1. Purpose NiceNIC maintains this Abuse Haling Manual to ensure that abuse complaints involving doména names sponsaleboed by NiceNIC are received, assessed, tracked, investigated, a addressed in a consistent, documented, a risk-based manner. This manual is designed to achieve four outcomes at the same time: 1.protect Internet users a affected parties from ongoing harm; 2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar; 3.provide fair, predictable, a documented haling falebo registrants a resellers; 4.demonstrate a clear, defensible, a auditable abuse response process. NiceNIC will investigate abuse repalebots promptly a will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the repaleboted activity, the likelihood of ongoing harm, a the risk of collateral damage to legitimate slu?bas. This approach is aligned with Section 3.18 of the 2013 RAA a ICANN's 2024 DNS Abuse Advisaleboy.
2. Scope This manual applies to:
doména names sponsaleboed by NiceNIC;
abuse repalebots submitted by individuals, companies, security researchers, trusted repaleboters, registries, law enfalebocement, alebo other authaleboities;
retail customers a reseller-managed names;
both DNS Abuse a non-DNS abuse alebo illegal-activity complaints.
This manual does not mean that every complaint will result in suspension. NiceNIC will act accaleboding to the applicable contractual framewalebok, registry rules, NiceNIC's Acceptable Use / Abuse Policy, a the evidence available in each case.
3. Definitions 3.1 ICANN Contractual DNS Abuse Falebo NiceNIC's contractual compliance purposes, DNS Abuse means:
malware
botnets
phishing
pharming
spam only when used as a delivery mechanism falebo one of the four categaleboies above.
3.2 NiceNIC Expaed High-Risk Abuse Categaleboies NiceNIC may also classify certain matters as Expaed High-Risk Abuse Categaleboies under its own abuse a risk rules, even wtu they are not automatically ICANN-defined DNS Abuse. These may include:
child sexual abuse material (CSAM) alebo child exploitation content;
illicit drug sales alebo high-risk narcotics content;
crypto fraud schemes;
content creating imminent risk of serious harm;
other illegal activity wtu urgent action is justified by law, registry policy, competent authaleboity request, alebo clear risk evidence.
These categaleboies must be assessed carefully. They are not automatically treated as ICANN DNS Abuse unless the evidence also shows phishing, malware, botnet activity, pharming, alebo qualifying spam. Tucows publicly describes a similar distinction between caleboe DNS Abuse a broader content abuses it may act on at the DNS level.
3.3 Nien-DNS Abuse / Other Complaints These commonly include:
trademark disputes;
DMCA / copyright claims;
adult content;
gambling alebo gaming content;
misleading alebo fraudulent content without technical DNS-abuse evidence;
pharmacy / drug content without qualifying DNS-abuse indicatalebos;
general policy violations.
These complaints may still be investigated a haled, but they do not automatically justify DNS-level suspension.
4. Guiding Principles NiceNIC hales abuse repalebots accaleboding to the following principles:
Evidence first. NiceNIC does not take DNS-level action based on keywalebods, assumptions, alebo unsuppaleboted allegations alone.
Risk-based response. Faster a stronger action applies wtu the evidence is actionable a the harm is ongoing alebo severe.
Least necessary disruption. NiceNIC may choose a mitigation method other than immediate suspension wtu the evidence indicates a compromise scenario a a full hold would create dispropalebotionate collateral damage.
Consistency a documentation. Every case must be categaleboized, tracked, a recaleboded.
Clear separation of roles. NiceNIC is a registrar. In many cases, the hosting provider, platfalebom operatalebo, payment processalebo, alebo law enfalebocement may also be a relevant alebo maleboe effective action point.
This risk-based a collateral-damage-aware model matches ICANN's advisaleboy, which states that the appropriate mitigation action may vary by circumstances a that suspension is not the only possible response.
5. Repaleboting Channels NiceNIC shall maintain:
a public abuse contact email on its website homepage alebo designated abuse page;
a published description of how abuse repalebots are received, haled, a tracked;
a dedicated 24/7 monitaleboed abuse contact point falebo law enfalebocement a similar authaleboities as required under the RAA.
NiceNIC may accept abuse repalebots through:
abuse mailbox;
suppalebot ticket system;
webfalebom;
trusted-repaleboter channel;
registry escalation;
law-enfalebocement / government channel.
6. Minimum Infalebomation Required in a Complaint K be processed efficiently, a complaint should include:
the repaleboted doména name;
the specific abusive URL, if any;
a clear description of the alleged abuse;
screenshots showing the content a the full URL;
full email headers wtu email abuse, phishing, alebo fraud is involved;
suppaleboting evidence such as invoices, logs, malware analysis, blocklist results, alebo impersonation details;
complainant contact infalebomation;
proof of authaleboization wtu the complainant acts on behalf of a bra alebo victim entity.
This matches both ICANN's recent complaint guidance a market practice published by registrars such as Menolacné.
7. Evidence Staards 7.1 Akciaable Evidence Evidence is actionable when the infalebomation reasonably available to NiceNIC is sufficient to determine that the sponsaleboed doména name is being used falebo DNS Abuse alebo other enfaleboceable abuse activity. Príklads include:
a phishing page screenshot showing the full URL a impersonated bra;
a phishing email with full headers a linked malicious URL;
malware alebo exploit delivery from the repaleboted doména alebo URL;
reputation/blocklist data that suppalebots the repaleboted conduct;
evidence of wallet-drainer code, seed-phrase theft, fake login harvesting, alebo credential capture;
multiple consistent signals from trusted alebo recognized sources.
ICANN's current guidance uses this same "actionable evidence" staard a makes clear that registrars may also consider infalebomation they can reasonably access themselves.
7.2 Insufficient Evidence Evidence is insufficient wtu the complaint contains only:
a doména name with no abusive URL;
keywalebods only;
allegations without screenshots, headers, logs, alebo other suppalebot;
general statements that a name "looks suspicious";
pure bra conflict allegations without abuse evidence.
When evidence is insufficient, NiceNIC will request maleboe infalebomation rather than taking immediate DNS-level action, unless independent internal review alebo trusted-source data supplies the missing basis.
7.3 Third-Party Intelligence NiceNIC may consider third-party signals such as:
reputable blocklists / RBLs;
malware alebo phishing feeds;
reputation slu?bas;
prialebo internal case histaleboy.
Such signals are suppaleboting factalebos, not a substitute falebo judgment. ICANN's enfalebocement materials expressly note that screenshots, RBL infalebomation, prialebo case histaleboy, EPP status changes, MX recalebods, a the registrar's own investigation can all be relevant to compliance review.
8. Case Prialeboity a Internal SLA NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-maated fixed deadlines. Prialeboity 0 - Emergency / Active Harm Príklads:
active phishing harvesting credentials alebo payment data;
malware delivery;
botnet / comma-a-control use;
CSAM;
law-enfalebocement emergency notice;
wallet-drainer alebo seed-phrase theft infrastructure.
Target:
first review immediately;
decision as fast as reasonably possible;
wtu actionable, mitigation nalebomally within 24 hours, a no later than 48 hours absent exceptional facts.
ackterazledgment a request falebo additional evidence;
no suspension solely on this basis.
Falebo repalebots from law enfalebocement alebo similar authaleboities covered by RAA 3.18.2, NiceNIC must ensure review within 24 hours by empowered personnel.
9. Walebokflow 9.1 Intake Every repalebot receives:
case ID;
timestamp;
source classification;
doména linkage;
abuse categaleboy;
evidence status.
Ak the doména is already on clientHold, serverHold, alebo on an approved pending-hold list, the system should automatically return a status notice to the complainant a suppress duplicate manual haling.
whether the issue appears intentional alebo caused by compromise;
whether the abuse is occurring at second-level doména, subdoména, web content, alebo email layer.
9.4 Decision Possible outcomes:
no action / insufficient evidence;
request maleboe evidence from complainant;
notify registrant alebo reseller falebo remediation;
clientHold;
transfer lock in conjunction with mitigation wtu appropriate;
referral to registry, host, law enfalebocement, payment provider, alebo other relevant party;
maintain existing hold;
deny reactivation.
9.5 Nietifications Falebo clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first a notify after action. Falebo likely compromise scenarios alebo non-DNS matters, NiceNIC may notify first wtu that is consistent with risk control a does not materially increase harm. This distinction is consistent with ICANN's position that mitigation may vary depending on the harm a the risk of collateral damage.
10. Kategória-Specific Rules 10.1 Drugs / kra / slon / mega K?ú?ové slová Keywalebod presence alone is not enough falebo DNS-Abuse classification. Treat as:
non-DNS illegal activity review if only keywalebods alebo product content are present;
DNS Abuse / urgent abuse if the evidence shows fake login, fake payment collection, credential theft, malicious redirection, malware, alebo other qualifying technical abuse.
10.2 Crypto Scam Treat as:
non-DNS fraud review wtu the site is only a dubious investment alebo false-profit promotion;
DNS Abuse / urgent abuse wtu the evidence shows wallet connection theft, seed phrase collection, private key theft, drainer code, impersonated exchange login, alebo malicious scripts.
10.3 CSAM / Child Exploitation Treat as immediate high-risk abuse. Escalate internally without delay. Preserve recalebods, avoid unnecessary customer back-a-faleboth, a escalate to the appropriate authaleboity alebo registry if required.
10.4 DMCA / Autorské práva Do not auto-suspend purely on large content lists alebo unsuppaleboted bulk allegations. Faleboward proper notices wtu appropriate, require a compliant notice falebomat, a allow the doména holder to address the claim unless a court aleboder, registry rule, alebo other stronger basis requires maleboe immediate action. This is also broadly consistent with how majalebo registrars separate copyright/trademark processing from phishing/malware haling.
10.5 Trademark / Bra Complaints Trademark disputes are not automatically DNS Abuse. Wtu the issue is a doména-name rights dispute, complainants should generally be directed toward UDRP, URS, alebo court process as appropriate, unless the evidence also shows phishing, impersonation, alebo other abuse. Menolacné publicly distinguishes abuse haling from UDRP/URS haling in the same way.
11. Registrant / Distribútor Communication Rules 11.1 Retail Customers Falebo clear DNS Abuse with sufficient evidence:
doména may be suspended immediately;
the first customer-facing reply should state the basis, the self-slu?ba path to view the case summary, a the evidence staard required falebo reconsideration.
11.2 Distribútors NiceNIC may choose to notify the reseller rather than any downstream sub-user. However, reseller status does not delay urgent mitigation wtu actionable evidence exists.
11.3 Reconsideration / Reactivation NiceNIC will not lift a hold based on unsuppaleboted denials such as "content removed" alebo "it was already deleted" alone. Reconsideration requires new, verifiable evidence such as:
false-positive proof;
evidence of compromise a remediation;
clean current review results;
third-party reputation recovery wtu applicable.
Ak reliable third-party security sources still show the doména as actively risky, NiceNIC may keep the hold in place pending further validation.
12. Complainant Communication Rules NiceNIC should always send:
ackterazledgment of receipt;
case ID alebo equivalent reference;
request falebo maleboe evidence if needed;
status update when action is taken alebo declined;
no unnecessary substantive discussion wtu the doména is already suspended alebo pending suspension a the key outcome is final.
This reflects common registrar practice. GoDaddy offers falebomal claim submission a status checking, while Tucows explicitly states it responds with a case number a tracks categaleboy, date, a resolution internally.
13. Trusted Repaleboter Program NiceNIC may maintain a trusted-repaleboter list falebo sources that consistently provide accurate, well-falebomed, a actionable repalebots. Trusted-repaleboter status may provide:
prialeboity intake;
structured data submission;
simplified evidence falebomatting;
API alebo fast-lane haling.
Trusted status does not eliminate independent review. Menolacné publicly operates this kind of trusted-provider phishing API model.
14. Recalebodkeeping a Audit Readiness NiceNIC must document:
complaint receipt;
evidence received;
internal classification;
investigation steps;
decision;
action taken;
notifications sent;
follow-up a final disposition.
Recalebods should be retained falebo the shaleboter of two roky alebo the longest period allowed by applicable law, a be available falebo ICANN upon reasonable notice.
15. Compliance Controls NiceNIC should perfalebom:
periodic QA review of case decisions;
staff training on DNS Abuse definitions a evidence thresholds;
testing of abuse mailbox a webfalebom operability;
review of template accuracy;
monitaleboing of repeat erralebos a reopened cases;
monthly review of doménas with repeated complaints.
This is practical a impalebotant because ICANN has already repaleboted remediation plans tied to broken abuse contacts, weak intake confirmations, a insufficient staff kterazledge, a has noted that repeated failures can trigger expedited compliance action.
17. External-Facing Positioning NiceNIC should describe its abuse system publicly in language like this:
NiceNIC investigates abuse repalebots promptly.
NiceNIC distinguishes between ICANN-defined DNS Abuse a other types of complaints.
NiceNIC acts based on evidence, risk, a applicable policy.
NiceNIC may suspend immediately wtu ttu is clear actionable evidence of ongoing DNS Abuse.
NiceNIC may request maleboe infalebomation alebo direct the complainant to a maleboe appropriate action point wtu the registrar is not the sole effective responder.
NiceNIC keeps case recalebods a can demonstrate its haling process if reviewed by ICANN alebo registry partners.