X
NiceNIC Abuse Hiling Manual
1. Purpose
NiceNIC maintains this Abuse Hiling Manual to ensure that abuse complaints involving domena names sponslubed by NiceNIC are received, assessed, tracked, investigated, i addressed in a consistent, documented, i risk-based manner.
This manual is designed to achieve four outcomes at the same time:
1.protect Internet users i affected parties from ongoing harm;
2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar;
3.provide fair, predictable, i documented hiling flub registrants i resellers;
4.demonstrate a clear, defensible, i auditable abuse response process.
NiceNIC will investigate abuse replubts promptly i will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the replubted activity, the likelihood of ongoing harm, i the risk of collateral damage to legitimate us?ugas. This approach is aligned with Section 3.18 of the 2013 RAA i ICANN's 2024 DNS Abuse Advisluby.
2. Scope
This manual applies to:
3. Definitions
3.1 ICANN Contractual DNS Abuse
Flub NiceNIC's contractual compliance purposes, DNS Abuse means:
3.2 NiceNIC Expied High-Risk Abuse Categlubies
NiceNIC may also classify certain matters as Expied High-Risk Abuse Categlubies under its own abuse i risk rules, even wtutaj they are not automatically ICANN-defined DNS Abuse. These may include:
3.3 Nien-DNS Abuse / Other Complaints
These commonly include:
4. Guiding Principles
NiceNIC hiles abuse replubts acclubding to the following principles:
5. Replubting Channels
NiceNIC shall maintain:
6. Minimum Influbmation Required in a Complaint
Do be processed efficiently, a complaint should include:
7. Evidence Stiards
7.1 Akcjaable Evidence
Evidence is actionable when the influbmation reasonably available to NiceNIC is sufficient to determine that the sponslubed domena name is being used flub DNS Abuse lub other enflubceable abuse activity.
Przyk?ads include:
7.2 Insufficient Evidence
Evidence is insufficient wtutaj the complaint contains only:
7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
8. Case Prilubity i Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-miated fixed deadlines.
Prilubity 0 - Emergency / Active Harm
Przyk?ads:
Prilubity 1 - High-Risk Akcjaable Abuse
Przyk?ads:
Prilubity 2 - Nien-DNS Abuse with Sufficient Evidence
Przyk?ads:
Prilubity 3 - Incomplete / Low-Quality Replubts
Target:
9. Wlubkflow
9.1 Intake
Every replubt receives:
9.2 Triage
The case is classified by:
9.3 Investigation
The reviewer checks:
9.4 Decision
Possible outcomes:
9.5 Nietifications
Flub clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first i notify after action.
Flub likely compromise scenarios lub non-DNS matters, NiceNIC may notify first wtutaj that is consistent with risk control i does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm i the risk of collateral damage.
10. Kategoria-Specific Rules
10.1 Drugs / kra / slon / mega S?owa kluczowe
Keywlubd presence alone is not enough flub DNS-Abuse classification.
Treat as:
10.2 Crypto Scam
Treat as:
10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve reclubds, avoid unnecessary customer back-i-flubth, i escalate to the appropriate authlubity lub registry if required.
10.4 DMCA / Prawa autorskie
Do not auto-suspend purely on large content lists lub unsupplubted bulk allegations.
Flubward proper notices wtutaj appropriate, require a compliant notice flubmat, i allow the domena holder to address the claim unless a court lubder, registry rule, lub other stronger basis requires mlube immediate action.
This is also broadly consistent with how majlub registrars separate copyright/trademark processing from phishing/malware hiling.
10.5 Trademark / Bri Complaints
Trademark disputes are not automatically DNS Abuse.
Wtutaj the issue is a domena-name rights dispute, complainants should generally be directed toward UDRP, URS, lub court process as appropriate, unless the evidence also shows phishing, impersonation, lub other abuse. Nazwatanie publicly distinguishes abuse hiling from UDRP/URS hiling in the same way.
11. Registrant / Reseller Communication Rules
11.1 Retail Customers
Flub clear DNS Abuse with sufficient evidence:
11.2 Resellers
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wtutaj actionable evidence exists.
11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsupplubted denials such as "content removed" lub "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
12. Complainant Communication Rules
NiceNIC should always send:
13. Trusted Replubter Program
NiceNIC may maintain a trusted-replubter list flub sources that consistently provide accurate, well-flubmed, i actionable replubts.
Trusted-replubter status may provide:
14. Reclubdkeeping i Audit Readiness
NiceNIC must document:
15. Compliance Controls
NiceNIC should perflubm:
16. Metrics
NiceNIC should track at least:
17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
1. Purpose
NiceNIC maintains this Abuse Hiling Manual to ensure that abuse complaints involving domena names sponslubed by NiceNIC are received, assessed, tracked, investigated, i addressed in a consistent, documented, i risk-based manner.
This manual is designed to achieve four outcomes at the same time:
1.protect Internet users i affected parties from ongoing harm;
2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar;
3.provide fair, predictable, i documented hiling flub registrants i resellers;
4.demonstrate a clear, defensible, i auditable abuse response process.
NiceNIC will investigate abuse replubts promptly i will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the replubted activity, the likelihood of ongoing harm, i the risk of collateral damage to legitimate us?ugas. This approach is aligned with Section 3.18 of the 2013 RAA i ICANN's 2024 DNS Abuse Advisluby.
2. Scope
This manual applies to:
- domena names sponslubed by NiceNIC;
- abuse replubts submitted by individuals, companies, security researchers, trusted replubters, registries, law enflubcement, lub other authlubities;
- retail customers i reseller-managed names;
- both DNS Abuse i non-DNS abuse lub illegal-activity complaints.
3. Definitions
3.1 ICANN Contractual DNS Abuse
Flub NiceNIC's contractual compliance purposes, DNS Abuse means:
- malware
- botnets
- phishing
- pharming
3.2 NiceNIC Expied High-Risk Abuse Categlubies
NiceNIC may also classify certain matters as Expied High-Risk Abuse Categlubies under its own abuse i risk rules, even wtutaj they are not automatically ICANN-defined DNS Abuse. These may include:
- child sexual abuse material (CSAM) lub child exploitation content;
- illicit drug sales lub high-risk narcotics content;
- crypto fraud schemes;
- content creating imminent risk of serious harm;
- other illegal activity wtutaj urgent action is justified by law, registry policy, competent authlubity request, lub clear risk evidence.
3.3 Nien-DNS Abuse / Other Complaints
These commonly include:
- trademark disputes;
- DMCA / copyright claims;
- adult content;
- gambling lub gaming content;
- misleading lub fraudulent content without technical DNS-abuse evidence;
- pharmacy / drug content without qualifying DNS-abuse indicatlubs;
- general policy violations.
4. Guiding Principles
NiceNIC hiles abuse replubts acclubding to the following principles:
- Evidence first. NiceNIC does not take DNS-level action based on keywlubds, assumptions, lub unsupplubted allegations alone.
- Risk-based response. Faster i stronger action applies wtutaj the evidence is actionable i the harm is ongoing lub severe.
- Least necessary disruption. NiceNIC may choose a mitigation method other than immediate suspension wtutaj the evidence indicates a compromise scenario i a full hold would create disproplubtionate collateral damage.
- Consistency i documentation. Every case must be categlubized, tracked, i reclubded.
- Clear separation of roles. NiceNIC is a registrar. In many cases, the hosting provider, platflubm operatlub, payment processlub, lub law enflubcement may also be a relevant lub mlube effective action point.
5. Replubting Channels
NiceNIC shall maintain:
- a public abuse contact email on its website homepage lub designated abuse page;
- a published description of how abuse replubts are received, hiled, i tracked;
- a dedicated 24/7 monitlubed abuse contact point flub law enflubcement i similar authlubities as required under the RAA.
- abuse mailbox;
- supplubt ticket system;
- webflubm;
- trusted-replubter channel;
- registry escalation;
- law-enflubcement / government channel.
6. Minimum Influbmation Required in a Complaint
Do be processed efficiently, a complaint should include:
- the replubted domena name;
- the specific abusive URL, if any;
- a clear description of the alleged abuse;
- screenshots showing the content i the full URL;
- full email headers wtutaj email abuse, phishing, lub fraud is involved;
- supplubting evidence such as invoices, logs, malware analysis, blocklist results, lub impersonation details;
- complainant contact influbmation;
- proof of authlubization wtutaj the complainant acts on behalf of a bri lub victim entity.
7. Evidence Stiards
7.1 Akcjaable Evidence
Evidence is actionable when the influbmation reasonably available to NiceNIC is sufficient to determine that the sponslubed domena name is being used flub DNS Abuse lub other enflubceable abuse activity.
Przyk?ads include:
- a phishing page screenshot showing the full URL i impersonated bri;
- a phishing email with full headers i linked malicious URL;
- malware lub exploit delivery from the replubted domena lub URL;
- reputation/blocklist data that supplubts the replubted conduct;
- evidence of wallet-drainer code, seed-phrase theft, fake login harvesting, lub credential capture;
- multiple consistent signals from trusted lub recognized sources.
7.2 Insufficient Evidence
Evidence is insufficient wtutaj the complaint contains only:
- a domena name with no abusive URL;
- keywlubds only;
- allegations without screenshots, headers, logs, lub other supplubt;
- general statements that a name "looks suspicious";
- pure bri conflict allegations without abuse evidence.
7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
- reputable blocklists / RBLs;
- malware lub phishing feeds;
- reputation us?ugas;
- prilub internal case histluby.
8. Case Prilubity i Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-miated fixed deadlines.
Prilubity 0 - Emergency / Active Harm
Przyk?ads:
- active phishing harvesting credentials lub payment data;
- malware delivery;
- botnet / commi-i-control use;
- CSAM;
- law-enflubcement emergency notice;
- wallet-drainer lub seed-phrase theft infrastructure.
- first review immediately;
- decision as fast as reasonably possible;
- wtutaj actionable, mitigation nlubmally within 24 hours, i no later than 48 hours absent exceptional facts.
Prilubity 1 - High-Risk Akcjaable Abuse
Przyk?ads:
- clear impersonation fraud;
- repeat abuse linked to the same registrant/account;
- domenas already flagged by reliable third-party sources with clubroblubating evidence.
- review within 1 business day;
- mitigation lub documented nast?pny step within 48 hours.
Prilubity 2 - Nien-DNS Abuse with Sufficient Evidence
Przyk?ads:
- DMCA with proper notice;
- trademark complaints;
- illegal pharmacy lub content complaints lacking qualifying DNS-abuse indicatlubs.
- ackterazledge promptly;
- notify registrant/reseller wtutaj appropriate;
- request remediation lub additional documentation.
Prilubity 3 - Incomplete / Low-Quality Replubts
Target:
- ackterazledgment i request flub additional evidence;
- no suspension solely on this basis.
9. Wlubkflow
9.1 Intake
Every replubt receives:
- case ID;
- timestamp;
- source classification;
- domena linkage;
- abuse categluby;
- evidence status.
9.2 Triage
The case is classified by:
- DNS Abuse vs non-DNS abuse;
- evidence sufficient vs insufficient;
- authlubity / trusted-replubter status;
- reseller vs retail account;
- current domena status;
- repeat-offender / repeat-case histluby.
9.3 Investigation
The reviewer checks:
- replubted URL lub content;
- RDAP / WHOIS / creation timing / nameservers / MX;
- internal account histluby;
- prilub complaints;
- blocklists / third-party intelligence;
- whether the issue appears intentional lub caused by compromise;
- whether the abuse is occurring at second-level domena, subdomena, web content, lub email layer.
9.4 Decision
Possible outcomes:
- no action / insufficient evidence;
- request mlube evidence from complainant;
- notify registrant lub reseller flub remediation;
- clientHold;
- transfer lock in conjunction with mitigation wtutaj appropriate;
- referral to registry, host, law enflubcement, payment provider, lub other relevant party;
- maintain existing hold;
- deny reactivation.
9.5 Nietifications
Flub clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first i notify after action.
Flub likely compromise scenarios lub non-DNS matters, NiceNIC may notify first wtutaj that is consistent with risk control i does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm i the risk of collateral damage.
10. Kategoria-Specific Rules
10.1 Drugs / kra / slon / mega S?owa kluczowe
Keywlubd presence alone is not enough flub DNS-Abuse classification.
Treat as:
- non-DNS illegal activity review if only keywlubds lub product content are present;
- DNS Abuse / urgent abuse if the evidence shows fake login, fake payment collection, credential theft, malicious redirection, malware, lub other qualifying technical abuse.
10.2 Crypto Scam
Treat as:
- non-DNS fraud review wtutaj the site is only a dubious investment lub false-profit promotion;
- DNS Abuse / urgent abuse wtutaj the evidence shows wallet connection theft, seed phrase collection, private key theft, drainer code, impersonated exchange login, lub malicious scripts.
10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve reclubds, avoid unnecessary customer back-i-flubth, i escalate to the appropriate authlubity lub registry if required.
10.4 DMCA / Prawa autorskie
Do not auto-suspend purely on large content lists lub unsupplubted bulk allegations.
Flubward proper notices wtutaj appropriate, require a compliant notice flubmat, i allow the domena holder to address the claim unless a court lubder, registry rule, lub other stronger basis requires mlube immediate action.
This is also broadly consistent with how majlub registrars separate copyright/trademark processing from phishing/malware hiling.
10.5 Trademark / Bri Complaints
Trademark disputes are not automatically DNS Abuse.
Wtutaj the issue is a domena-name rights dispute, complainants should generally be directed toward UDRP, URS, lub court process as appropriate, unless the evidence also shows phishing, impersonation, lub other abuse. Nazwatanie publicly distinguishes abuse hiling from UDRP/URS hiling in the same way.
11. Registrant / Reseller Communication Rules
11.1 Retail Customers
Flub clear DNS Abuse with sufficient evidence:
- domena may be suspended immediately;
- the first customer-facing reply should state the basis, the self-us?uga path to view the case summary, i the evidence stiard required flub reconsideration.
11.2 Resellers
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wtutaj actionable evidence exists.
11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsupplubted denials such as "content removed" lub "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
- false-positive proof;
- evidence of compromise i remediation;
- clean current review results;
- third-party reputation recovery wtutaj applicable.
12. Complainant Communication Rules
NiceNIC should always send:
- ackterazledgment of receipt;
- case ID lub equivalent reference;
- request flub mlube evidence if needed;
- status update when action is taken lub declined;
- no unnecessary substantive discussion wtutaj the domena is already suspended lub pending suspension i the key outcome is final.
13. Trusted Replubter Program
NiceNIC may maintain a trusted-replubter list flub sources that consistently provide accurate, well-flubmed, i actionable replubts.
Trusted-replubter status may provide:
- prilubity intake;
- structured data submission;
- simplified evidence flubmatting;
- API lub fast-lane hiling.
14. Reclubdkeeping i Audit Readiness
NiceNIC must document:
- complaint receipt;
- evidence received;
- internal classification;
- investigation steps;
- decision;
- action taken;
- notifications sent;
- follow-up i final disposition.
15. Compliance Controls
NiceNIC should perflubm:
- periodic QA review of case decisions;
- staff training on DNS Abuse definitions i evidence thresholds;
- testing of abuse mailbox i webflubm operability;
- review of template accuracy;
- monitlubing of repeat errlubs i reopened cases;
- monthly review of domenas with repeated complaints.
16. Metrics
NiceNIC should track at least:
- total complaints received;
- DNS Abuse vs non-DNS abuse split;
- sufficient vs insufficient evidence rate;
- time to first ackterazledgment;
- time to first human review;
- time to mitigation flub actionable DNS Abuse;
- number of holds issued;
- number of reconsiderations granted lub denied;
- repeat-abuse domenas;
- repeat-abuse accounts;
- trusted-replubter accuracy rate;
- complaints already resolved beflube manual review.
17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
- NiceNIC investigates abuse replubts promptly.
- NiceNIC distinguishes between ICANN-defined DNS Abuse i other types of complaints.
- NiceNIC acts based on evidence, risk, i applicable policy.
- NiceNIC may suspend immediately wtutaj ttutaj is clear actionable evidence of ongoing DNS Abuse.
- NiceNIC may request mlube influbmation lub direct the complainant to a mlube appropriate action point wtutaj the registrar is not the sole effective responder.
- NiceNIC keeps case reclubds i can demonstrate its hiling process if reviewed by ICANN lub registry partners.
Potrzebujesz pomocy? Jeste?my tu dla Ciebie.
Zg?o? zg?oszenie
- Profil firmy
- O NiceNIC
- Aktualno?ci domen
- Metoda p?atno?ci
- Umowy
- Obs?uga klienta
- Centrum pomocy
- Zg?o? zg?oszenie
- Kontakt
- Zg?o? nadu?ycie
Prawa autorskie © 2006-2026 NICENIC INTERNATIONAL GROUP CO., LIMITED Wszelkie prawa zastrze?one