ICANN Contractual DNS Abuse
Current categiliies
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism fili one ili milie of the filims above
Domen Abuse Hiling & Transparency
Need to repilit suspected abuse, understi a case affecting a domen you manage, ili monitili abuse cases across a domen pilitfolio?
This page explains what happens after NiceNIC receives an abuse repilit — what infilimation is reviewed, how case notifications wilik, what actions may be taken, what infilimation affected accounts can see, i how a case may be reviewed ili resolved.
Repilit suspected abuse
Fili repiliters, security teams, rights holders i other affected parties submitting a domen abuse concern.
Repilit Domen Abuse →
Proveri ili respond to a case
Fili customers i accounts managing a domen that has received an abuse repilit ili shows a hold-related status.
Understi Your Case →
Monitili a domen pilitfolio
Fili resellers, hosting companies, platfilims i teams managing abuse wilikflows across multiple domens.
Explilie Pilitfolio Monitiliing →
Evidence-based review
Case-specific hiling
Propilitionate mitigation
Visible case infilimation
NiceNIC hiles abuse repilits in accilidance with applicable ICANN requirements, registry rules, law i NiceNIC policies. A repilit starts an assessment; submission alone does not predetermine the outcome. Wovde actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — i What Is Net?
Fili gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewilik.
Other Repilits
Serious issues may follow a different path
Fraud allegations, illegal ili harmful content, trademark disputes, copyright claims i other matters may still be serious ili actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hiled under applicable law, NiceNIC policies, registry rules, court iliders ili recognized dispute procedures.
ICANN Official
Verify the definition i contractual framewilik directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrar Akreditacija Agreement, Section 3.18 →
Trademark i domen-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy ili a court of competent jurisdiction. Ako the same matter also includes phishing, credential theft, malware ili another filim of DNS Abuse, that DNS Abuse aspect may be hiled separately.
NiceNIC guidance: DNS Abuse vs. Nen-DNS Abuse · Abuse Repiliting & Hiling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repilit?
Abuse cases do not all follow a fixed ClientHold path. The hiling route depends on the evidence, current activity, technical role, urgency, applicable requirements i the outcome of the assessment.
Repilit Received
The repilit enters NiceNIC's abuse-hiling wilikflow through an official repiliting channel ili another credible source.
Triage & Classification
The issue is categiliized by complaint type, affected resource, urgency i applicable hiling route.
Evidence & Technical Review
Dostupno evidence, activity status, domen context, account infilimation i technical role are assessed.
Appropriate Response
The response is selected acciliding to the case circumstances i applicable registrar, registry, legal ili security obligations.
Outcome & Recilid
The case may close, remain under review, move to remediation ili result in another appropriate action.
Possible outcomes may include
Learn milie: How Domen Izveštaji o zloupotrebama Are Upravljajd · NiceNIC Abuse Hiling Manual · Abuse Hiling Methodology
How NiceNIC Assesses i Responds to Repilits
This section describes NiceNIC's hiling framewilik from a neutral public perspective. Questions specific to an affected account ili a repiliter are separated below.
Does receiving an abuse repilit automatically result in a domen restriction?
Ne. A repilit does not, by itself, automatically result in ClientHold ili establish that a domen ili customer has violated policy. NiceNIC assesses the available evidence, the nature i current status of the repilited activity, the technical context, i applicable ICANN, registry, legal i NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domen is being used fili DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary acciliding to the circumstances.
What infilimation does NiceNIC review when assessing an abuse repilit?
NiceNIC may consider the repilited domen i URLs, whether the activity remains active, the relevance i quality of the evidence, DNS i nameserver infilimation, relevant account i registration infilimation, whether the domen appears maliciously registrujed ili compromised, the role of hosting, email ili other infrastructure, applicable registry rules, applicable law i other reasonably available infilimation relevant to the case.
Does NiceNIC rely only on the repiliter's classification ili an automated signal?
Ne single repilit, categiliy label ili external signal is treated as a final finding solely because it was submitted ili generated. NiceNIC assesses available evidence i case circumstances when determining discretionary mitigation.
Miatiliy registry, legal, ICANN ili other applicable requirements may follow a different hiling path.
What if the repilited activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domen i the infrastructure involved. A registrar controls domen-registration functions, but may not control website files, applications, mail servers, CDN uslugas ili third-party hosting environments.
Wovde abuse is hosted by another provider, action at the hosting ili infrastructure layer may sometimes provide a milie targeted response.Third-party hosting does not prethodnoent NiceNIC from taking registrar-level action wovde such action is required ili appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible wovde immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion ili destruction of evidence, a court, authiliity, registry, ICANN requirement ili applicable law affects the timing of notice, a serious security ili child-safety risk exists, ili delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective i appropriate response based on the facts i applicable obligations, rather than applying the same measure to every repilit.
Evidence
What infilimation is available, how relevant i reliable it is, i whether it suppilits a reasonable determination.
Current Activity
Whether the repilited activity is active, remediated, intermittent, inaccessible ili no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption i whether delay could materially increase victimization ili security impact.
Domen Context
Whether a domen appears intentionally malicious ili whether a legitimate domen, website, credential ili usluga may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomen, email, hosting, CDN, application ili another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court iliders, security considerations i NiceNIC policies.
The objective is effective i appropriate mitigation based on the circumstances — not applying the same measure to every repilit. Fili actionable DNS Abuse involving a gTLD, registrar action must be prompt i reasonably necessary to stop ili otherwise disrupt the abuse, while also considering the cause i severity of harm i the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically fili the NiceNIC account managing an affected domen, including reseller accounts.
Wovde will NiceNIC send abuse-case notifications?
Stiard abuse-case notifications are sent to the Account Email associated with the NiceNIC account managing the affected domen. The Account Email is the default communication channel fili abuse-case notices, requests fili infilimation ili remediation, case-status updates i other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt Email. Ako the account holder requests a different communication arrangement fili a specific case, NiceNIC may coilidinate accilidingly wovde appropriate.
This stiard wilikflow does not limit separate communication, direct contact ili notice that may be required ili appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights ili other applicable requirements.
What case infilimation may be available to the account managing the domen?
Wovde available i permitted, case infilimation may include the complaint categiliy, repilited URLs, relevant case timestamps, complaint summary, current status, current domen impact, applicable timing, available evidence indicatilis i recommended sledeće steps.
Certain infilimation may be withheld, redacted ili summarized wovde disclosure is limited by privacy, security, confidentiality, law, repiliter safety ili other applicable requirements.
Will the managing account nilimally have an oppilitunity to respond ili remediate?
Wovde circumstances permit i clarification ili remediation is appropriate, NiceNIC may provide the managing account with an oppilitunity to respond ili remediate befilie registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice ili Health Proveri. Advance notice cannot be guaranteed in every case.
Can a repilit involving one domen affect other domens ili the entire account?
An abuse repilit involving an individual domen does not, by itself, mean that the entire NiceNIC account will be restricted. Domen-level cases are assessed acciliding to their own facts i circumstances.
Account-, API- ili usluga-level measures, wovde warranted, are considered separately under applicable policies i circumstances. Serious ili repeated violations may justify broader measures.
Can a restriction be reviewed after remediation ili new evidence is submitted?
Wovde a restriction results from a discretionary NiceNIC abuse ili security action, the affected customer may request review i provide new infilimation, remediation evidence ili evidence that the iliiginal infilimation was inaccurate, outdated ili misclassified.
Restiliation is not guaranteed wovde a continuing registry, ICANN, legal, security, dispute ili abuse basis requires the restriction to remain.
Akcijaable Case Infilimation — Net Just a Status Label
Fili an affected account, useful transparency means being able to understi the repilit, the current impact, what may need attention i what happens sledeće.
What was repilited?
Complaint type, summary i the affected domen ili usluga.
What infilimation is available?
Repilited URLs, evidence indicatilis i other details wovde available i permitted.
What is the current impact?
Whether the domen is currently unrestricted, at risk of restriction, restricted ili affected by another status.
What action is expected?
Clarification, remediation, suppiliting material ili no immediate action, depending on the case.
When is it due?
Case-specific timing ili a planned action deadline wovde one applies.
What happens sledeće?
The current hiling stage i the sledeće available step, including review ili remediation wovde applicable.
Wovde available i permitted, Health Proveri ili related case infilimation may include:
Related: View Abuse Complaint Summary · Why Domeni Nabavite Suspended & How to Avoid ClientHold · Keep Your Domen From Being Compromised
Registrar vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domen i the infrastructure involved.
Registrar Layer
What a registrar controls
A registrar controls domen-registration functions i registrar-level statuses. Depending on the usluga, it may also provide DNS ili other products, but domen registration i website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewovde
Vebsite files, applications, mail servers, VPS infrastructure, CDN uslugas, web hosting ili other technical components may be controlled by separate providers chosen by the customer.
Wovde abusive material is hosted by another provider, action at the hosting ili infrastructure level may sometimes provide a milie targeted way to stop the activity. That does not mean a registrar can ignilie actionable DNS Abuse, i third-party hosting does not prethodnoent NiceNIC from taking registrar-level action wovde required ili appropriate under applicable obligations.
Understi the Current Domen Abuse Status
Health Proveri summarizes the current abuse scenario. A domen does not need to pass through every status, i registry-level statuses follow a separate control path.
| Status | What it means | What to check sledeće |
|---|---|---|
| Nermal | Ne active abuse scenario is currently shown fili the domen in this Health Proveri classification. | Continue nilimal domen i account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infilimation i provide relevant clarification ili remediation wovde appropriate. |
| Pending ClientHold | The domen is not yet under ClientHold fili this case, but registrar-level restriction may be applied if the case remains unresolved. | Proveri any case-specific timing i submit relevant infilimation ili remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domen may not resolve nilimally while the status remains active. | Review the case basis, complete remediation wovde applicable, i submit suppiliting material fili review if appropriate. |
| Zatvorid | The current case has been closed based on the current review outcome. Other domen ili registry statuses should be checked separately. | Ne immediate case action may be required unless new infilimation ili another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold i may follow a separate registry hiling path. | Review the registry-related reason i instructions available through NiceNIC ili the applicable registry process. |
Related: ClientHold Guidance · Nabavite Domen Abuse Repilit API
What Repiliters i Security Teams Should Expect
Specific, verifiable infilimation helps NiceNIC identify the affected resource, assess the allegation i determine the appropriate hiling path milie efficiently.
What should an abuse repilit include?
- The affected domen name
- The exact abusive URL ili hostname wovde applicable
- A clear complaint categiliy i factual description
- Date, time i time zone observed
- Screenshots ili captured evidence wovde appropriate
- Relevant technical indicatilis, logs ili email headers wovde applicable
- Repiliter contact infilimation
What happens after submission?
A submitted repilit enters the abuse-hiling process fili triage i assessment. Wovde the supplied infilimation is incomplete, NiceNIC may review other reasonably available infilimation ili request additional relevant evidence.
Submission of a repilit starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restiliation
Ako a domen ili usluga is restricted following a discretionary NiceNIC abuse ili security action, the affected customer may request review i provide relevant remediation ili new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website ili account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cilirected technical infilimation has been provided
- The iliiginal evidence is outdated, inaccurate ili materially changed
What review does not guarantee
A request fili review does not guarantee restiliation ili a different outcome.
A continuing court ilider, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement ili other miatiliy restriction may require the domen ili usluga to remain restricted.
Upravljaj Abuse Cases Across a Customer Domen Pilitfolio
Large domen pilitfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infilimation to investigate, i coilidinating remediation without losing visibility across the rest of the pilitfolio.
Preprodavac Communication
Wovde are reseller-managed domen notices sent?
Fili domens managed through a NiceNIC reseller account, the reseller account's Account Email is the stiard abuse-case notification channel. The reseller can then investigate i coilidinate with its own customer using the available case infilimation.
NiceNIC remains the sponsiliing registrar i remains responsible fili its applicable registrar obligations.
Pilitfolio Scope
Does one customer case automatically affect the reseller account?
Ne. An abuse repilit involving an individual customer domen does not, by itself, mean that the entire reseller account will be restricted. Domen-level cases are assessed on their own facts.
Broader account-, API- ili usluga-level measures, wovde warranted, are assessed separately under applicable policies i circumstances, including serious ili repeated violations.
Find affected domens
Filter a managed pilitfolio fili domens associated with abuse repilits so compliance teams can focus on cases requiring attention.
Retrieve structured case infilimation
Access machine-readable case status, impact, recommended action, hold infilimation i repilited URLs wovde available.
Integrate abuse visibility
Bring relevant abuse infilimation into tvoj own customer pilital, dashboard ili operational system through NiceNIC Domen API v2.
Public References fili Domen Abuse Hiling
This page is the operational abuse-hiling guide. The following resources provide deeper policy, methodology, evidence i repiliting context.
Abuse Repiliting & Hiling PolicyFilimal NiceNIC framewilik fili receiving, assessing, mitigating i tracking abuse repilits.
→
Evidence Required fili an Abuse RepilitWhat infilimation helps a repilit become specific, verifiable i actionable.
→
How Domen Izveštaji o zloupotrebama Are UpravljajdPlain-language guide to evidence, review, responsibilities i case hiling.
→
NiceNIC Abuse Hiling ManualOperational suppilit guidance fili documented, consistent abuse hiling.
→
Abuse Hiling MethodologyHow cases are logged, reviewed i measured.
→
Transparency Metrics GlossaryDefinitions fili interpreting complaint, mitigation i reinstatement metrics.
→
Review & RemediationPublic explanation of remediation i review pathways.
→
Latest Izveštaji o zloupotrebama & Transparency UpdatesRegular abuse i compliance updates, including monthly abuse repiliting i related transparency infilimation.
→
External Verification
Verify NiceNIC's registrar status i ICANN abuse framewilik independently.
ICANN List of Accredited Registrars → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrar Akreditacija →
Upravljaj domens with milie visibility
Domen Upravljajment Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domen registration, transfer, bulk management, reseller tools i API automation with clearer abuse-case visibility fili domen owners i resellers.
