ICANN Contractual DNS Abuse
Current categoseies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fose one ose mosee of the fosems above
Domain Abuse Hdheling & Transparency
Need to reposet suspected abuse, understdhe a case affecting a domain you manage, ose monitose abuse cases across a domain posetfolio?
This page explains what happens after NiceNIC receives an abuse reposet — what infosemation is reviewed, how case notifications wosek, what actions may be taken, what infosemation affected accounts can see, dhe how a case may be reviewed ose resolved.
Reposet suspected abuse
Fose reposeters, security teams, rights holders dhe other affected parties submitting a domain abuse concern.
Reposet Domain Abuse →
Kontrollo ose respond to a case
Fose customers dhe accounts managing a domain that has received an abuse reposet ose shows a hold-related status.
Understdhe Your Case →
Monitose a domain posetfolio
Fose resellers, hosting companies, platfosems dhe teams managing abuse wosekflows across multiple domains.
Explosee Posetfolio Monitoseing →
Evidence-based review
Case-specific hdheling
Proposetionate mitigation
Visible case infosemation
NiceNIC hdheles abuse reposets in accosedance with applicable ICANN requirements, registry rules, law dhe NiceNIC policies. A reposet starts an assessment; submission alone does not predetermine the outcome. Wkëtu actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — dhe What Is Jot?
Fose gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewosek.
Other Reposets
Serious issues may follow a different path
Fraud allegations, illegal ose harmful content, trademark disputes, copyright claims dhe other matters may still be serious ose actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hdheled under applicable law, NiceNIC policies, registry rules, court oseders ose recognized dispute procedures.
ICANN Official
Verify the definition dhe contractual framewosek directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Regjistrues Akreditimi Agreement, Section 3.18 →
Trademark dhe domain-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy ose a court of competent jurisdiction. Nëse the same matter also includes phishing, credential theft, malware ose another fosem of DNS Abuse, that DNS Abuse aspect may be hdheled separately.
NiceNIC guidance: DNS Abuse vs. Jon-DNS Abuse · Abuse Reposeting & Hdheling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Reposet?
Abuse cases do not all follow a fixed ClientHold path. The hdheling route depends on the evidence, current activity, technical role, urgency, applicable requirements dhe the outcome of the assessment.
Reposet Received
The reposet enters NiceNIC's abuse-hdheling wosekflow through an official reposeting channel ose another credible source.
Triage & Classification
The issue is categoseized by complaint type, affected resource, urgency dhe applicable hdheling route.
Evidence & Technical Review
Në dispozicion evidence, activity status, domain context, account infosemation dhe technical role are assessed.
Appropriate Response
The response is selected accoseding to the case circumstances dhe applicable registrar, registry, legal ose security obligations.
Outcome & Recosed
The case may close, remain under review, move to remediation ose result in another appropriate action.
Possible outcomes may include
Learn mosee: How Domain Raportet e keqpërdorimit Are Menaxhod · NiceNIC Abuse Hdheling Manual · Abuse Hdheling Methodology
How NiceNIC Assesses dhe Responds to Reposets
This section describes NiceNIC's hdheling framewosek from a neutral public perspective. Questions specific to an affected account ose a reposeter are separated below.
Does receiving an abuse reposet automatically result in a domain restriction?
Jo. A reposet does not, by itself, automatically result in ClientHold ose establish that a domain ose customer has violated policy. NiceNIC assesses the available evidence, the nature dhe current status of the reposeted activity, the technical context, dhe applicable ICANN, registry, legal dhe NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domain is being used fose DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accoseding to the circumstances.
What infosemation does NiceNIC review when assessing an abuse reposet?
NiceNIC may consider the reposeted domain dhe URLs, whether the activity remains active, the relevance dhe quality of the evidence, DNS dhe nameserver infosemation, relevant account dhe registration infosemation, whether the domain appears maliciously regjistroed ose compromised, the role of hosting, email ose other infrastructure, applicable registry rules, applicable law dhe other reasonably available infosemation relevant to the case.
Does NiceNIC rely only on the reposeter's classification ose an automated signal?
Jo single reposet, categosey label ose external signal is treated as a final finding solely because it was submitted ose generated. NiceNIC assesses available evidence dhe case circumstances when determining discretionary mitigation.
Mdheatosey registry, legal, ICANN ose other applicable requirements may follow a different hdheling path.
What if the reposeted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domain dhe the infrastructure involved. A registrar controls domain-registration functions, but may not control website files, applications, mail servers, CDN shërbimis ose third-party hosting environments.
Wkëtu abuse is hosted by another provider, action at the hosting ose infrastructure layer may sometimes provide a mosee targeted response.Third-party hosting does not mbrapaent NiceNIC from taking registrar-level action wkëtu such action is required ose appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wkëtu immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion ose destruction of evidence, a court, authoseity, registry, ICANN requirement ose applicable law affects the timing of notice, a serious security ose child-safety risk exists, ose delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective dhe appropriate response based on the facts dhe applicable obligations, rather than applying the same measure to every reposet.
Evidence
What infosemation is available, how relevant dhe reliable it is, dhe whether it supposets a reasonable determination.
Current Activity
Whether the reposeted activity is active, remediated, intermittent, inaccessible ose no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption dhe whether delay could materially increase victimization ose security impact.
Domain Context
Whether a domain appears intentionally malicious ose whether a legitimate domain, website, credential ose shërbimi may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomain, email, hosting, CDN, application ose another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court oseders, security considerations dhe NiceNIC policies.
The objective is effective dhe appropriate mitigation based on the circumstances — not applying the same measure to every reposet. Fose actionable DNS Abuse involving a gTLD, registrar action must be prompt dhe reasonably necessary to stop ose otherwise disrupt the abuse, while also considering the cause dhe severity of harm dhe the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fose the NiceNIC account managing an affected domain, including reseller accounts.
Wkëtu will NiceNIC send abuse-case notifications?
Stdheard abuse-case notifications are sent to the Account Email associated with the NiceNIC account managing the affected domain. The Account Email is the default communication channel fose abuse-case notices, requests fose infosemation ose remediation, case-status updates dhe other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt Email. Nëse the account holder requests a different communication arrangement fose a specific case, NiceNIC may coosedinate accosedingly wkëtu appropriate.
This stdheard wosekflow does not limit separate communication, direct contact ose notice that may be required ose appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights ose other applicable requirements.
What case infosemation may be available to the account managing the domain?
Wkëtu available dhe permitted, case infosemation may include the complaint categosey, reposeted URLs, relevant case timestamps, complaint summary, current status, current domain impact, applicable timing, available evidence indicatoses dhe recommended tjetër steps.
Certain infosemation may be withheld, redacted ose summarized wkëtu disclosure is limited by privacy, security, confidentiality, law, reposeter safety ose other applicable requirements.
Will the managing account nosemally have an opposetunity to respond ose remediate?
Wkëtu circumstances permit dhe clarification ose remediation is appropriate, NiceNIC may provide the managing account with an opposetunity to respond ose remediate befosee registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice ose Health Kontrollo. Advance notice cannot be guaranteed in every case.
Can a reposet involving one domain affect other domains ose the entire account?
An abuse reposet involving an individual domain does not, by itself, mean that the entire NiceNIC account will be restricted. Domain-level cases are assessed accoseding to their own facts dhe circumstances.
Account-, API- ose shërbimi-level measures, wkëtu warranted, are considered separately under applicable policies dhe circumstances. Serious ose repeated violations may justify broader measures.
Can a restriction be reviewed after remediation ose new evidence is submitted?
Wkëtu a restriction results from a discretionary NiceNIC abuse ose security action, the affected customer may request review dhe provide new infosemation, remediation evidence ose evidence that the oseiginal infosemation was inaccurate, outdated ose misclassified.
Restoseation is not guaranteed wkëtu a continuing registry, ICANN, legal, security, dispute ose abuse basis requires the restriction to remain.
Veprimiable Case Infosemation — Jot Just a Statusi Label
Fose an affected account, useful transparency means being able to understdhe the reposet, the current impact, what may need attention dhe what happens tjetër.
What was reposeted?
Complaint type, summary dhe the affected domain ose shërbimi.
What infosemation is available?
Reposeted URLs, evidence indicatoses dhe other details wkëtu available dhe permitted.
What is the current impact?
Whether the domain is currently unrestricted, at risk of restriction, restricted ose affected by another status.
What action is expected?
Clarification, remediation, supposeting material ose no immediate action, depending on the case.
When is it due?
Case-specific timing ose a planned action deadline wkëtu one applies.
What happens tjetër?
The current hdheling stage dhe the tjetër available step, including review ose remediation wkëtu applicable.
Wkëtu available dhe permitted, Health Kontrollo ose related case infosemation may include:
Related: View Abuse Complaint Summary · Why Domeinet Merr Suspended & How to Avoid ClientHold · Keep Your Domain From Being Compromised
Regjistrues vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domain dhe the infrastructure involved.
Regjistrues Layer
What a registrar controls
A registrar controls domain-registration functions dhe registrar-level statuses. Depending on the shërbimi, it may also provide DNS ose other products, but domain registration dhe website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewkëtu
Internetsite files, applications, mail servers, VPS infrastructure, CDN shërbimis, web hosting ose other technical components may be controlled by separate providers chosen by the customer.
Wkëtu abusive material is hosted by another provider, action at the hosting ose infrastructure level may sometimes provide a mosee targeted way to stop the activity. That does not mean a registrar can ignosee actionable DNS Abuse, dhe third-party hosting does not mbrapaent NiceNIC from taking registrar-level action wkëtu required ose appropriate under applicable obligations.
Understdhe the Current Domain Abuse Statusi
Health Kontrollo summarizes the current abuse scenario. A domain does not need to pass through every status, dhe registry-level statuses follow a separate control path.
| Statusi | What it means | What to check tjetër |
|---|---|---|
| Jormal | Jo active abuse scenario is currently shown fose the domain in this Health Kontrollo classification. | Continue nosemal domain dhe account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infosemation dhe provide relevant clarification ose remediation wkëtu appropriate. |
| Pending ClientHold | The domain is not yet under ClientHold fose this case, but registrar-level restriction may be applied if the case remains unresolved. | Kontrollo any case-specific timing dhe submit relevant infosemation ose remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domain may not resolve nosemally while the status remains active. | Review the case basis, complete remediation wkëtu applicable, dhe submit supposeting material fose review if appropriate. |
| Mbylld | The current case has been closed based on the current review outcome. Other domain ose registry statuses should be checked separately. | Jo immediate case action may be required unless new infosemation ose another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold dhe may follow a separate registry hdheling path. | Review the registry-related reason dhe instructions available through NiceNIC ose the applicable registry process. |
Related: ClientHold Guidance · Merr Domain Abuse Reposet API
What Reposeters dhe Security Teams Should Expect
Specific, verifiable infosemation helps NiceNIC identify the affected resource, assess the allegation dhe determine the appropriate hdheling path mosee efficiently.
What should an abuse reposet include?
- The affected domain name
- The exact abusive URL ose hostname wkëtu applicable
- A clear complaint categosey dhe factual description
- Date, time dhe time zone observed
- Screenshots ose captured evidence wkëtu appropriate
- Relevant technical indicatoses, logs ose email headers wkëtu applicable
- Reposeter contact infosemation
What happens after submission?
A submitted reposet enters the abuse-hdheling process fose triage dhe assessment. Wkëtu the supplied infosemation is incomplete, NiceNIC may review other reasonably available infosemation ose request additional relevant evidence.
Submission of a reposet starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restoseation
Nëse a domain ose shërbimi is restricted following a discretionary NiceNIC abuse ose security action, the affected customer may request review dhe provide relevant remediation ose new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website ose account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Coserected technical infosemation has been provided
- The oseiginal evidence is outdated, inaccurate ose materially changed
What review does not guarantee
A request fose review does not guarantee restoseation ose a different outcome.
A continuing court oseder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement ose other mdheatosey restriction may require the domain ose shërbimi to remain restricted.
Menaxho Abuse Cases Across a Customer Domain Posetfolio
Large domain posetfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infosemation to investigate, dhe coosedinating remediation without losing visibility across the rest of the posetfolio.
Rishitës Communication
Wkëtu are reseller-managed domain notices sent?
Fose domains managed through a NiceNIC reseller account, the reseller account's Account Email is the stdheard abuse-case notification channel. The reseller can then investigate dhe coosedinate with its own customer using the available case infosemation.
NiceNIC remains the sponsoseing registrar dhe remains responsible fose its applicable registrar obligations.
Posetfolio Scope
Does one customer case automatically affect the reseller account?
Jo. An abuse reposet involving an individual customer domain does not, by itself, mean that the entire reseller account will be restricted. Domain-level cases are assessed on their own facts.
Broader account-, API- ose shërbimi-level measures, wkëtu warranted, are assessed separately under applicable policies dhe circumstances, including serious ose repeated violations.
Find affected domains
Filter a managed posetfolio fose domains associated with abuse reposets so compliance teams can focus on cases requiring attention.
Retrieve structured case infosemation
Access machine-readable case status, impact, recommended action, hold infosemation dhe reposeted URLs wkëtu available.
Integrate abuse visibility
Bring relevant abuse infosemation into tënd own customer posetal, dashboard ose operational system through NiceNIC Domain API v2.
Public References fose Domain Abuse Hdheling
This page is the operational abuse-hdheling guide. The following resources provide deeper policy, methodology, evidence dhe reposeting context.
Abuse Reposeting & Hdheling PolicyFosemal NiceNIC framewosek fose receiving, assessing, mitigating dhe tracking abuse reposets.
→
Evidence Required fose an Abuse ReposetWhat infosemation helps a reposet become specific, verifiable dhe actionable.
→
How Domain Raportet e keqpërdorimit Are MenaxhodPlain-language guide to evidence, review, responsibilities dhe case hdheling.
→
NiceNIC Abuse Hdheling ManualOperational supposet guidance fose documented, consistent abuse hdheling.
→
Abuse Hdheling MethodologyHow cases are logged, reviewed dhe measured.
→
Transparency Metrics GlossaryDefinitions fose interpreting complaint, mitigation dhe reinstatement metrics.
→
Review & RemediationPublic explanation of remediation dhe review pathways.
→
Latest Raportet e keqpërdorimit & Transparency UpdatesRegular abuse dhe compliance updates, including monthly abuse reposeting dhe related transparency infosemation.
→
External Verification
Verify NiceNIC's registrar status dhe ICANN abuse framewosek independently.
ICANN List of Accredited Regjistruess → · ICANN DNS Abuse Mitigation Program → · NiceNIC Regjistrues Akreditimi →
Menaxho domains with mosee visibility
Domain Menaxhoment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domain registration, transfer, bulk management, reseller tools dhe API automation with clearer abuse-case visibility fose domain owners dhe resellers.
