ICANN Contractual DNS Abuse
Current categories
- Malware
- Botnets
- Phishing
- Pharming
- Spam when used as a delivery mechanism for one or more of the forms above
Domain Abuse Handling & Transparency
Need to report suspected abuse, understand a case affecting a domain you manage, or monitor abuse cases across a domain portfolio?
This page explains what happens after NiceNIC receives an abuse report — what information is reviewed, how case notifications work, what actions may be taken, what information affected accounts can see, and how a case may be reviewed or resolved.
Report suspected abuse
For reporters, security teams, rights holders and other affected parties submitting a domain abuse concern.
Report Domain Abuse →
Check or respond to a case
For customers and accounts managing a domain that has received an abuse report or shows a hold-related status.
Understand Your Case →
Monitor a domain portfolio
For resellers, hosting companies, platforms and teams managing abuse workflows across multiple domains.
Explore Portfolio Monitoring →
Evidence-based review
Case-specific handling
Proportionate mitigation
Visible case information
NiceNIC handles abuse reports in accordance with applicable ICANN requirements, registry rules, law and NiceNIC policies. A report starts an assessment; submission alone does not predetermine the outcome. Where actionable DNS Abuse is established, appropriate mitigation is taken as required.
What Is DNS Abuse — and What Is Not?
For gTLDs subject to NiceNIC's ICANN registrar obligations, DNS Abuse follows the definition established under the applicable ICANN contractual framework.
Other Reports
Serious issues may follow a different path
Fraud allegations, illegal or harmful content, trademark disputes, copyright claims and other matters may still be serious or actionable, but they do not automatically fall within ICANN's contractual definition of DNS Abuse.
Depending on the facts, they may be handled under applicable law, NiceNIC policies, registry rules, court orders or recognized dispute procedures.
ICANN Official
Verify the definition and contractual framework directly with ICANN.
ICANN DNS Abuse Mitigation Program → · 2013 Registrar Accreditation Agreement, Section 3.18 →
Trademark and domain-name rights disputes are not automatically DNS Abuse. Depending on the dispute, an appropriate mechanism may include UDRP, URS, a ccTLD-specific dispute policy or a court of competent jurisdiction. If the same matter also includes phishing, credential theft, malware or another form of DNS Abuse, that DNS Abuse aspect may be handled separately.
NiceNIC guidance: DNS Abuse vs. Non-DNS Abuse · Abuse Reporting & Handling Policy · Legal Policies
What Happens After NiceNIC Receives an Abuse Report?
Abuse cases do not all follow a fixed ClientHold path. The handling route depends on the evidence, current activity, technical role, urgency, applicable requirements and the outcome of the assessment.
Report Received
The report enters NiceNIC's abuse-handling workflow through an official reporting channel or another credible source.
Triage & Classification
The issue is categorized by complaint type, affected resource, urgency and applicable handling route.
Evidence & Technical Review
Available evidence, activity status, domain context, account information and technical role are assessed.
Appropriate Response
The response is selected according to the case circumstances and applicable registrar, registry, legal or security obligations.
Outcome & Record
The case may close, remain under review, move to remediation or result in another appropriate action.
Possible outcomes may include
Learn more: How Domain Abuse Reports Are Managed · NiceNIC Abuse Handling Manual · Abuse Handling Methodology
How NiceNIC Assesses and Responds to Reports
This section describes NiceNIC's handling framework from a neutral public perspective. Questions specific to an affected account or a reporter are separated below.
Does receiving an abuse report automatically result in a domain restriction?
No. A report does not, by itself, automatically result in ClientHold or establish that a domain or customer has violated policy. NiceNIC assesses the available evidence, the nature and current status of the reported activity, the technical context, and applicable ICANN, registry, legal and NiceNIC requirements.
When NiceNIC has actionable evidence that a gTLD domain is being used for DNS Abuse, appropriate mitigation is taken promptly as required. The appropriate response may vary according to the circumstances.
What information does NiceNIC review when assessing an abuse report?
NiceNIC may consider the reported domain and URLs, whether the activity remains active, the relevance and quality of the evidence, DNS and nameserver information, relevant account and registration information, whether the domain appears maliciously registered or compromised, the role of hosting, email or other infrastructure, applicable registry rules, applicable law and other reasonably available information relevant to the case.
Does NiceNIC rely only on the reporter's classification or an automated signal?
No single report, category label or external signal is treated as a final finding solely because it was submitted or generated. NiceNIC assesses available evidence and case circumstances when determining discretionary mitigation.
Mandatory registry, legal, ICANN or other applicable requirements may follow a different handling path.
What if the reported activity is hosted by a third-party provider?
NiceNIC considers the technical role of the domain and the infrastructure involved. A registrar controls domain-registration functions, but may not control website files, applications, mail servers, CDN services or third-party hosting environments.
Where abuse is hosted by another provider, action at the hosting or infrastructure layer may sometimes provide a more targeted response.Third-party hosting does not prevent NiceNIC from taking registrar-level action where such action is required or appropriate under applicable obligations.
When may action be taken without advance notice?
Advance notice may not be possible where immediate mitigation is reasonably necessary, evidence indicates intentionally malicious use, notice could enable evasion or destruction of evidence, a court, authority, registry, ICANN requirement or applicable law affects the timing of notice, a serious security or child-safety risk exists, or delay would materially increase harm.
How Is the Appropriate Response Determined?
The purpose of the review is to determine an effective and appropriate response based on the facts and applicable obligations, rather than applying the same measure to every report.
Evidence
What information is available, how relevant and reliable it is, and whether it supports a reasonable determination.
Current Activity
Whether the reported activity is active, remediated, intermittent, inaccessible or no longer reproducible.
Severity & Risk
The nature of the harm, the urgency of disruption and whether delay could materially increase victimization or security impact.
Domain Context
Whether a domain appears intentionally malicious or whether a legitimate domain, website, credential or service may have been compromised.
Technical Role
Whether the relevant issue is associated with the registration, DNS, a subdomain, email, hosting, CDN, application or another provider.
Applicable Requirements
Relevant ICANN requirements, registry rules, legal obligations, court orders, security considerations and NiceNIC policies.
The objective is effective and appropriate mitigation based on the circumstances — not applying the same measure to every report. For actionable DNS Abuse involving a gTLD, registrar action must be prompt and reasonably necessary to stop or otherwise disrupt the abuse, while also considering the cause and severity of harm and the risk of collateral damage.
What the Managing NiceNIC Account Should Expect
The following answers are written specifically for the NiceNIC account managing an affected domain, including reseller accounts.
Where will NiceNIC send abuse-case notifications?
Standard abuse-case notifications are sent to the Account Email associated with the NiceNIC account managing the affected domain. The Account Email is the default communication channel for abuse-case notices, requests for information or remediation, case-status updates and other operational communications relating to the case.
NiceNIC does not routinely send a separate abuse-case notification to a different Registrant Contact Email. If the account holder requests a different communication arrangement for a specific case, NiceNIC may coordinate accordingly where appropriate.
This standard workflow does not limit separate communication, direct contact or notice that may be required or appropriate under applicable law, ICANN requirements, registry rules, dispute procedures, security obligations, protection of registrant rights or other applicable requirements.
What case information may be available to the account managing the domain?
Where available and permitted, case information may include the complaint category, reported URLs, relevant case timestamps, complaint summary, current status, current domain impact, applicable timing, available evidence indicators and recommended next steps.
Certain information may be withheld, redacted or summarized where disclosure is limited by privacy, security, confidentiality, law, reporter safety or other applicable requirements.
Will the managing account normally have an opportunity to respond or remediate?
Where circumstances permit and clarification or remediation is appropriate, NiceNIC may provide the managing account with an opportunity to respond or remediate before registrar-level restriction.
When a case-specific deadline applies, the relevant timing may be shown in the abuse notice or Health Check. Advance notice cannot be guaranteed in every case.
Can a report involving one domain affect other domains or the entire account?
An abuse report involving an individual domain does not, by itself, mean that the entire NiceNIC account will be restricted. Domain-level cases are assessed according to their own facts and circumstances.
Account-, API- or service-level measures, where warranted, are considered separately under applicable policies and circumstances. Serious or repeated violations may justify broader measures.
Can a restriction be reviewed after remediation or new evidence is submitted?
Where a restriction results from a discretionary NiceNIC abuse or security action, the affected customer may request review and provide new information, remediation evidence or evidence that the original information was inaccurate, outdated or misclassified.
Restoration is not guaranteed where a continuing registry, ICANN, legal, security, dispute or abuse basis requires the restriction to remain.
Actionable Case Information — Not Just a Status Label
For an affected account, useful transparency means being able to understand the report, the current impact, what may need attention and what happens next.
What was reported?
Complaint type, summary and the affected domain or service.
What information is available?
Reported URLs, evidence indicators and other details where available and permitted.
What is the current impact?
Whether the domain is currently unrestricted, at risk of restriction, restricted or affected by another status.
What action is expected?
Clarification, remediation, supporting material or no immediate action, depending on the case.
When is it due?
Case-specific timing or a planned action deadline where one applies.
What happens next?
The current handling stage and the next available step, including review or remediation where applicable.
Where available and permitted, Health Check or related case information may include:
Related: View Abuse Complaint Summary · Why Domains Get Suspended & How to Avoid ClientHold · Keep Your Domain From Being Compromised
Registrar vs. Hosting Provider: Who Can Act?
NiceNIC evaluates the technical role of the domain and the infrastructure involved.
Registrar Layer
What a registrar controls
A registrar controls domain-registration functions and registrar-level statuses. Depending on the service, it may also provide DNS or other products, but domain registration and website hosting are distinct control layers.
Third-Party Infrastructure
What may sit elsewhere
Website files, applications, mail servers, VPS infrastructure, CDN services, web hosting or other technical components may be controlled by separate providers chosen by the customer.
Where abusive material is hosted by another provider, action at the hosting or infrastructure level may sometimes provide a more targeted way to stop the activity. That does not mean a registrar can ignore actionable DNS Abuse, and third-party hosting does not prevent NiceNIC from taking registrar-level action where required or appropriate under applicable obligations.
Understand the Current Domain Abuse Status
Health Check summarizes the current abuse scenario. A domain does not need to pass through every status, and registry-level statuses follow a separate control path.
| Status | What it means | What to check next |
|---|---|---|
| Normal | No active abuse scenario is currently shown for the domain in this Health Check classification. | Continue normal domain and account security practices. |
| Under Review | The abuse case is being assessed. This status does not, by itself, mean that ClientHold has been applied. | Review available case information and provide relevant clarification or remediation where appropriate. |
| Pending ClientHold | The domain is not yet under ClientHold for this case, but registrar-level restriction may be applied if the case remains unresolved. | Check any case-specific timing and submit relevant information or remediation promptly. |
| ClientHold | A registrar-level hold is currently applied. The domain may not resolve normally while the status remains active. | Review the case basis, complete remediation where applicable, and submit supporting material for review if appropriate. |
| Closed | The current case has been closed based on the current review outcome. Other domain or registry statuses should be checked separately. | No immediate case action may be required unless new information or another status requires attention. |
| ServerHold | A registry-level hold is present. It is not the same as registrar-level ClientHold and may follow a separate registry handling path. | Review the registry-related reason and instructions available through NiceNIC or the applicable registry process. |
Related: ClientHold Guidance · Get Domain Abuse Report API
What Reporters and Security Teams Should Expect
Specific, verifiable information helps NiceNIC identify the affected resource, assess the allegation and determine the appropriate handling path more efficiently.
What should an abuse report include?
- The affected domain name
- The exact abusive URL or hostname where applicable
- A clear complaint category and factual description
- Date, time and time zone observed
- Screenshots or captured evidence where appropriate
- Relevant technical indicators, logs or email headers where applicable
- Reporter contact information
What happens after submission?
A submitted report enters the abuse-handling process for triage and assessment. Where the supplied information is incomplete, NiceNIC may review other reasonably available information or request additional relevant evidence.
Submission of a report starts the assessment process; it does not predetermine the final outcome.
Review, Remediation & Restoration
If a domain or service is restricted following a discretionary NiceNIC abuse or security action, the affected customer may request review and provide relevant remediation or new evidence.
A review may consider whether
- The abusive activity has been removed
- A compromised website or account has been secured
- Relevant credentials have been reset
- Required security updates have been applied
- Corrected technical information has been provided
- The original evidence is outdated, inaccurate or materially changed
What review does not guarantee
A request for review does not guarantee restoration or a different outcome.
A continuing court order, registry requirement, ICANN obligation, UDRP/URS action, security basis, dispute requirement or other mandatory restriction may require the domain or service to remain restricted.
Manage Abuse Cases Across a Customer Domain Portfolio
Large domain portfolios create a practical challenge: identifying the affected customer quickly, seeing enough case information to investigate, and coordinating remediation without losing visibility across the rest of the portfolio.
Reseller Communication
Where are reseller-managed domain notices sent?
For domains managed through a NiceNIC reseller account, the reseller account's Account Email is the standard abuse-case notification channel. The reseller can then investigate and coordinate with its own customer using the available case information.
NiceNIC remains the sponsoring registrar and remains responsible for its applicable registrar obligations.
Portfolio Scope
Does one customer case automatically affect the reseller account?
No. An abuse report involving an individual customer domain does not, by itself, mean that the entire reseller account will be restricted. Domain-level cases are assessed on their own facts.
Broader account-, API- or service-level measures, where warranted, are assessed separately under applicable policies and circumstances, including serious or repeated violations.
Find affected domains
Filter a managed portfolio for domains associated with abuse reports so compliance teams can focus on cases requiring attention.
Retrieve structured case information
Access machine-readable case status, impact, recommended action, hold information and reported URLs where available.
Integrate abuse visibility
Bring relevant abuse information into your own customer portal, dashboard or operational system through NiceNIC Domain API v2.
Public References for Domain Abuse Handling
This page is the operational abuse-handling guide. The following resources provide deeper policy, methodology, evidence and reporting context.
Abuse Reporting & Handling PolicyFormal NiceNIC framework for receiving, assessing, mitigating and tracking abuse reports.
→
Evidence Required for an Abuse ReportWhat information helps a report become specific, verifiable and actionable.
→
How Domain Abuse Reports Are ManagedPlain-language guide to evidence, review, responsibilities and case handling.
→
NiceNIC Abuse Handling ManualOperational support guidance for documented, consistent abuse handling.
→
Abuse Handling MethodologyHow cases are logged, reviewed and measured.
→
Transparency Metrics GlossaryDefinitions for interpreting complaint, mitigation and reinstatement metrics.
→
Review & RemediationPublic explanation of remediation and review pathways.
→
Latest Abuse Reports & Transparency UpdatesRegular abuse and compliance updates, including monthly abuse reporting and related transparency information.
→
External Verification
Verify NiceNIC's registrar status and ICANN abuse framework independently.
ICANN List of Accredited Registrars → · ICANN DNS Abuse Mitigation Program → · NiceNIC Registrar Accreditation →
Manage domains with more visibility
Domain Management Should Stay Clear Even When Something Goes Wrong
NiceNIC combines domain registration, transfer, bulk management, reseller tools and API automation with clearer abuse-case visibility for domain owners and resellers.
