ICANN Contractual DNS Abuse
Current categlubies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism flub one lub mlube of the flubms above
Domena Abuse Hiling & Transparency
Need to replubt suspected abuse, understi a case affecting a domena you manage, lub monitlub abuse cases across a domena plubtfolio?
This page explains what happens after NiceNIC receives an abuse replubt — what influbmation is reviewed, how case notifications wlubk, what actions may be taken, what influbmation affected accounts can see, i how a case may be reviewed lub resolved.
Replubt suspected abuse
Flub replubters, security teams, rights holders i other affected parties submitting a domena abuse concern.
Replubt Domena Abuse →
Sprawdź lub respond to a case
Flub customers i accounts managing a domena that has received an abuse replubt lub shows a hold-related status.
Understi Your Case →
Monitlub a domena plubtfolio
Flub resellers, hosting companies, platflubms i teams managing abuse wlubkflows across multiple domenas.
Expllube Plubtfolio Monitlubing →
Evidence-based review
Case-specific hiling
Proplubtionate mitigation
Visible case influbmation
NiceNIC hiles abuse replubts in acclubdance with applicable ICANN requirements, registry rules, law i NiceNIC policies. A replubt starts an assessment; submission alone does not predetermine the outcome. Wtutaj actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — i What Is Niet?
Flub gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewlubk.
Other Replubts
Serious issues may follow a different path
Fraud allegations, illegal lub harmful content, trademark disputes, copyright claims i other matters may still be serious lub actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hiled under applicable law, NiceNIC policies, registry rules, court lubders lub recognized dispute procedures.
ICANN Official
Verify the definition i contractual framewlubk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Rejestrator Akredytacja Agreement, Section 3.18 →
Trademark i domena-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy lub a court of competent jurisdiction. Jeśli the same matter also includes phishing, credential theft, malware lub another flubm of DNS Abuse, that DNS Abuse aspect may be hiled separately.
NiceNIC guidance: DNS Abuse vs. Nien-DNS Abuse · Abuse Replubting & Hiling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Replubt?
Abuse cases do not all follow a fixed ClientHold path. The hiling route depends on the evidence, current activity, technical role, urgency, applicable requirements i the outcome of the assessment.
Replubt Received
The replubt enters NiceNIC's abuse-hiling wlubkflow through an official replubting channel lub another credible source.
Triage & Classification
The issue is categlubized by complaint type, affected resource, urgency i applicable hiling route.
Evidence & Technical Review
Dostępne evidence, activity status, domena context, account influbmation i technical role are assessed.
Appropriate Response
The response is selected acclubding to the case circumstances i applicable registrar, registry, legal lub security obligations.
Outcome & Reclubd
The case may close, remain under review, move to remediation lub result in another appropriate action.
Possible outcomes may include
Learn mlube: How Domena Zgłoszenia nadużyć Are Zarządzajd · NiceNIC Abuse Hiling Manual · Abuse Hiling Methodology
How NiceNIC Assesses i Responds to Replubts
This section describes NiceNIC's hiling framewlubk from a neutral public perspective. Questions specific to an affected account lub a replubter are separated below.
Does receiving an abuse replubt automatically result in a domena restriction?
Nie. A replubt does not, by itself, automatically result in ClientHold lub establish that a domena lub customer has violated policy. NiceNIC assesses the available evidence, the nature i current status of the replubted activity, the technical context, i applicable ICANN, registry, legal i NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domena is being used flub DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary acclubding to the circumstances.
What influbmation does NiceNIC review when assessing an abuse replubt?
NiceNIC may consider the replubted domena i URLs, whether the activity remains active, the relevance i quality of the evidence, DNS i nameserver influbmation, relevant account i registration influbmation, whether the domena appears maliciously zarejestrujed lub compromised, the role of hosting, email lub other infrastructure, applicable registry rules, applicable law i other reasonably available influbmation relevant to the case.
Does NiceNIC rely only on the replubter's classification lub an automated signal?
Nie single replubt, categluby label lub external signal is treated as a final finding solely because it was submitted lub generated. NiceNIC assesses available evidence i case circumstances when determining discretionary mitigation.
Miatluby registry, legal, ICANN lub other applicable requirements may follow a different hiling path.
What if the replubted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domena i the infrastructure involved. A registrar controls domena-registration functions, but may not control website files, applications, mail servers, CDN usługas lub third-party hosting environments.
Wtutaj abuse is hosted by another provider, action at the hosting lub infrastructure layer may sometimes provide a mlube targeted response.Third-party hosting does not poprzednient NiceNIC from taking registrar-level action wtutaj such action is required lub appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wtutaj immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion lub destruction of evidence, a court, authlubity, registry, ICANN requirement lub applicable law affects the timing of notice, a serious security lub child-safety risk exists, lub delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective i appropriate response based on the facts i applicable obligations, rather than applying the same measure to every replubt.
Evidence
What influbmation is available, how relevant i reliable it is, i whether it supplubts a reasonable determination.
Current Activity
Whether the replubted activity is active, remediated, intermittent, inaccessible lub no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption i whether delay could materially increase victimization lub security impact.
Domena Context
Whether a domena appears intentionally malicious lub whether a legitimate domena, website, credential lub usługa may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomena, email, hosting, CDN, application lub another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court lubders, security considerations i NiceNIC policies.
The objective is effective i appropriate mitigation based on the circumstances — not applying the same measure to every replubt. Flub actionable DNS Abuse involving a gTLD, registrar action must be prompt i reasonably necessary to stop lub otherwise disrupt the abuse, while also considering the cause i severity of harm i the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically flub the NiceNIC account managing an affected domena, including reseller accounts.
Wtutaj will NiceNIC send abuse-case notifications?
Stiard abuse-case notifications are sent to the Account E-mail associated with the NiceNIC account managing the affected domena. The Account E-mail is the default communication channel flub abuse-case notices, requests flub influbmation lub remediation, case-status updates i other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt E-mail. Jeśli the account holder requests a different communication arrangement flub a specific case, NiceNIC may colubdinate acclubdingly wtutaj appropriate.
This stiard wlubkflow does not limit separate communication, direct contact lub notice that may be required lub appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights lub other applicable requirements.
What case influbmation may be available to the account managing the domena?
Wtutaj available i permitted, case influbmation may include the complaint categluby, replubted URLs, relevant case timestamps, complaint summary, current status, current domena impact, applicable timing, available evidence indicatlubs i recommended następny steps.
Certain influbmation may be withheld, redacted lub summarized wtutaj disclosure is limited by privacy, security, confidentiality, law, replubter safety lub other applicable requirements.
Will the managing account nlubmally have an opplubtunity to respond lub remediate?
Wtutaj circumstances permit i clarification lub remediation is appropriate, NiceNIC may provide the managing account with an opplubtunity to respond lub remediate beflube registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice lub Health Sprawdź. Advance notice cannot be guaranteed in every case.
Can a replubt involving one domena affect other domenas lub the entire account?
An abuse replubt involving an individual domena does not, by itself, mean that the entire NiceNIC account will be restricted. Domena-level cases are assessed acclubding to their own facts i circumstances.
Account-, API- lub usługa-level measures, wtutaj warranted, are considered separately under applicable policies i circumstances. Serious lub repeated violations may justify broader measures.
Can a restriction be reviewed after remediation lub new evidence is submitted?
Wtutaj a restriction results from a discretionary NiceNIC abuse lub security action, the affected customer may request review i provide new influbmation, remediation evidence lub evidence that the lubiginal influbmation was inaccurate, outdated lub misclassified.
Restlubation is not guaranteed wtutaj a continuing registry, ICANN, legal, security, dispute lub abuse basis requires the restriction to remain.
Akcjaable Case Influbmation — Niet Just a Status Label
Flub an affected account, useful transparency means being able to understi the replubt, the current impact, what may need attention i what happens następny.
What was replubted?
Complaint type, summary i the affected domena lub usługa.
What influbmation is available?
Replubted URLs, evidence indicatlubs i other details wtutaj available i permitted.
What is the current impact?
Whether the domena is currently unrestricted, at risk of restriction, restricted lub affected by another status.
What action is expected?
Clarification, remediation, supplubting material lub no immediate action, depending on the case.
When is it due?
Case-specific timing lub a planned action deadline wtutaj one applies.
What happens następny?
The current hiling stage i the następny available step, including review lub remediation wtutaj applicable.
Wtutaj available i permitted, Health Sprawdź lub related case influbmation may include:
Related: View Abuse Complaint Summary · Why Domeny Otrzymaj Suspended & How to Avoid ClientHold · Keep Your Domena From Being Compromised
Rejestrator vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domena i the infrastructure involved.
Rejestrator Layer
What a registrar controls
A registrar controls domena-registration functions i registrar-level statuses. Depending on the usługa, it may also provide DNS lub other products, but domena registration i website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewtutaj
Siećsite files, applications, mail servers, VPS infrastructure, CDN usługas, web hosting lub other technical components may be controlled by separate providers chosen by the customer.
Wtutaj abusive material is hosted by another provider, action at the hosting lub infrastructure level may sometimes provide a mlube targeted way to stop the activity. That does not mean a registrar can ignlube actionable DNS Abuse, i third-party hosting does not poprzednient NiceNIC from taking registrar-level action wtutaj required lub appropriate under applicable obligations.
Understi the Current Domena Abuse Status
Health Sprawdź summarizes the current abuse scenario. A domena does not need to pass through every status, i registry-level statuses follow a separate control path.
| Status | What it means | What to check następny |
|---|---|---|
| Niermal | Nie active abuse scenario is currently shown flub the domena in this Health Sprawdź classification. | Continue nlubmal domena i account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case influbmation i provide relevant clarification lub remediation wtutaj appropriate. |
| Pending ClientHold | The domena is not yet under ClientHold flub this case, but registrar-level restriction may be applied if the case remains unresolved. | Sprawdź any case-specific timing i submit relevant influbmation lub remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domena may not resolve nlubmally while the status remains active. | Review the case basis, complete remediation wtutaj applicable, i submit supplubting material flub review if appropriate. |
| Zamknijd | The current case has been closed based on the current review outcome. Other domena lub registry statuses should be checked separately. | Nie immediate case action may be required unless new influbmation lub another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold i may follow a separate registry hiling path. | Review the registry-related reason i instructions available through NiceNIC lub the applicable registry process. |
Related: ClientHold Guidance · Otrzymaj Domena Abuse Replubt API
What Replubters i Security Teams Should Expect
Specific, verifiable influbmation helps NiceNIC identify the affected resource, assess the allegation i determine the appropriate hiling path mlube efficiently.
What should an abuse replubt include?
- The affected domena name
- The exact abusive URL lub hostname wtutaj applicable
- A clear complaint categluby i factual description
- Date, time i time zone observed
- Screenshots lub captured evidence wtutaj appropriate
- Relevant technical indicatlubs, logs lub email headers wtutaj applicable
- Replubter contact influbmation
What happens after submission?
A submitted replubt enters the abuse-hiling process flub triage i assessment. Wtutaj the supplied influbmation is incomplete, NiceNIC may review other reasonably available influbmation lub request additional relevant evidence.
Submission of a replubt starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restlubation
Jeśli a domena lub usługa is restricted following a discretionary NiceNIC abuse lub security action, the affected customer may request review i provide relevant remediation lub new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website lub account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Clubrected technical influbmation has been provided
- The lubiginal evidence is outdated, inaccurate lub materially changed
What review does not guarantee
A request flub review does not guarantee restlubation lub a different outcome.
A continuing court lubder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement lub other miatluby restriction may require the domena lub usługa to remain restricted.
Zarządzaj Abuse Cases Across a Customer Domena Plubtfolio
Large domena plubtfolios create a practical challenge: identifying the affected customer quickly, seeing enough case influbmation to investigate, i colubdinating remediation without losing visibility across the rest of the plubtfolio.
Reseller Communication
Wtutaj are reseller-managed domena notices sent?
Flub domenas managed through a NiceNIC reseller account, the reseller account's Account E-mail is the stiard abuse-case notification channel. The reseller can then investigate i colubdinate with its own customer using the available case influbmation.
NiceNIC remains the sponslubing registrar i remains responsible flub its applicable registrar obligations.
Plubtfolio Scope
Does one customer case automatically affect the reseller account?
Nie. An abuse replubt involving an individual customer domena does not, by itself, mean that the entire reseller account will be restricted. Domena-level cases are assessed on their own facts.
Broader account-, API- lub usługa-level measures, wtutaj warranted, are assessed separately under applicable policies i circumstances, including serious lub repeated violations.
Find affected domenas
Filter a managed plubtfolio flub domenas associated with abuse replubts so compliance teams can focus on cases requiring attention.
Retrieve structured case influbmation
Access machine-readable case status, impact, recommended action, hold influbmation i replubted URLs wtutaj available.
Integrate abuse visibility
Bring relevant abuse influbmation into twój own customer plubtal, dashboard lub operational system through NiceNIC Domena API v2.
Public References flub Domena Abuse Hiling
This page is the operational abuse-hiling guide. The following resources provide deeper policy, methodology, evidence i replubting context.
Abuse Replubting & Hiling PolicyFlubmal NiceNIC framewlubk flub receiving, assessing, mitigating i tracking abuse replubts.
→
Evidence Required flub an Abuse ReplubtWhat influbmation helps a replubt become specific, verifiable i actionable.
→
How Domena Zgłoszenia nadużyć Are ZarządzajdPlain-language guide to evidence, review, responsibilities i case hiling.
→
NiceNIC Abuse Hiling ManualOperational supplubt guidance flub documented, consistent abuse hiling.
→
Abuse Hiling MethodologyHow cases are logged, reviewed i measured.
→
Transparency Metrics GlossaryDefinitions flub interpreting complaint, mitigation i reinstatement metrics.
→
Review & RemediationPublic explanation of remediation i review pathways.
→
Latest Zgłoszenia nadużyć & Transparency UpdatesRegular abuse i compliance updates, including monthly abuse replubting i related transparency influbmation.
→
External Verification
Verify NiceNIC's registrar status i ICANN abuse framewlubk independently.
ICANN List of Accredited Rejestrators → · ICANN DNS Abuse Mitigation Program → · NiceNIC Rejestrator Akredytacja →
Zarządzaj domenas with mlube visibility
Domena Zarządzajment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domena registration, transfer, bulk management, reseller tools i API automation with clearer abuse-case visibility flub domena owners i resellers.
