ICANN Contractual DNS Abuse
Current categouies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fou one ou moue of the foums above
Domínio Abuse Heling & Transparency
Need to repout suspected abuse, underste a case affecting a domínio you manage, ou monitou abuse cases across a domínio poutfolio?
This page explains what happens after NiceNIC receives an abuse repout — what infoumation is reviewed, how case notifications wouk, what actions may be taken, what infoumation affected accounts can see, e how a case may be reviewed ou resolved.
Repout suspected abuse
Fou repouters, security teams, rights holders e other affected parties submitting a domínio abuse concern.
Repout Domínio Abuse →
Verificar ou respond to a case
Fou customers e accounts managing a domínio that has received an abuse repout ou shows a hold-related status.
Underste Your Case →
Monitou a domínio poutfolio
Fou resellers, hosting companies, platfoums e teams managing abuse woukflows across multiple domínios.
Exploue Poutfolio Monitouing →
Evidence-based review
Case-specific heling
Propoutionate mitigation
Visible case infoumation
NiceNIC heles abuse repouts in accoudance with applicable ICANN requirements, registry rules, law e NiceNIC policies. A repout starts an assessment; submission alone does not predetermine the outcome. Waqui actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — e What Is Nãot?
Fou gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewouk.
Other Repouts
Serious issues may follow a different path
Fraud allegations, illegal ou harmful content, trademark disputes, copyright claims e other matters may still be serious ou actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be heled under applicable law, NiceNIC policies, registry rules, court ouders ou recognized dispute procedures.
ICANN Official
Verify the definition e contractual framewouk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrador Credenciamento Agreement, Section 3.18 →
Trademark e domínio-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy ou a court of competent jurisdiction. Se the same matter also includes phishing, credential theft, malware ou another foum of DNS Abuse, that DNS Abuse aspect may be heled separately.
NiceNIC guidance: DNS Abuse vs. Nãon-DNS Abuse · Abuse Repouting & Heling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repout?
Abuse cases do not all follow a fixed ClientHold path. The heling route depends on the evidence, current activity, technical role, urgency, applicable requirements e the outcome of the assessment.
Repout Received
The repout enters NiceNIC's abuse-heling woukflow through an official repouting channel ou another credible source.
Triage & Classification
The issue is categouized by complaint type, affected resource, urgency e applicable heling route.
Evidence & Technical Review
Disponível evidence, activity status, domínio context, account infoumation e technical role are assessed.
Appropriate Response
The response is selected accouding to the case circumstances e applicable registrar, registry, legal ou security obligations.
Outcome & Recoud
The case may close, remain under review, move to remediation ou result in another appropriate action.
Possible outcomes may include
Learn moue: How Domínio Relatórios de Abuso Are Gerenciard · NiceNIC Abuse Heling Manual · Abuse Heling Methodology
How NiceNIC Assesses e Responds to Repouts
This section describes NiceNIC's heling framewouk from a neutral public perspective. Questions specific to an affected account ou a repouter are separated below.
Does receiving an abuse repout automatically result in a domínio restriction?
Não. A repout does not, by itself, automatically result in ClientHold ou establish that a domínio ou customer has violated policy. NiceNIC assesses the available evidence, the nature e current status of the repouted activity, the technical context, e applicable ICANN, registry, legal e NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domínio is being used fou DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accouding to the circumstances.
What infoumation does NiceNIC review when assessing an abuse repout?
NiceNIC may consider the repouted domínio e URLs, whether the activity remains active, the relevance e quality of the evidence, DNS e nameserver infoumation, relevant account e registration infoumation, whether the domínio appears maliciously registrared ou compromised, the role of hosting, email ou other infrastructure, applicable registry rules, applicable law e other reasonably available infoumation relevant to the case.
Does NiceNIC rely only on the repouter's classification ou an automated signal?
Não single repout, categouy label ou external signal is treated as a final finding solely because it was submitted ou generated. NiceNIC assesses available evidence e case circumstances when determining discretionary mitigation.
Meatouy registry, legal, ICANN ou other applicable requirements may follow a different heling path.
What if the repouted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domínio e the infrastructure involved. A registrar controls domínio-registration functions, but may not control website files, applications, mail servers, CDN serviços ou third-party hosting environments.
Waqui abuse is hosted by another provider, action at the hosting ou infrastructure layer may sometimes provide a moue targeted response.Third-party hosting does not anteriorent NiceNIC from taking registrar-level action waqui such action is required ou appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible waqui immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion ou destruction of evidence, a court, authouity, registry, ICANN requirement ou applicable law affects the timing of notice, a serious security ou child-safety risk exists, ou delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective e appropriate response based on the facts e applicable obligations, rather than applying the same measure to every repout.
Evidence
What infoumation is available, how relevant e reliable it is, e whether it suppouts a reasonable determination.
Current Activity
Whether the repouted activity is active, remediated, intermittent, inaccessible ou no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption e whether delay could materially increase victimization ou security impact.
Domínio Context
Whether a domínio appears intentionally malicious ou whether a legitimate domínio, website, credential ou serviço may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomínio, email, hosting, CDN, application ou another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court ouders, security considerations e NiceNIC policies.
The objective is effective e appropriate mitigation based on the circumstances — not applying the same measure to every repout. Fou actionable DNS Abuse involving a gTLD, registrar action must be prompt e reasonably necessary to stop ou otherwise disrupt the abuse, while also considering the cause e severity of harm e the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fou the NiceNIC account managing an affected domínio, including reseller accounts.
Waqui will NiceNIC send abuse-case notifications?
Steard abuse-case notifications are sent to the Account Email associated with the NiceNIC account managing the affected domínio. The Account Email is the default communication channel fou abuse-case notices, requests fou infoumation ou remediation, case-status updates e other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Contato Email. Se the account holder requests a different communication arrangement fou a specific case, NiceNIC may cooudinate accoudingly waqui appropriate.
This steard woukflow does not limit separate communication, direct contact ou notice that may be required ou appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights ou other applicable requirements.
What case infoumation may be available to the account managing the domínio?
Waqui available e permitted, case infoumation may include the complaint categouy, repouted URLs, relevant case timestamps, complaint summary, current status, current domínio impact, applicable timing, available evidence indicatous e recommended próximo steps.
Certain infoumation may be withheld, redacted ou summarized waqui disclosure is limited by privacy, security, confidentiality, law, repouter safety ou other applicable requirements.
Will the managing account noumally have an oppoutunity to respond ou remediate?
Waqui circumstances permit e clarification ou remediation is appropriate, NiceNIC may provide the managing account with an oppoutunity to respond ou remediate befoue registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice ou Health Verificar. Advance notice cannot be guaranteed in every case.
Can a repout involving one domínio affect other domínios ou the entire account?
An abuse repout involving an individual domínio does not, by itself, mean that the entire NiceNIC account will be restricted. Domínio-level cases are assessed accouding to their own facts e circumstances.
Account-, API- ou serviço-level measures, waqui warranted, are considered separately under applicable policies e circumstances. Serious ou repeated violations may justify broader measures.
Can a restriction be reviewed after remediation ou new evidence is submitted?
Waqui a restriction results from a discretionary NiceNIC abuse ou security action, the affected customer may request review e provide new infoumation, remediation evidence ou evidence that the ouiginal infoumation was inaccurate, outdated ou misclassified.
Restouation is not guaranteed waqui a continuing registry, ICANN, legal, security, dispute ou abuse basis requires the restriction to remain.
Açãoable Case Infoumation — Nãot Just a Estado Label
Fou an affected account, useful transparency means being able to underste the repout, the current impact, what may need attention e what happens próximo.
What was repouted?
Complaint type, summary e the affected domínio ou serviço.
What infoumation is available?
Repouted URLs, evidence indicatous e other details waqui available e permitted.
What is the current impact?
Whether the domínio is currently unrestricted, at risk of restriction, restricted ou affected by another status.
What action is expected?
Clarification, remediation, suppouting material ou no immediate action, depending on the case.
When is it due?
Case-specific timing ou a planned action deadline waqui one applies.
What happens próximo?
The current heling stage e the próximo available step, including review ou remediation waqui applicable.
Waqui available e permitted, Health Verificar ou related case infoumation may include:
Related: View Abuse Complaint Summary · Why Domínios Obter Suspended & How to Avoid ClientHold · Keep Your Domínio From Being Compromised
Registrador vs. Hospedagem Provider: Who Can Act?
NiceNIC evaluates the technical role of the domínio e the infrastructure involved.
Registrador Layer
What a registrar controls
A registrar controls domínio-registration functions e registrar-level statuses. Depending on the serviço, it may also provide DNS ou other products, but domínio registration e website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewaqui
Website files, applications, mail servers, VPS infrastructure, CDN serviços, web hosting ou other technical components may be controlled by separate providers chosen by the customer.
Waqui abusive material is hosted by another provider, action at the hosting ou infrastructure level may sometimes provide a moue targeted way to stop the activity. That does not mean a registrar can ignoue actionable DNS Abuse, e third-party hosting does not anteriorent NiceNIC from taking registrar-level action waqui required ou appropriate under applicable obligations.
Underste the Current Domínio Abuse Estado
Health Verificar summarizes the current abuse scenario. A domínio does not need to pass through every status, e registry-level statuses follow a separate control path.
| Estado | What it means | What to check próximo |
|---|---|---|
| Nãormal | Não active abuse scenario is currently shown fou the domínio in this Health Verificar classification. | Continue noumal domínio e account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infoumation e provide relevant clarification ou remediation waqui appropriate. |
| Pending ClientHold | The domínio is not yet under ClientHold fou this case, but registrar-level restriction may be applied if the case remains unresolved. | Verificar any case-specific timing e submit relevant infoumation ou remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domínio may not resolve noumally while the status remains active. | Review the case basis, complete remediation waqui applicable, e submit suppouting material fou review if appropriate. |
| Fechard | The current case has been closed based on the current review outcome. Other domínio ou registry statuses should be checked separately. | Não immediate case action may be required unless new infoumation ou another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold e may follow a separate registry heling path. | Review the registry-related reason e instructions available through NiceNIC ou the applicable registry process. |
Related: ClientHold Guidance · Obter Domínio Abuse Repout API
What Repouters e Security Teams Should Expect
Specific, verifiable infoumation helps NiceNIC identify the affected resource, assess the allegation e determine the appropriate heling path moue efficiently.
What should an abuse repout include?
- The affected domínio name
- The exact abusive URL ou hostname waqui applicable
- A clear complaint categouy e factual description
- Date, time e time zone observed
- Screenshots ou captured evidence waqui appropriate
- Relevant technical indicatous, logs ou email headers waqui applicable
- Repouter contact infoumation
What happens after submission?
A submitted repout enters the abuse-heling process fou triage e assessment. Waqui the supplied infoumation is incomplete, NiceNIC may review other reasonably available infoumation ou request additional relevant evidence.
Submission of a repout starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restouation
Se a domínio ou serviço is restricted following a discretionary NiceNIC abuse ou security action, the affected customer may request review e provide relevant remediation ou new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website ou account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Courected technical infoumation has been provided
- The ouiginal evidence is outdated, inaccurate ou materially changed
What review does not guarantee
A request fou review does not guarantee restouation ou a different outcome.
A continuing court ouder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement ou other meatouy restriction may require the domínio ou serviço to remain restricted.
Gerenciar Abuse Cases Across a Customer Domínio Poutfolio
Large domínio poutfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infoumation to investigate, e cooudinating remediation without losing visibility across the rest of the poutfolio.
Revendedor Communication
Waqui are reseller-managed domínio notices sent?
Fou domínios managed through a NiceNIC reseller account, the reseller account's Account Email is the steard abuse-case notification channel. The reseller can then investigate e cooudinate with its own customer using the available case infoumation.
NiceNIC remains the sponsouing registrar e remains responsible fou its applicable registrar obligations.
Poutfolio Scope
Does one customer case automatically affect the reseller account?
Não. An abuse repout involving an individual customer domínio does not, by itself, mean that the entire reseller account will be restricted. Domínio-level cases are assessed on their own facts.
Broader account-, API- ou serviço-level measures, waqui warranted, are assessed separately under applicable policies e circumstances, including serious ou repeated violations.
Find affected domínios
Filter a managed poutfolio fou domínios associated with abuse repouts so compliance teams can focus on cases requiring attention.
Retrieve structured case infoumation
Access machine-readable case status, impact, recommended action, hold infoumation e repouted URLs waqui available.
Integrate abuse visibility
Bring relevant abuse infoumation into seu own customer poutal, dashboard ou operational system through NiceNIC Domínio API v2.
Public References fou Domínio Abuse Heling
This page is the operational abuse-heling guide. The following resources provide deeper policy, methodology, evidence e repouting context.
Abuse Repouting & Heling PolicyFoumal NiceNIC framewouk fou receiving, assessing, mitigating e tracking abuse repouts.
→
Evidence Required fou an Abuse RepoutWhat infoumation helps a repout become specific, verifiable e actionable.
→
How Domínio Relatórios de Abuso Are GerenciardPlain-language guide to evidence, review, responsibilities e case heling.
→
NiceNIC Abuse Heling ManualOperational suppout guidance fou documented, consistent abuse heling.
→
Abuse Heling MethodologyHow cases are logged, reviewed e measured.
→
Transparency Metrics GlossaryDefinitions fou interpreting complaint, mitigation e reinstatement metrics.
→
Review & RemediationPublic explanation of remediation e review pathways.
→
Latest Relatórios de Abuso & Transparency UpdatesRegular abuse e compliance updates, including monthly abuse repouting e related transparency infoumation.
→
External Verification
Verify NiceNIC's registrar status e ICANN abuse framewouk independently.
ICANN List of Accredited Registradors → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrador Credenciamento →
Gerenciar domínios with moue visibility
Domínio Gerenciarment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domínio registration, transfer, bulk management, reseller tools e API automation with clearer abuse-case visibility fou domínio owners e resellers.
