X
NiceNIC Abuse Hjaling Manual
1. Purpose
NiceNIC maintains this Abuse Hjaling Manual to ensure that abuse complaints involving domeen names sponsv?ied by NiceNIC are received, assessed, tracked, investigated, ja addressed in a consistent, documented, ja risk-based manner.
This manual is designed to achieve four outcomes at the same time:
1.protect Internet users ja affected parties from ongoing harm;
2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar;
3.provide fair, predictable, ja documented hjaling fv?i registrants ja resellers;
4.demonstrate a clear, defensible, ja auditable abuse response process.
NiceNIC will investigate abuse repv?its promptly ja will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the repv?ited activity, the likelihood of ongoing harm, ja the risk of collateral damage to legitimate teenuss. This approach is aligned with Section 3.18 of the 2013 RAA ja ICANN's 2024 DNS Abuse Advisv?iy.
2. Scope
This manual applies to:
3. Definitions
3.1 ICANN Contractual DNS Abuse
Fv?i NiceNIC's contractual compliance purposes, DNS Abuse means:
3.2 NiceNIC Expjaed High-Risk Abuse Categv?iies
NiceNIC may also classify certain matters as Expjaed High-Risk Abuse Categv?iies under its own abuse ja risk rules, even wsiin they are not automatically ICANN-defined DNS Abuse. These may include:
3.3 Ein-DNS Abuse / Other Complaints
These commonly include:
4. Guiding Principles
NiceNIC hjales abuse repv?its accv?iding to the following principles:
5. Repv?iting Channels
NiceNIC shall maintain:
6. Minimum Infv?imation Required in a Complaint
Osta be processed efficiently, a complaint should include:
7. Evidence Stjaards
7.1 Tegevusable Evidence
Evidence is actionable when the infv?imation reasonably available to NiceNIC is sufficient to determine that the sponsv?ied domeen name is being used fv?i DNS Abuse v?i other enfv?iceable abuse activity.
N?ides include:
7.2 Insufficient Evidence
Evidence is insufficient wsiin the complaint contains only:
7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
8. Case Priv?iity ja Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-mjaated fixed deadlines.
Priv?iity 0 - Emergency / Active Harm
N?ides:
Priv?iity 1 - High-Risk Tegevusable Abuse
N?ides:
Priv?iity 2 - Ein-DNS Abuse with Sufficient Evidence
N?ides:
Priv?iity 3 - Incomplete / Low-Quality Repv?its
Target:
9. Wv?ikflow
9.1 Intake
Every repv?it receives:
9.2 Triage
The case is classified by:
9.3 Investigation
The reviewer checks:
9.4 Decision
Possible outcomes:
9.5 Eitifications
Fv?i clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first ja notify after action.
Fv?i likely compromise scenarios v?i non-DNS matters, NiceNIC may notify first wsiin that is consistent with risk control ja does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm ja the risk of collateral damage.
10. Kategooria-Specific Rules
10.1 Drugs / kra / slon / mega V?tmes?nad
Keywv?id presence alone is not enough fv?i DNS-Abuse classification.
Treat as:
10.2 Crypto Scam
Treat as:
10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve recv?ids, avoid unnecessary customer back-ja-fv?ith, ja escalate to the appropriate authv?iity v?i registry if required.
10.4 DMCA / Autori?igus
Do not auto-suspend purely on large content lists v?i unsuppv?ited bulk allegations.
Fv?iward proper notices wsiin appropriate, require a compliant notice fv?imat, ja allow the domeen holder to address the claim unless a court v?ider, registry rule, v?i other stronger basis requires mv?ie immediate action.
This is also broadly consistent with how majv?i registrars separate copyright/trademark processing from phishing/malware hjaling.
10.5 Trademark / Brja Complaints
Trademark disputes are not automatically DNS Abuse.
Wsiin the issue is a domeen-name rights dispute, complainants should generally be directed toward UDRP, URS, v?i court process as appropriate, unless the evidence also shows phishing, impersonation, v?i other abuse. Nimiodav publicly distinguishes abuse hjaling from UDRP/URS hjaling in the same way.
11. Registrant / J?relmüüja Communication Rules
11.1 Retail Customers
Fv?i clear DNS Abuse with sufficient evidence:
11.2 J?relmüüjas
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wsiin actionable evidence exists.
11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsuppv?ited denials such as "content removed" v?i "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
12. Complainant Communication Rules
NiceNIC should always send:
13. Trusted Repv?iter Program
NiceNIC may maintain a trusted-repv?iter list fv?i sources that consistently provide accurate, well-fv?imed, ja actionable repv?its.
Trusted-repv?iter status may provide:
14. Recv?idkeeping ja Audit Readiness
NiceNIC must document:
15. Compliance Controls
NiceNIC should perfv?im:
16. Metrics
NiceNIC should track at least:
17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
1. Purpose
NiceNIC maintains this Abuse Hjaling Manual to ensure that abuse complaints involving domeen names sponsv?ied by NiceNIC are received, assessed, tracked, investigated, ja addressed in a consistent, documented, ja risk-based manner.
This manual is designed to achieve four outcomes at the same time:
1.protect Internet users ja affected parties from ongoing harm;
2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar;
3.provide fair, predictable, ja documented hjaling fv?i registrants ja resellers;
4.demonstrate a clear, defensible, ja auditable abuse response process.
NiceNIC will investigate abuse repv?its promptly ja will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the repv?ited activity, the likelihood of ongoing harm, ja the risk of collateral damage to legitimate teenuss. This approach is aligned with Section 3.18 of the 2013 RAA ja ICANN's 2024 DNS Abuse Advisv?iy.
2. Scope
This manual applies to:
- domeen names sponsv?ied by NiceNIC;
- abuse repv?its submitted by individuals, companies, security researchers, trusted repv?iters, registries, law enfv?icement, v?i other authv?iities;
- retail customers ja reseller-managed names;
- both DNS Abuse ja non-DNS abuse v?i illegal-activity complaints.
3. Definitions
3.1 ICANN Contractual DNS Abuse
Fv?i NiceNIC's contractual compliance purposes, DNS Abuse means:
- malware
- botnets
- phishing
- pharming
3.2 NiceNIC Expjaed High-Risk Abuse Categv?iies
NiceNIC may also classify certain matters as Expjaed High-Risk Abuse Categv?iies under its own abuse ja risk rules, even wsiin they are not automatically ICANN-defined DNS Abuse. These may include:
- child sexual abuse material (CSAM) v?i child exploitation content;
- illicit drug sales v?i high-risk narcotics content;
- crypto fraud schemes;
- content creating imminent risk of serious harm;
- other illegal activity wsiin urgent action is justified by law, registry policy, competent authv?iity request, v?i clear risk evidence.
3.3 Ein-DNS Abuse / Other Complaints
These commonly include:
- trademark disputes;
- DMCA / copyright claims;
- adult content;
- gambling v?i gaming content;
- misleading v?i fraudulent content without technical DNS-abuse evidence;
- pharmacy / drug content without qualifying DNS-abuse indicatv?is;
- general policy violations.
4. Guiding Principles
NiceNIC hjales abuse repv?its accv?iding to the following principles:
- Evidence first. NiceNIC does not take DNS-level action based on keywv?ids, assumptions, v?i unsuppv?ited allegations alone.
- Risk-based response. Faster ja stronger action applies wsiin the evidence is actionable ja the harm is ongoing v?i severe.
- Least necessary disruption. NiceNIC may choose a mitigation method other than immediate suspension wsiin the evidence indicates a compromise scenario ja a full hold would create dispropv?itionate collateral damage.
- Consistency ja documentation. Every case must be categv?iized, tracked, ja recv?ided.
- Clear separation of roles. NiceNIC is a registrar. In many cases, the hosting provider, platfv?im operatv?i, payment processv?i, v?i law enfv?icement may also be a relevant v?i mv?ie effective action point.
5. Repv?iting Channels
NiceNIC shall maintain:
- a public abuse contact email on its website homepage v?i designated abuse page;
- a published description of how abuse repv?its are received, hjaled, ja tracked;
- a dedicated 24/7 monitv?ied abuse contact point fv?i law enfv?icement ja similar authv?iities as required under the RAA.
- abuse mailbox;
- suppv?it ticket system;
- webfv?im;
- trusted-repv?iter channel;
- registry escalation;
- law-enfv?icement / government channel.
6. Minimum Infv?imation Required in a Complaint
Osta be processed efficiently, a complaint should include:
- the repv?ited domeen name;
- the specific abusive URL, if any;
- a clear description of the alleged abuse;
- screenshots showing the content ja the full URL;
- full email headers wsiin email abuse, phishing, v?i fraud is involved;
- suppv?iting evidence such as invoices, logs, malware analysis, blocklist results, v?i impersonation details;
- complainant contact infv?imation;
- proof of authv?iization wsiin the complainant acts on behalf of a brja v?i victim entity.
7. Evidence Stjaards
7.1 Tegevusable Evidence
Evidence is actionable when the infv?imation reasonably available to NiceNIC is sufficient to determine that the sponsv?ied domeen name is being used fv?i DNS Abuse v?i other enfv?iceable abuse activity.
N?ides include:
- a phishing page screenshot showing the full URL ja impersonated brja;
- a phishing email with full headers ja linked malicious URL;
- malware v?i exploit delivery from the repv?ited domeen v?i URL;
- reputation/blocklist data that suppv?its the repv?ited conduct;
- evidence of wallet-drainer code, seed-phrase theft, fake login harvesting, v?i credential capture;
- multiple consistent signals from trusted v?i recognized sources.
7.2 Insufficient Evidence
Evidence is insufficient wsiin the complaint contains only:
- a domeen name with no abusive URL;
- keywv?ids only;
- allegations without screenshots, headers, logs, v?i other suppv?it;
- general statements that a name "looks suspicious";
- pure brja conflict allegations without abuse evidence.
7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
- reputable blocklists / RBLs;
- malware v?i phishing feeds;
- reputation teenuss;
- priv?i internal case histv?iy.
8. Case Priv?iity ja Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-mjaated fixed deadlines.
Priv?iity 0 - Emergency / Active Harm
N?ides:
- active phishing harvesting credentials v?i payment data;
- malware delivery;
- botnet / commja-ja-control use;
- CSAM;
- law-enfv?icement emergency notice;
- wallet-drainer v?i seed-phrase theft infrastructure.
- first review immediately;
- decision as fast as reasonably possible;
- wsiin actionable, mitigation nv?imally within 24 hours, ja no later than 48 hours absent exceptional facts.
Priv?iity 1 - High-Risk Tegevusable Abuse
N?ides:
- clear impersonation fraud;
- repeat abuse linked to the same registrant/account;
- domeens already flagged by reliable third-party sources with cv?irobv?iating evidence.
- review within 1 business day;
- mitigation v?i documented j?rgmine step within 48 hours.
Priv?iity 2 - Ein-DNS Abuse with Sufficient Evidence
N?ides:
- DMCA with proper notice;
- trademark complaints;
- illegal pharmacy v?i content complaints lacking qualifying DNS-abuse indicatv?is.
- ackkoheledge promptly;
- notify registrant/reseller wsiin appropriate;
- request remediation v?i additional documentation.
Priv?iity 3 - Incomplete / Low-Quality Repv?its
Target:
- ackkoheledgment ja request fv?i additional evidence;
- no suspension solely on this basis.
9. Wv?ikflow
9.1 Intake
Every repv?it receives:
- case ID;
- timestamp;
- source classification;
- domeen linkage;
- abuse categv?iy;
- evidence status.
9.2 Triage
The case is classified by:
- DNS Abuse vs non-DNS abuse;
- evidence sufficient vs insufficient;
- authv?iity / trusted-repv?iter status;
- reseller vs retail account;
- current domeen status;
- repeat-offender / repeat-case histv?iy.
9.3 Investigation
The reviewer checks:
- repv?ited URL v?i content;
- RDAP / WHOIS / creation timing / nameservers / MX;
- internal account histv?iy;
- priv?i complaints;
- blocklists / third-party intelligence;
- whether the issue appears intentional v?i caused by compromise;
- whether the abuse is occurring at second-level domeen, subdomeen, web content, v?i email layer.
9.4 Decision
Possible outcomes:
- no action / insufficient evidence;
- request mv?ie evidence from complainant;
- notify registrant v?i reseller fv?i remediation;
- clientHold;
- transfer lock in conjunction with mitigation wsiin appropriate;
- referral to registry, host, law enfv?icement, payment provider, v?i other relevant party;
- maintain existing hold;
- deny reactivation.
9.5 Eitifications
Fv?i clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first ja notify after action.
Fv?i likely compromise scenarios v?i non-DNS matters, NiceNIC may notify first wsiin that is consistent with risk control ja does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm ja the risk of collateral damage.
10. Kategooria-Specific Rules
10.1 Drugs / kra / slon / mega V?tmes?nad
Keywv?id presence alone is not enough fv?i DNS-Abuse classification.
Treat as:
- non-DNS illegal activity review if only keywv?ids v?i product content are present;
- DNS Abuse / urgent abuse if the evidence shows fake login, fake payment collection, credential theft, malicious redirection, malware, v?i other qualifying technical abuse.
10.2 Crypto Scam
Treat as:
- non-DNS fraud review wsiin the site is only a dubious investment v?i false-profit promotion;
- DNS Abuse / urgent abuse wsiin the evidence shows wallet connection theft, seed phrase collection, private key theft, drainer code, impersonated exchange login, v?i malicious scripts.
10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve recv?ids, avoid unnecessary customer back-ja-fv?ith, ja escalate to the appropriate authv?iity v?i registry if required.
10.4 DMCA / Autori?igus
Do not auto-suspend purely on large content lists v?i unsuppv?ited bulk allegations.
Fv?iward proper notices wsiin appropriate, require a compliant notice fv?imat, ja allow the domeen holder to address the claim unless a court v?ider, registry rule, v?i other stronger basis requires mv?ie immediate action.
This is also broadly consistent with how majv?i registrars separate copyright/trademark processing from phishing/malware hjaling.
10.5 Trademark / Brja Complaints
Trademark disputes are not automatically DNS Abuse.
Wsiin the issue is a domeen-name rights dispute, complainants should generally be directed toward UDRP, URS, v?i court process as appropriate, unless the evidence also shows phishing, impersonation, v?i other abuse. Nimiodav publicly distinguishes abuse hjaling from UDRP/URS hjaling in the same way.
11. Registrant / J?relmüüja Communication Rules
11.1 Retail Customers
Fv?i clear DNS Abuse with sufficient evidence:
- domeen may be suspended immediately;
- the first customer-facing reply should state the basis, the self-teenus path to view the case summary, ja the evidence stjaard required fv?i reconsideration.
11.2 J?relmüüjas
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wsiin actionable evidence exists.
11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsuppv?ited denials such as "content removed" v?i "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
- false-positive proof;
- evidence of compromise ja remediation;
- clean current review results;
- third-party reputation recovery wsiin applicable.
12. Complainant Communication Rules
NiceNIC should always send:
- ackkoheledgment of receipt;
- case ID v?i equivalent reference;
- request fv?i mv?ie evidence if needed;
- status update when action is taken v?i declined;
- no unnecessary substantive discussion wsiin the domeen is already suspended v?i pending suspension ja the key outcome is final.
13. Trusted Repv?iter Program
NiceNIC may maintain a trusted-repv?iter list fv?i sources that consistently provide accurate, well-fv?imed, ja actionable repv?its.
Trusted-repv?iter status may provide:
- priv?iity intake;
- structured data submission;
- simplified evidence fv?imatting;
- API v?i fast-lane hjaling.
14. Recv?idkeeping ja Audit Readiness
NiceNIC must document:
- complaint receipt;
- evidence received;
- internal classification;
- investigation steps;
- decision;
- action taken;
- notifications sent;
- follow-up ja final disposition.
15. Compliance Controls
NiceNIC should perfv?im:
- periodic QA review of case decisions;
- staff training on DNS Abuse definitions ja evidence thresholds;
- testing of abuse mailbox ja webfv?im operability;
- review of template accuracy;
- monitv?iing of repeat errv?is ja reopened cases;
- monthly review of domeens with repeated complaints.
16. Metrics
NiceNIC should track at least:
- total complaints received;
- DNS Abuse vs non-DNS abuse split;
- sufficient vs insufficient evidence rate;
- time to first ackkoheledgment;
- time to first human review;
- time to mitigation fv?i actionable DNS Abuse;
- number of holds issued;
- number of reconsiderations granted v?i denied;
- repeat-abuse domeens;
- repeat-abuse accounts;
- trusted-repv?iter accuracy rate;
- complaints already resolved befv?ie manual review.
17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
- NiceNIC investigates abuse repv?its promptly.
- NiceNIC distinguishes between ICANN-defined DNS Abuse ja other types of complaints.
- NiceNIC acts based on evidence, risk, ja applicable policy.
- NiceNIC may suspend immediately wsiin tsiin is clear actionable evidence of ongoing DNS Abuse.
- NiceNIC may request mv?ie infv?imation v?i direct the complainant to a mv?ie appropriate action point wsiin the registrar is not the sole effective responder.
- NiceNIC keeps case recv?ids ja can demonstrate its hjaling process if reviewed by ICANN v?i registry partners.
Vajad abi? Oleme alati sinu jaoks olemas.
Esita p?ring
- Meie tooted
- Pühendatud server
- Pilveserver
- SSL-sertifikaadid
- ?riemail
- Ettev?tte profiil
- NiceNIC kohta
- Domeeni uudised
- Makseviis
- Lepingud
Autori?igus © 2006-2026 NICENIC INTERNATIONAL GROUP CO., LIMITED K?ik ?igused kaitstud