Introduction
NiceNIC publishes monthly abuse-handling statistics to provide a clearer view of how abuse-related reports are recorded, reviewed, and handled over time. This September 2026 report summarizes complaint volume, domains involved, complaint categories, response timing, domain pausing, and recovery activity.
As an ICANN-accredited registrar, NiceNIC maintains an evidence-based abuse handling process that considers the nature of a report, available evidence, the domain's technical role, applicable requirements, and the appropriate level of registrar action. More information about this framework is available through the Domain Abuse Transparency page.
The September figures show a notable change from August: recorded complaints decreased, while the number of domains involved increased slightly. At the same time, the number of paused domains increased and the average response time moved slightly upward.
These statistics represent operational records. A complaint is an allegation or report requiring review; it does not by itself establish that DNS Abuse occurred or that a registrant violated a policy or law.
Methodology and Definitions
This report covers abuse-related complaints recorded in NiceNIC’s internal handling workflow during September 2026.
A complaint refers to a report received and recorded during the reporting period. One domain may receive multiple complaints, so complaint volume should not be interpreted as the number of unique abusive domains.
The complaint categories shown in this report include both DNS Abuse-related categories and other types of abuse or domain-related complaints. Under the applicable ICANN framework, DNS Abuse includes malware, botnets, phishing, pharming, and spam when spam serves as a delivery mechanism for those forms of DNS Abuse. Other complaints, such as trademark or fraud reports, may follow different review and resolution paths. See NiceNIC's Abuse Reporting & Handling Policy and What DNS Abuse Means for further explanation.
Paused domains refers to domains that entered a paused or comparable mitigation status during review based on the information available at the time and the applicable handling standard.
Recovered domains refers to domains restored after remediation, clarification, further review, or another valid recovery condition was met.
For this report:
- Pause Rate = Paused Domains / Domains Involved
- Recovery Rate = Recovered Domains / Paused Domains
The statistics are aggregate operational data and do not identify individual registrants or disclose individual case details.
Monthly Overview
During September 2026, NiceNIC recorded:
September’s most important change is the difference between complaint volume and domain volume. Recorded complaints fell from 30,450 in August to 26,608 in September, while involved domains increased from 9,539 to 9,659.
This means the monthly reduction in complaint volume was not accompanied by a reduction in the number of domains appearing in the reporting data. The figures alone do not establish why this pattern changed, since complaint sources, repeated reports, evidence, case status, and handling paths can vary from month to month.
Paused domains increased from 4,691 to 5,012, moving the pause rate from 49.18% to 51.89%. A pause rate is an operational metric and should not be interpreted as a confirmation rate for complaints or as a final finding against the affected domains.
The reported average response time moved from 2.3 days in August to 2.4 days in September. Response time is an average rather than a guaranteed maximum or resolution deadline, and individual cases can require different levels of review.
Recovered domains decreased from 149 to 131, with the recovery rate moving from 3.18% to 2.61%. Recovery activity depends on the cases that reach a valid remediation, clarification, or review outcome during the relevant period.
Complaint Categories
The September 2026 complaint distribution was:
The September category mix changed substantially from August.
Phishing
Phishing remained the largest category, with 15,558 recorded complaints, representing 58.47% of the monthly total.
The count increased by 1,402 complaints from August even though total complaint volume declined. As a result, phishing became a significantly larger share of the overall September reporting mix, rising from 46.49% to 58.47%.
This figure represents reports recorded under the phishing classification. It should not be read as a count of confirmed phishing incidents or unique abusive domains.
Trademark
Trademark complaints increased from 2,458 in August to 4,185 in September, a rise of approximately 70.3%.
Their share of the monthly complaint mix also increased from 8.07% to 15.73%.
Trademark complaints are not automatically DNS Abuse. Depending on the circumstances, domain-name rights disputes may require appropriate dispute-resolution procedures or other legal processes rather than registrar-level DNS Abuse mitigation.
Fraud, Other, and Drugs
Fraud-related complaints declined from 3,236 to 2,572, while their share moved from 10.63% to 9.67%.
The Other category decreased from 4,402 to 2,390, falling from 14.46% to 8.98%.
Drug-related complaints also declined, from 2,925 to 1,464, with their share decreasing from 9.61% to 5.50%.
These changes contributed to the much greater concentration of the September complaint mix in phishing and trademark reports.
Malware, Pharming, Spam, Botnet, and CSAM
The remaining categories represented smaller portions of the September total.
Malware complaints declined from 1,083 in August to 260 in September. Pharming decreased from 1,998 to 102, while spam decreased from 153 to 66 and botnet reports from 31 to 10.
One CSAM-related complaint was recorded during September. Such reports remain high-sensitivity matters and are handled according to applicable procedures regardless of their volume.
Lower complaint volume in a category should not be interpreted as lower operational importance.
Response Time Analysis
The reported average response time for September was 2.4 days, compared with 2.3 days in August.
The 0.1-day movement should be considered alongside the composition of the monthly workload rather than treated as a standalone measure of performance. Abuse reports can differ significantly in evidence quality, activity status, technical configuration, hosting arrangements, duplication, and the type of action that may be appropriate.
NiceNIC’s objective is to review reports in a timely manner while keeping decisions evidence-based and proportionate.
Reporters who identify suspected abuse involving a NiceNIC-sponsored domain can use the official Report Domain Abuse channel and provide the relevant domain, URLs, description, and supporting evidence.
Paused Domains and Recovery
NiceNIC recorded 5,012 paused domains in September, compared with 4,691 in August.
Using the reporting formula of paused domains divided by domains involved, the September pause rate was 51.89%, compared with 49.18% in August.
The increase in paused domains occurred during a month when total recorded complaints decreased. These two figures measure different aspects of the workflow and should therefore not be treated as direct indicators of one another.
A paused or comparable mitigation status is an operational action taken during case handling. It does not, by itself, constitute a final legal determination or establish that the underlying complaint was ultimately substantiated.
September recorded 131 recovered domains, compared with 149 in August.
Using recovered domains divided by paused domains, the September recovery rate was 2.61%.
Recovery is a separate stage of case handling. A domain may return to service following remediation, clarification, further review, updated evidence, or another valid recovery condition. Conversely, recovery does not by itself establish that an earlier complaint was incorrect.
Operational Summary and Ongoing Commitments
September’s data presents a different pattern from August: fewer recorded complaints, slightly more domains involved, more paused domains, a marginally higher reported average response time, and fewer recovered domains.
The most significant change was in complaint composition. Phishing increased in both count and share, while trademark reports also rose substantially. At the same time, several other categories declined considerably. The data therefore shows a change in the type of reporting workload, not simply a change in its overall size.
NiceNIC will continue to focus on:
- Clear complaint classification and evidence assessment;
- Timely review of reports according to their urgency and circumstances;
- Appropriate registrar-level mitigation where supported by applicable requirements and evidence;
- A review and remediation path where the circumstances allow;
- Consistent publication of aggregate abuse-handling statistics.
NiceNIC's Domain Abuse Transparency resources provide additional information about reporting, review, mitigation, customer notification, and recovery.
This report does not disclose individual domain cases or registrant information. Aggregate complaint statistics should not be used to infer the outcome or handling reason of any particular domain.
For suspected abuse, reporters should use NiceNIC's official Report Domain Abuse channel or contact the Abuse Team at [email protected].
Readers can also review the NiceNIC August 2026 Abuse Report to compare the preceding month's statistics and observe changes in complaint volume, category distribution, mitigation activity, and recovery outcomes.
