How can I check if a domain name is registered or hosted with NiceNIC?

Before reporting your concern, please make sure that the domain name in question uses our services. To check the domain name registration, go to the Whois lookup page.

Does your investigation differ for domains registered with NiceNIC and websites hosted by third parties?

Yes. NiceNIC reviews abuse reports based on the services involved, the available evidence, and the applicable requirements. As a domain registrar, NiceNIC controls domain-registration functions but may not control website content, applications, email servers, or hosting infrastructure operated by third parties. In some cases, reporting abusive content to the hosting provider may allow for more targeted removal. However, third-party hosting does not prevent NiceNIC from taking appropriate registrar-level action. When actionable evidence establishes that a gTLD domain sponsored by NiceNIC is being used for DNS Abuse, we promptly take mitigation measures reasonably necessary to stop or disrupt the abuse, as required by applicable ICANN obligations. Other complaints are assessed under applicable law, registry rules, and NiceNIC policies. We consider the evidence, the severity of the issue, and the potential impact of any action before determining an appropriate response. For more information, please see our Domain Abuse Transparency page: https://nicenic.com/trust-center/domain-abuse-transparency/

How long does it take to review an abuse report?

NiceNIC provides confirmation of receipt for reports submitted through its official abuse reporting channels. Each report then enters our triage and assessment process. Confirmation of receipt does not mean that the reported activity has already been verified. There is no single review or resolution timeframe for all abuse reports. Handling depends on the nature and urgency of the reported activity, the available evidence, and applicable requirements. Where NiceNIC has actionable evidence that a gTLD domain it sponsors is being used for DNS Abuse, we promptly take mitigation measures reasonably necessary to stop or disrupt the abuse, as required by applicable ICANN obligations. The appropriate response is determined on a case-by-case basis and does not always require domain suspension. If the available information is incomplete, we may request clarification or consider other reasonably available evidence. Some cases may require additional verification or coordination with relevant service providers or authorities. If a reported domain is already restricted, NiceNIC may still assess whether further investigation or action is appropriate. For more information about our handling process, please see Domain Abuse Transparency: https://nicenic.com/trust-center/domain-abuse-transparency/ If you submit the abuse report via our Ticket system, you will get a ticket ID for you to track the result of complaint and you can check your ticket status by viewing the following link: >>View my reports

When will I receive a response?

NiceNIC provides confirmation when an abuse report is received through our official reporting channels. We may request further information or provide case updates when appropriate. Privacy, security, and legal requirements may limit the details we can disclose about an investigation or its outcome. You may check the domain's registration status using a domain lookup service. A clientHold status is applied at the registrar level, while a serverHold status is applied at the registry level. Either status may affect DNS resolution, but the status alone does not establish the reason for the restriction or the outcome of an abuse investigation. For more information about domain restrictions and case handling, please visit our Domain Abuse Transparency page: https://nicenic.com/trust-center/domain-abuse-transparency/

Reopening or Appealing Responses?

Responses to reported complaints and abuses that are resolved in a satisfactory manner will be closed within 48 hours of a non-response from the complainant. If the response is not satisfactory, simply respond with additional information or detail that will allow for further investigation of the issue.

Does your system accept any file type for attachment?

For security reasons, we only accept the following file types: csv, doc, docx, eml, jpeg, jpg, pdf, png, txt, xls, xlsx. Thus, when attaching the evidence, please make sure to double-check whether the file is allowed by our system.

How and where can I file abuse complaints?

If you need to report a domain name, email address or IP address involved in any illegal or abusive activity, here are some tips to follow to make this process easier. As always, please substantiate your allegations with concrete evidence and/or any other relevant information to verify the abuse incident and help us take appropriate action. Keep in mind that depending on the type of the issue you'd like to report, the evidence may vary.

How to Report Suspected Domain Abuse

Anyone can report suspected abuse involving a domain sponsored by NiceNIC. You can select the appropriate reporting category below or email our Abuse Team at [email protected]. A NiceNIC account is not required to submit an abuse report. Please provide the affected domain name, relevant URL(s), and any available supporting information. The evidence needed may vary depending on the type of report. For more information about our investigation and mitigation procedures, see our Abuse Reporting & Handling Policy: https://nicenic.com/legal/abuse-reporting-and-handling-policy The following list explains the most common types of abuse we investigate and provides examples of useful supporting evidence to help our investigation.

Type of Abuse and Description	Useful Evidence	Notes and Advice
Phishing is a type of fraud with the intent to acquire sensitive information (usernames, passwords, PINs, credit card or bank account details) using fake websites that are almost identical to legitimate ones.	Abusive Domain Name(s) Abusive URL(s) Target of the attack (legitimate website) Country your IP address belongs to (the content may be geo-blocked, so we will try using the corresponding proxy); User-agent (mobile phone, PC) and browser (the content may vary depending on the device and software)	If you clicked on a link or opened an attachment from a suspected phishing email, then you should run a virus check on your computer just to be safe. Click here to report this case to us.
Malware is a software used to disrupt computer operations, gather sensitive data, or gain access to private computer systems.	Abusive Domain Name(s) Abusive URL(s)	Click here to report this case to us.
Email Abuse / Spam is an unsolicited commercial bulk email. This also includes "spamvertising", i.e. advertising domains via spam sent from another network. Legitimate emails are those complying with the requirements of the CAN-SPAM Act.	"From" Address "To" Address Full Email Headers Email Content	Click here to report this case to us. How does NiceNIC investigate Suspected Email Abuse/Spam?
Copyright/DMCA is the content that is protected by copyright being published online with no authorization rights.	An official DMCA Takedown Notice that meets all the DMCA requirements set out in our Copyright and Trademark Policies.	Click here to report this case to us.
Fraud is wrongful deception with the intent to gain a monetary benefit (also known as the scam) or other benefits (i.e. access to personal details).	Abusive Domain Name(s) Abusive URL(s) Paid invoices or receipts Screenshot of the abusive page Email with full header and body (in case of email fraud)	Click here to report this case to us.
Illegal Pharmacy is a website that sells or distributes medications with no valid prescription, outdated, substituted or counterfeit medications, thus violating the law.	Abusive Domain Name(s) Abusive URL(s) Screenshot of the abusive page	Click here to report this case to us.
Hacking Activity is networking attacks such as port scanning, brute force, denial of service attacks, etc. with the intent to infect or exploit the victim’s resources, or for other illegal purposes.	Abusive Domain Name(s) Abusive URL(s) Abusive IP address Date and time (including the time zone) of when the abuse took place Full unmasked log of the attack generated by your firewall (with the source and destination IPs/domains, user-agent, timestamps and time zone)	Click here to report this case to us.
Trademark Infringement is the unauthorized use of a trademark or service mark on or in connection with goods and/or services in a manner that is likely to cause confusion, deception, or mistake about the source of the goods and/or services.	A formal notice of a trademark complaint that meets all the requirements set out in our Copyright and Trademark Policies.	In case of a trademarked domain name, we recommend you to seek resolution through the UDRP or URS. For more information, please visit https://www.icann.org/resources/pages/dispute-resolution-2012-02-25-en. Alternatively, you can pursue the matter in a U.S. court of competent jurisdiction. UDRP/URS disputes are communicated via our dedicated email address: abuse###nicenic.net(change the ### to @). Click here to report this case to us.
Child Sexual Abuse Material (CSAM) / Child Exploitation Reports involving suspected child sexual abuse material or online sexual exploitation of children. Such reports are treated as high-priority matters and escalated without unnecessary delay.	Affected domain name(s) Relevant URL(s), if available) A brief factual description of the suspected activity Date and time observed, if known	Do not download, save, screenshot, share, or upload suspected child sexual abuse material. Click here to report this case to NiceNIC: https://nicenic.com/customer/reportabuse_information.php?type=1 You may also report suspected child sexual exploitation to the appropriate authorities or recognized hotlines, such as: NCMEC CyberTipline: https://www.ncmec.org/gethelpnow/cybertipline INHOPE: https://inhope.org/what-we-do/how-to-report
Abuse Reports stand for any other inappropriate content, including but not limited to: identity theft, unauthorized redirect/frame/IP pointing, defamation, terrorism propaganda, HYIP, warez, etc.	Abusive Domain Name(s) Abusive URL(s) Screenshot of the respective abusive page	Click here to report this case to us.

Multiple complaints regarding the same issue should be consolidated in a single support ticket, ensuring that tickets are not duplicated. If you have a ticket opened with our Legal and Abuse Department and would like to provide more details or have further questions, please continue this conversation via the ticket. This reduces cross-referencing and confusion, contributing to an efficient and timely communication.

Frequently Asked Questions

How can I check if a domain name is registered or hosted with NiceNIC?

Before reporting your concern, please make sure that the domain name in question uses our services. To check the domain name registration, go to the Whois lookup page.
Does your investigation differ for domains registered with NiceNIC and websites hosted by third parties?

Yes. NiceNIC reviews abuse reports based on the services involved, the available evidence, and the applicable requirements.
As a domain registrar, NiceNIC controls domain-registration functions but may not control website content, applications, email servers, or hosting infrastructure operated by third parties. In some cases, reporting abusive content to the hosting provider may allow for more targeted removal.
However, third-party hosting does not prevent NiceNIC from taking appropriate registrar-level action. When actionable evidence establishes that a gTLD domain sponsored by NiceNIC is being used for DNS Abuse, we promptly take mitigation measures reasonably necessary to stop or disrupt the abuse, as required by applicable ICANN obligations.
Other complaints are assessed under applicable law, registry rules, and NiceNIC policies. We consider the evidence, the severity of the issue, and the potential impact of any action before determining an appropriate response.
For more information, please see our Domain Abuse Transparency page:
https://nicenic.com/trust-center/domain-abuse-transparency/
How long does it take to review an abuse report?

NiceNIC provides confirmation of receipt for reports submitted through its official abuse reporting channels. Each report then enters our triage and assessment process. Confirmation of receipt does not mean that the reported activity has already been verified.
There is no single review or resolution timeframe for all abuse reports. Handling depends on the nature and urgency of the reported activity, the available evidence, and applicable requirements.
Where NiceNIC has actionable evidence that a gTLD domain it sponsors is being used for DNS Abuse, we promptly take mitigation measures reasonably necessary to stop or disrupt the abuse, as required by applicable ICANN obligations. The appropriate response is determined on a case-by-case basis and does not always require domain suspension.
If the available information is incomplete, we may request clarification or consider other reasonably available evidence. Some cases may require additional verification or coordination with relevant service providers or authorities.
If a reported domain is already restricted, NiceNIC may still assess whether further investigation or action is appropriate.
For more information about our handling process, please see Domain Abuse Transparency:
https://nicenic.com/trust-center/domain-abuse-transparency/
If you submit the abuse report via our Ticket system, you will get a ticket ID for you to track the result of complaint and you can check your ticket status by viewing the following link:
>>View my reports
When will I receive a response?

NiceNIC provides confirmation when an abuse report is received through our official reporting channels. We may request further information or provide case updates when appropriate.
Privacy, security, and legal requirements may limit the details we can disclose about an investigation or its outcome.
You may check the domain's registration status using a domain lookup service. A clientHold status is applied at the registrar level, while a serverHold status is applied at the registry level. Either status may affect DNS resolution, but the status alone does not establish the reason for the restriction or the outcome of an abuse investigation.
For more information about domain restrictions and case handling, please visit our Domain Abuse Transparency page:
https://nicenic.com/trust-center/domain-abuse-transparency/
Reopening or Appealing Responses?

Responses to reported complaints and abuses that are resolved in a satisfactory manner will be closed within 48 hours of a non-response from the complainant. If the response is not satisfactory, simply respond with additional information or detail that will allow for further investigation of the issue.
Does your system accept any file type for attachment?

For security reasons, we only accept the following file types: csv, doc, docx, eml, jpeg, jpg, pdf, png, txt, xls, xlsx. Thus, when attaching the evidence, please make sure to double-check whether the file is allowed by our system.
Thank you for your cooperation!