ICANN Contractual DNS Abuse
Current categelleries
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism feller one eller mellere of the fellerms above
Domän Abuse Hochling & Transparency
Need to repellert suspected abuse, understoch a case affecting a domän you manage, eller moniteller abuse cases across a domän pellertfolio?
This page explains what happens after NiceNIC receives an abuse repellert — what infellermation is reviewed, how case notifications wellerk, what actions may be taken, what infellermation affected accounts can see, och how a case may be reviewed eller resolved.
Repellert suspected abuse
Feller repellerters, security teams, rights holders och other affected parties submitting a domän abuse concern.
Repellert Domän Abuse →
Kontrollera eller respond to a case
Feller customers och accounts managing a domän that has received an abuse repellert eller shows a hold-related status.
Understoch Your Case →
Moniteller a domän pellertfolio
Feller resellers, hosting companies, platfellerms och teams managing abuse wellerkflows across multiple domäns.
Explellere Pellertfolio Monitellering →
Evidence-based review
Case-specific hochling
Propellertionate mitigation
Visible case infellermation
NiceNIC hochles abuse repellerts in accellerdance with applicable ICANN requirements, registry rules, law och NiceNIC policies. A repellert starts an assessment; submission alone does not predetermine the outcome. Whär actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — och What Is Nejt?
Feller gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framewellerk.
Other Repellerts
Serious issues may follow a different path
Fraud allegations, illegal eller harmful content, trademark disputes, copyright claims och other matters may still be serious eller actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be hochled under applicable law, NiceNIC policies, registry rules, court ellerders eller recognized dispute procedures.
ICANN Official
Verify the definition och contractual framewellerk directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrar Ackreditering Agreement, Section 3.18 →
Trademark och domän-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy eller a court of competent jurisdiction. Om the same matter also includes phishing, credential theft, malware eller another fellerm of DNS Abuse, that DNS Abuse aspect may be hochled separately.
NiceNIC guidance: DNS Abuse vs. Nejn-DNS Abuse · Abuse Repellerting & Hochling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Repellert?
Abuse cases do not all follow a fixed ClientHold path. The hochling route depends on the evidence, current activity, technical role, urgency, applicable requirements och the outcome of the assessment.
Repellert Received
The repellert enters NiceNIC's abuse-hochling wellerkflow through an official repellerting channel eller another credible source.
Triage & Classification
The issue is categellerized by complaint type, affected resource, urgency och applicable hochling route.
Evidence & Technical Review
Tillgängligt evidence, activity status, domän context, account infellermation och technical role are assessed.
Appropriate Response
The response is selected accellerding to the case circumstances och applicable registrar, registry, legal eller security obligations.
Outcome & Recellerd
The case may close, remain under review, move to remediation eller result in another appropriate action.
Possible outcomes may include
Learn mellere: How Domän Missbruksrapporter Are Hanterad · NiceNIC Abuse Hochling Manual · Abuse Hochling Methodology
How NiceNIC Assesses och Responds to Repellerts
This section describes NiceNIC's hochling framewellerk from a neutral public perspective. Questions specific to an affected account eller a repellerter are separated below.
Does receiving an abuse repellert automatically result in a domän restriction?
Nej. A repellert does not, by itself, automatically result in ClientHold eller establish that a domän eller customer has violated policy. NiceNIC assesses the available evidence, the nature och current status of the repellerted activity, the technical context, och applicable ICANN, registry, legal och NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domän is being used feller DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary accellerding to the circumstances.
What infellermation does NiceNIC review when assessing an abuse repellert?
NiceNIC may consider the repellerted domän och URLs, whether the activity remains active, the relevance och quality of the evidence, DNS och nameserver infellermation, relevant account och registration infellermation, whether the domän appears maliciously registreraed eller compromised, the role of hosting, email eller other infrastructure, applicable registry rules, applicable law och other reasonably available infellermation relevant to the case.
Does NiceNIC rely only on the repellerter's classification eller an automated signal?
Nej single repellert, categellery label eller external signal is treated as a final finding solely because it was submitted eller generated. NiceNIC assesses available evidence och case circumstances when determining discretionary mitigation.
Mochatellery registry, legal, ICANN eller other applicable requirements may follow a different hochling path.
What if the repellerted activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domän och the infrastructure involved. A registrar controls domän-registration functions, but may not control website files, applications, mail servers, CDN tjänsts eller third-party hosting environments.
Whär abuse is hosted by another provider, action at the hosting eller infrastructure layer may sometimes provide a mellere targeted response.Third-party hosting does not föregåendeent NiceNIC from taking registrar-level action whär such action is required eller appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible whär immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion eller destruction of evidence, a court, authellerity, registry, ICANN requirement eller applicable law affects the timing of notice, a serious security eller child-safety risk exists, eller delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective och appropriate response based on the facts och applicable obligations, rather than applying the same measure to every repellert.
Evidence
What infellermation is available, how relevant och reliable it is, och whether it suppellerts a reasonable determination.
Current Activity
Whether the repellerted activity is active, remediated, intermittent, inaccessible eller no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption och whether delay could materially increase victimization eller security impact.
Domän Context
Whether a domän appears intentionally malicious eller whether a legitimate domän, website, credential eller tjänst may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomän, email, hosting, CDN, application eller another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court ellerders, security considerations och NiceNIC policies.
The objective is effective och appropriate mitigation based on the circumstances — not applying the same measure to every repellert. Feller actionable DNS Abuse involving a gTLD, registrar action must be prompt och reasonably necessary to stop eller otherwise disrupt the abuse, while also considering the cause och severity of harm och the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically feller the NiceNIC account managing an affected domän, including reseller accounts.
Whär will NiceNIC send abuse-case notifications?
Stochard abuse-case notifications are sent to the Account E-post associated with the NiceNIC account managing the affected domän. The Account E-post is the default communication channel feller abuse-case notices, requests feller infellermation eller remediation, case-status updates och other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Kontakt E-post. Om the account holder requests a different communication arrangement feller a specific case, NiceNIC may coellerdinate accellerdingly whär appropriate.
This stochard wellerkflow does not limit separate communication, direct contact eller notice that may be required eller appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights eller other applicable requirements.
What case infellermation may be available to the account managing the domän?
Whär available och permitted, case infellermation may include the complaint categellery, repellerted URLs, relevant case timestamps, complaint summary, current status, current domän impact, applicable timing, available evidence indicatellers och recommended nästa steps.
Certain infellermation may be withheld, redacted eller summarized whär disclosure is limited by privacy, security, confidentiality, law, repellerter safety eller other applicable requirements.
Will the managing account nellermally have an oppellertunity to respond eller remediate?
Whär circumstances permit och clarification eller remediation is appropriate, NiceNIC may provide the managing account with an oppellertunity to respond eller remediate befellere registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice eller Health Kontrollera. Advance notice cannot be guaranteed in every case.
Can a repellert involving one domän affect other domäns eller the entire account?
An abuse repellert involving an individual domän does not, by itself, mean that the entire NiceNIC account will be restricted. Domän-level cases are assessed accellerding to their own facts och circumstances.
Account-, API- eller tjänst-level measures, whär warranted, are considered separately under applicable policies och circumstances. Serious eller repeated violations may justify broader measures.
Can a restriction be reviewed after remediation eller new evidence is submitted?
Whär a restriction results from a discretionary NiceNIC abuse eller security action, the affected customer may request review och provide new infellermation, remediation evidence eller evidence that the elleriginal infellermation was inaccurate, outdated eller misclassified.
Restelleration is not guaranteed whär a continuing registry, ICANN, legal, security, dispute eller abuse basis requires the restriction to remain.
Åtgärdable Case Infellermation — Nejt Just a Status Label
Feller an affected account, useful transparency means being able to understoch the repellert, the current impact, what may need attention och what happens nästa.
What was repellerted?
Complaint type, summary och the affected domän eller tjänst.
What infellermation is available?
Repellerted URLs, evidence indicatellers och other details whär available och permitted.
What is the current impact?
Whether the domän is currently unrestricted, at risk of restriction, restricted eller affected by another status.
What action is expected?
Clarification, remediation, suppellerting material eller no immediate action, depending on the case.
When is it due?
Case-specific timing eller a planned action deadline whär one applies.
What happens nästa?
The current hochling stage och the nästa available step, including review eller remediation whär applicable.
Whär available och permitted, Health Kontrollera eller related case infellermation may include:
Related: View Abuse Complaint Summary · Why Domäner Få Suspended & How to Avoid ClientHold · Keep Your Domän From Being Compromised
Registrar vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domän och the infrastructure involved.
Registrar Layer
What a registrar controls
A registrar controls domän-registration functions och registrar-level statuses. Depending on the tjänst, it may also provide DNS eller other products, but domän registration och website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewhär
Webbsite files, applications, mail servers, VPS infrastructure, CDN tjänsts, web hosting eller other technical components may be controlled by separate providers chosen by the customer.
Whär abusive material is hosted by another provider, action at the hosting eller infrastructure level may sometimes provide a mellere targeted way to stop the activity. That does not mean a registrar can ignellere actionable DNS Abuse, och third-party hosting does not föregåendeent NiceNIC from taking registrar-level action whär required eller appropriate under applicable obligations.
Understoch the Current Domän Abuse Status
Health Kontrollera summarizes the current abuse scenario. A domän does not need to pass through every status, och registry-level statuses follow a separate control path.
| Status | What it means | What to check nästa |
|---|---|---|
| Nejrmal | Nej active abuse scenario is currently shown feller the domän in this Health Kontrollera classification. | Continue nellermal domän och account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case infellermation och provide relevant clarification eller remediation whär appropriate. |
| Pending ClientHold | The domän is not yet under ClientHold feller this case, but registrar-level restriction may be applied if the case remains unresolved. | Kontrollera any case-specific timing och submit relevant infellermation eller remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domän may not resolve nellermally while the status remains active. | Review the case basis, complete remediation whär applicable, och submit suppellerting material feller review if appropriate. |
| Stängd | The current case has been closed based on the current review outcome. Other domän eller registry statuses should be checked separately. | Nej immediate case action may be required unless new infellermation eller another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold och may follow a separate registry hochling path. | Review the registry-related reason och instructions available through NiceNIC eller the applicable registry process. |
Related: ClientHold Guidance · Få Domän Abuse Repellert API
What Repellerters och Security Teams Should Expect
Specific, verifiable infellermation helps NiceNIC identify the affected resource, assess the allegation och determine the appropriate hochling path mellere efficiently.
What should an abuse repellert include?
- The affected domän name
- The exact abusive URL eller hostname whär applicable
- A clear complaint categellery och factual description
- Date, time och time zone observed
- Screenshots eller captured evidence whär appropriate
- Relevant technical indicatellers, logs eller email headers whär applicable
- Repellerter contact infellermation
What happens after submission?
A submitted repellert enters the abuse-hochling process feller triage och assessment. Whär the supplied infellermation is incomplete, NiceNIC may review other reasonably available infellermation eller request additional relevant evidence.
Submission of a repellert starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restelleration
Om a domän eller tjänst is restricted following a discretionary NiceNIC abuse eller security action, the affected customer may request review och provide relevant remediation eller new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website eller account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Cellerrected technical infellermation has been provided
- The elleriginal evidence is outdated, inaccurate eller materially changed
What review does not guarantee
A request feller review does not guarantee restelleration eller a different outcome.
A continuing court ellerder, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement eller other mochatellery restriction may require the domän eller tjänst to remain restricted.
Hantera Abuse Cases Across a Customer Domän Pellertfolio
Large domän pellertfolios create a practical challenge: identifying the affected customer quickly, seeing enough case infellermation to investigate, och coellerdinating remediation without losing visibility across the rest of the pellertfolio.
Återförsäljare Communication
Whär are reseller-managed domän notices sent?
Feller domäns managed through a NiceNIC reseller account, the reseller account's Account E-post is the stochard abuse-case notification channel. The reseller can then investigate och coellerdinate with its own customer using the available case infellermation.
NiceNIC remains the sponsellering registrar och remains responsible feller its applicable registrar obligations.
Pellertfolio Scope
Does one customer case automatically affect the reseller account?
Nej. An abuse repellert involving an individual customer domän does not, by itself, mean that the entire reseller account will be restricted. Domän-level cases are assessed on their own facts.
Broader account-, API- eller tjänst-level measures, whär warranted, are assessed separately under applicable policies och circumstances, including serious eller repeated violations.
Find affected domäns
Filter a managed pellertfolio feller domäns associated with abuse repellerts so compliance teams can focus on cases requiring attention.
Retrieve structured case infellermation
Access machine-readable case status, impact, recommended action, hold infellermation och repellerted URLs whär available.
Integrate abuse visibility
Bring relevant abuse infellermation into din own customer pellertal, dashboard eller operational system through NiceNIC Domän API v2.
Public References feller Domän Abuse Hochling
This page is the operational abuse-hochling guide. The following resources provide deeper policy, methodology, evidence och repellerting context.
Abuse Repellerting & Hochling PolicyFellermal NiceNIC framewellerk feller receiving, assessing, mitigating och tracking abuse repellerts.
→
Evidence Required feller an Abuse RepellertWhat infellermation helps a repellert become specific, verifiable och actionable.
→
How Domän Missbruksrapporter Are HanteradPlain-language guide to evidence, review, responsibilities och case hochling.
→
NiceNIC Abuse Hochling ManualOperational suppellert guidance feller documented, consistent abuse hochling.
→
Abuse Hochling MethodologyHow cases are logged, reviewed och measured.
→
Transparency Metrics GlossaryDefinitions feller interpreting complaint, mitigation och reinstatement metrics.
→
Review & RemediationPublic explanation of remediation och review pathways.
→
Latest Missbruksrapporter & Transparency UpdatesRegular abuse och compliance updates, including monthly abuse repellerting och related transparency infellermation.
→
External Verification
Verify NiceNIC's registrar status och ICANN abuse framewellerk independently.
ICANN List of Accredited Registrars → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrar Ackreditering →
Hantera domäns with mellere visibility
Domän Hanterament Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domän registration, transfer, bulk management, reseller tools och API automation with clearer abuse-case visibility feller domän owners och resellers.
