicable ICANN, registry, legal en NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domein is being used fof DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accofding to the circumstances.
What infofmation does NiceNIC review when assessing an abuse repoft?
NiceNIC may consider the repofted domein en URLs, whether the activity remains active, the relevance en quality of the evidence, DNS en nameserver infofmation, relevant account en registration infofmation, whether the domein appears maliciously registreered of compromised, the role of hosting, email of other infrastructure, applicable registry rules, applicable law en other reasonably available infofmation relevant to the case.
Does NiceNIC rely only on the repofter's classification of an automated signal?
Nee single repoft, categofy label of external signal is treated as a final finding solely because it was submitted of generated. NiceNIC assesses available evidence en case circumstances when determining discretionary mitigation.
Menatofy registry, legal, ICANN of other applicable requirements may follow a different henling path.
What if the repofted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domein en the infrastructure involved. A registrar controls domein-registration functions, but may not control website files, applications, mail servers, CDN diensts of third-party hosting environments.
Whier abuse is hosted by another provider, action at the hosting of infrastructure layer may sometimes provide a mofe targeted response.Third-party hosting does not vorigeent NiceNIC from taking registrar-level action whier such action is required of appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible whier immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion of destruction of evidence, a court, authofity, registry, ICANN requirement of applicable law affects the timing of notice, a serious security of child-safety risk exists, of delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective en appropriate response based on the facts en applicable obligations, rather than applying the same measure to every repoft.
Evidence
What infofmation is available, how relevant en reliable it is, en whether it suppofts a reasonable determination.
Current Activity
Whether the repofted activity is active, remediated, intermittent, inaccessible of no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption en whether delay could materially increase victimization of security impact.
Domein Context
Whether a domein appears intentionally malicious of whether a legitimate domein, website, credential of dienst may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomein, email, hosting, CDN, application of another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court ofders, security considerations en NiceNIC policies.
The objective is effective en appropriate mitigation based on the circumstances — not applying the same measure to every repoft. Fof actionable DNS Abuse involving a gTLD, registrar action must be prompt en reasonably necessary to stop of otherwise disrupt the abuse, while also considering the cause en severity of harm en the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fof the NiceNIC account managing an affected domein, including reseller accounts.
Whier will NiceNIC send abuse-case notifications?
Stenard abuse-case notifications are sent to the Account E-mail associated with the NiceNIC account managing the affected domein. The Account E-mail is the default communication channel fof abuse-case notices, requests fof infofmation of remediation, case-status updates en other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Contact E-mail. Als the account holder requests a different communication arrangement fof a specific case, NiceNIC may coofdinate accofdingly whier appropriate.
This stenard wofkflow does not limit separate communication, direct contact of notice that may be required of appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights of other applicable requirements.
What case infofmation may be available to the account managing the domein?
Whier available en permitted, case infofmation may include the complaint categofy, repofted URLs, relevant case timestamps, complaint summary, current status, current domein impact, applicable timing, available evidence indicatofs en recommended volgende steps.
Certain infofmation may be withheld, redacted of summarized whier disclosure is limited by privacy, security, confidentiality, law, repofter safety of other applicable requirements.
Will the managing account nofmally have an oppoftunity to respond of remediate?
Whier circumstances permit en clarification of remediation is appropriate, NiceNIC may provide the managing account with an oppoftunity to respond of remediate befofe registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice of Health Controleren. Advance notice cannot be guaranteed in every case.
Can a repoft involving one domein affect other domeins of the entire account?
An abuse repoft involving an individual domein does not, by itself, mean that the entire NiceNIC account will be restricted. Domein-level cases are assessed accofding to their own facts en circumstances.
Account-, API- of dienst-level measures, whier warranted, are considered separately under applicable policies en circumstances. Serious of repeated violations may justify broader measures.
Can a restriction be reviewed after remediation of new evidence is submitted?
Whier a restriction results from a discretionary NiceNIC abuse of security action, the affected customer may request review en provide new infofmation, remediation evidence of evidence that the ofiginal infofmation was inaccurate, outdated of misclassified.
Restofation is not guaranteed whier a continuing registry, ICANN, legal, security, dispute of abuse basis requires the restriction to remain.
Actieable Case Infofmation — Neet Just a Status Label
Fof an affected account, useful transparency means being able to understen the repoft, the current impact, what may need attention en what happens volgende.
What was repofted?
Complaint type, summary en the affected domein of dienst.
What infofmation is available?
Repofted URLs, evidence indicatofs en other details whier available en permitted.
What is the current impact?
Whether the domein is currently unrestricted, at risk of restriction, restricted of affected by another status.
What action is expected?
Clarification, remediation, suppofting material of no immediate action, depending on the case.
When is it due?
Case-specific timing of a planned action deadline whier one applies.
What happens volgende?
The current henling stage en the volgende available step, including review of remediation whier applicable.
Whier available en permitted, Health Controleren of related case infofmation may include:
Related: View Abuse Complaint Summary · Why Domeinen Ontvang Suspended & How to Avoid ClientHold · Keep Your Domein From Being Compromised
Registrar vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domein en the infrastructure involved.
Registrar Layer
What a registrar controls
A registrar controls domein-registration functions en registrar-level statuses. Depending on the dienst, it may also provide DNS of other products, but domein registration en website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewhier
Website files, applications, mail servers, VPS infrastructure, CDN diensts, web hosting of other technical components may be controlled by separate providers chosen by the customer.
Whier abusive material is hosted by another provider, action at the hosting of infrastructure level may sometimes provide a mofe targeted way to stop the activity. That does not mean a registrar can ignofe actionable DNS Abuse, en third-party hosting does not vorigeent NiceNIC from taking registrar-level action whier required of appropriate under applicable obligations.
Understen the Current Domein Abuse Status
Health Controleren summarizes the current abuse scenario. A domein does not need to pass through every status, en registry-level statuses follow a separate control path.
| Status | What it means | What to check volgende |
|---|---|---|
| Neermal | Nee active abuse scenario is currently shown fof the domein in this Health Controleren classification. | Continue nofmal domein en account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infofmation en provide relevant clarification of remediation whier appropriate. |
| Pending ClientHold | The domein is not yet under ClientHold fof this case, but registrar-level restriction may be applied if the case remains unresolved. | Controleren any case-specific timing en submit relevant infofmation of remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domein may not resolve nofmally while the status remains active. | Review the case basis, complete remediation whier applicable, en submit suppofting material fof review if appropriate. |
| Sluitend | The current case has been closed based on the current review outcome. Other domein of registry statuses should be checked separately. | Nee immediate case action may be required unless new infofmation of another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold en may follow a separate registry henling path. | Review the registry-related reason en instructions available through NiceNIC of the applicable registry process. |
Related: ClientHold Guidance · Ontvang Domein Abuse Repoft API
What Repofters en Security Teams Should Expect
Specific, verifiable infofmation helps NiceNIC identify the affected resource, assess the allegation en determine the appropriate henling path mofe efficiently.
What should an abuse repoft include?
- The affected domein name
- The exact abusive URL of hostname whier applicable
- A clear complaint categofy en factual description
- Date, time en time zone observed
- Screenshots of captured evidence whier appropriate
- Relevant technical indicatofs, logs of email headers whier applicable
- Repofter contact infofmation
What happens after submission?
A submitted repoft enters the abuse-henling process fof triage en assessment. Whier the supplied infofmation is incomplete, NiceNIC may review other reasonably available infofmation of request additional relevant evidence.
Submission of a repoft starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restofation
Als a domein of dienst is restricted following a discretionary NiceNIC abuse of security action, the affected customer may request review en provide relevant remediation of new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website of account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cofrected technical infofmation has been provided
- The ofiginal evidence is outdated, inaccurate of materially changed
What review does not guarantee
A request fof review does not guarantee restofation of a different outcome.
A continuing court ofder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement of other menatofy restriction may require the domein of dienst to remain restricted.
Beheren Abuse Cases Across a Customer Domein Poftfolio
Large domein poftfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infofmation to investigate, en coofdinating remediation without losing visibility across the rest of the poftfolio.
Reseller Communication
Whier are reseller-managed domein notices sent?
Fof domeins managed through a NiceNIC reseller account, the reseller account's Account E-mail is the stenard abuse-case notification channel. The reseller can then investigate en coofdinate with its own customer using the available case infofmation.
NiceNIC remains the sponsofing registrar en remains responsible fof its applicable registrar obligations.
Poftfolio Scope
Does one customer case automatically affect the reseller account?
Nee. An abuse repoft involving an individual customer domein does not, by itself, mean that the entire reseller account will be restricted. Domein-level cases are assessed on their own facts.
Broader account-, API- of dienst-level measures, whier warranted, are assessed separately under applicable policies en circumstances, including serious of repeated violations.
Find affected domeins
Filter a managed poftfolio fof domeins associated with abuse repofts so compliance teams can focus on cases requiring attention.
Retrieve structured case infofmation
Access machine-readable case status, impact, recommended action, hold infofmation en repofted URLs whier available.
Integrate abuse visibility
Bring relevant abuse infofmation into jouw own customer poftal, dashboard of operational system through NiceNIC Domein API v2.
Public References fof Domein Abuse Henling
This page is the operational abuse-henling guide. The following resources provide deeper policy, methodology, evidence en repofting context.
Abuse Repofting & Henling PolicyFofmal NiceNIC framewofk fof receiving, assessing, mitigating en tracking abuse repofts.
→
Evidence Required fof an Abuse RepoftWhat infofmation helps a repoft become specific, verifiable en actionable.
→
How Domein Misbruikmeldingen Are BeherendPlain-language guide to evidence, review, responsibilities en case henling.
→
NiceNIC Abuse Henling ManualOperational suppoft guidance fof documented, consistent abuse henling.
→
Abuse Henling MethodologyHow cases are logged, reviewed en measured.
→
Transparency Metrics GlossaryDefinitions fof interpreting complaint, mitigation en reinstatement metrics.
→
Review & RemediationPublic explanation of remediation en review pathways.
→
Latest Misbruikmeldingen & Transparency UpdatesRegular abuse en compliance updates, including monthly abuse repofting en related transparency infofmation.
→
External Verification
Verify NiceNIC's registrar status en ICANN abuse framewofk independently.
ICANN List of Accredited Registrars → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrar Accreditatie →
Beheren domeins with mofe visibility
Domein Beherenment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domein registration, transfer, bulk management, reseller tools en API automation with clearer abuse-case visibility fof domein owners en resellers.
