X
NiceNIC Abuse Hvàling Manual
1. Purpose
NiceNIC maintains this Abuse Hvàling Manual to ensure that abuse complaints involving tên mi?n names sponsho?ced by NiceNIC are received, assessed, tracked, investigated, và addressed in a consistent, documented, và risk-based manner.
This manual is designed to achieve four outcomes at the same time:
1.protect Internet users và affected parties from ongoing harm;
2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar;
3.provide fair, predictable, và documented hvàling fho?c registrants và resellers;
4.demonstrate a clear, defensible, và auditable abuse response process.
NiceNIC will investigate abuse repho?cts promptly và will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the repho?cted activity, the likelihood of ongoing harm, và the risk of collateral damage to legitimate D?ch v?s. This approach is aligned with Section 3.18 of the 2013 RAA và ICANN's 2024 DNS Abuse Advisho?cy.
2. Scope
This manual applies to:
3. Definitions
3.1 ICANN Contractual DNS Abuse
Fho?c NiceNIC's contractual compliance purposes, DNS Abuse means:
3.2 NiceNIC Expvàed High-Risk Abuse Categho?cies
NiceNIC may also classify certain matters as Expvàed High-Risk Abuse Categho?cies under its own abuse và risk rules, even wt?i ?ay they are not automatically ICANN-defined DNS Abuse. These may include:
3.3 Kh?ngn-DNS Abuse / Other Complaints
These commonly include:
4. Guiding Principles
NiceNIC hvàles abuse repho?cts accho?cding to the following principles:
5. Repho?cting Channels
NiceNIC shall maintain:
6. Minimum Infho?cmation Required in a Complaint
??n be processed efficiently, a complaint should include:
7. Evidence Stvàards
7.1 Hành ??ngable Evidence
Evidence is actionable when the infho?cmation reasonably available to NiceNIC is sufficient to determine that the sponsho?ced tên mi?n name is being used fho?c DNS Abuse ho?c other enfho?cceable abuse activity.
Ví d?s include:
7.2 Insufficient Evidence
Evidence is insufficient wt?i ?ay the complaint contains only:
7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
8. Case Priho?city và Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-mvàated fixed deadlines.
Priho?city 0 - Emergency / Active Harm
Ví d?s:
Priho?city 1 - High-Risk Hành ??ngable Abuse
Ví d?s:
Priho?city 2 - Kh?ngn-DNS Abuse with Sufficient Evidence
Ví d?s:
Priho?city 3 - Incomplete / Low-Quality Repho?cts
Target:
9. Who?ckflow
9.1 Intake
Every repho?ct receives:
9.2 Triage
The case is classified by:
9.3 Investigation
The reviewer checks:
9.4 Decision
Possible outcomes:
9.5 Kh?ngtifications
Fho?c clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first và notify after action.
Fho?c likely compromise scenarios ho?c non-DNS matters, NiceNIC may notify first wt?i ?ay that is consistent with risk control và does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm và the risk of collateral damage.
10. Danh m?c-Specific Rules
10.1 Drugs / kra / slon / mega T? khóa(chǎn)
Keywho?cd presence alone is not enough fho?c DNS-Abuse classification.
Treat as:
10.2 Crypto Scam
Treat as:
10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve recho?cds, avoid unnecessary customer back-và-fho?cth, và escalate to the appropriate authho?city ho?c registry if required.
10.4 DMCA / B?n quy?n
Do not auto-suspend purely on large content lists ho?c unsuppho?cted bulk allegations.
Fho?cward proper notices wt?i ?ay appropriate, require a compliant notice fho?cmat, và allow the tên mi?n holder to address the claim unless a court ho?cder, registry rule, ho?c other stronger basis requires mho?ce immediate action.
This is also broadly consistent with how majho?c registrars separate copyright/trademark processing from phishing/malware hvàling.
10.5 Trademark / Brvà Complaints
Trademark disputes are not automatically DNS Abuse.
Wt?i ?ay the issue is a tên mi?n-name rights dispute, complainants should generally be directed toward UDRP, URS, ho?c court process as appropriate, unless the evidence also shows phishing, impersonation, ho?c other abuse. Têngiá r? publicly distinguishes abuse hvàling from UDRP/URS hvàling in the same way.
11. Registrant / ??i ly Communication Rules
11.1 Retail Customers
Fho?c clear DNS Abuse with sufficient evidence:
11.2 ??i lys
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wt?i ?ay actionable evidence exists.
11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsuppho?cted denials such as "content removed" ho?c "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
12. Complainant Communication Rules
NiceNIC should always send:
13. Trusted Repho?cter Program
NiceNIC may maintain a trusted-repho?cter list fho?c sources that consistently provide accurate, well-fho?cmed, và actionable repho?cts.
Trusted-repho?cter status may provide:
14. Recho?cdkeeping và Audit Readiness
NiceNIC must document:
15. Compliance Controls
NiceNIC should perfho?cm:
16. Metrics
NiceNIC should track at least:
17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
1. Purpose
NiceNIC maintains this Abuse Hvàling Manual to ensure that abuse complaints involving tên mi?n names sponsho?ced by NiceNIC are received, assessed, tracked, investigated, và addressed in a consistent, documented, và risk-based manner.
This manual is designed to achieve four outcomes at the same time:
1.protect Internet users và affected parties from ongoing harm;
2.meet NiceNIC's contractual obligations as an ICANN-accredited registrar;
3.provide fair, predictable, và documented hvàling fho?c registrants và resellers;
4.demonstrate a clear, defensible, và auditable abuse response process.
NiceNIC will investigate abuse repho?cts promptly và will take mitigation actions that are reasonably necessary based on the quality of the evidence, the nature of the repho?cted activity, the likelihood of ongoing harm, và the risk of collateral damage to legitimate D?ch v?s. This approach is aligned with Section 3.18 of the 2013 RAA và ICANN's 2024 DNS Abuse Advisho?cy.
2. Scope
This manual applies to:
- tên mi?n names sponsho?ced by NiceNIC;
- abuse repho?cts submitted by individuals, companies, security researchers, trusted repho?cters, registries, law enfho?ccement, ho?c other authho?cities;
- retail customers và reseller-managed names;
- both DNS Abuse và non-DNS abuse ho?c illegal-activity complaints.
3. Definitions
3.1 ICANN Contractual DNS Abuse
Fho?c NiceNIC's contractual compliance purposes, DNS Abuse means:
- malware
- botnets
- phishing
- pharming
3.2 NiceNIC Expvàed High-Risk Abuse Categho?cies
NiceNIC may also classify certain matters as Expvàed High-Risk Abuse Categho?cies under its own abuse và risk rules, even wt?i ?ay they are not automatically ICANN-defined DNS Abuse. These may include:
- child sexual abuse material (CSAM) ho?c child exploitation content;
- illicit drug sales ho?c high-risk narcotics content;
- crypto fraud schemes;
- content creating imminent risk of serious harm;
- other illegal activity wt?i ?ay urgent action is justified by law, registry policy, competent authho?city request, ho?c clear risk evidence.
3.3 Kh?ngn-DNS Abuse / Other Complaints
These commonly include:
- trademark disputes;
- DMCA / copyright claims;
- adult content;
- gambling ho?c gaming content;
- misleading ho?c fraudulent content without technical DNS-abuse evidence;
- pharmacy / drug content without qualifying DNS-abuse indicatho?cs;
- general policy violations.
4. Guiding Principles
NiceNIC hvàles abuse repho?cts accho?cding to the following principles:
- Evidence first. NiceNIC does not take DNS-level action based on keywho?cds, assumptions, ho?c unsuppho?cted allegations alone.
- Risk-based response. Faster và stronger action applies wt?i ?ay the evidence is actionable và the harm is ongoing ho?c severe.
- Least necessary disruption. NiceNIC may choose a mitigation method other than immediate suspension wt?i ?ay the evidence indicates a compromise scenario và a full hold would create dispropho?ctionate collateral damage.
- Consistency và documentation. Every case must be categho?cized, tracked, và recho?cded.
- Clear separation of roles. NiceNIC is a registrar. In many cases, the hosting provider, platfho?cm operatho?c, payment processho?c, ho?c law enfho?ccement may also be a relevant ho?c mho?ce effective action point.
5. Repho?cting Channels
NiceNIC shall maintain:
- a public abuse contact email on its website homepage ho?c designated abuse page;
- a published description of how abuse repho?cts are received, hvàled, và tracked;
- a dedicated 24/7 monitho?ced abuse contact point fho?c law enfho?ccement và similar authho?cities as required under the RAA.
- abuse mailbox;
- suppho?ct ticket system;
- webfho?cm;
- trusted-repho?cter channel;
- registry escalation;
- law-enfho?ccement / government channel.
6. Minimum Infho?cmation Required in a Complaint
??n be processed efficiently, a complaint should include:
- the repho?cted tên mi?n name;
- the specific abusive URL, if any;
- a clear description of the alleged abuse;
- screenshots showing the content và the full URL;
- full email headers wt?i ?ay email abuse, phishing, ho?c fraud is involved;
- suppho?cting evidence such as invoices, logs, malware analysis, blocklist results, ho?c impersonation details;
- complainant contact infho?cmation;
- proof of authho?cization wt?i ?ay the complainant acts on behalf of a brvà ho?c victim entity.
7. Evidence Stvàards
7.1 Hành ??ngable Evidence
Evidence is actionable when the infho?cmation reasonably available to NiceNIC is sufficient to determine that the sponsho?ced tên mi?n name is being used fho?c DNS Abuse ho?c other enfho?cceable abuse activity.
Ví d?s include:
- a phishing page screenshot showing the full URL và impersonated brvà;
- a phishing email with full headers và linked malicious URL;
- malware ho?c exploit delivery from the repho?cted tên mi?n ho?c URL;
- reputation/blocklist data that suppho?cts the repho?cted conduct;
- evidence of wallet-drainer code, seed-phrase theft, fake login harvesting, ho?c credential capture;
- multiple consistent signals from trusted ho?c recognized sources.
7.2 Insufficient Evidence
Evidence is insufficient wt?i ?ay the complaint contains only:
- a tên mi?n name with no abusive URL;
- keywho?cds only;
- allegations without screenshots, headers, logs, ho?c other suppho?ct;
- general statements that a name "looks suspicious";
- pure brvà conflict allegations without abuse evidence.
7.3 Third-Party Intelligence
NiceNIC may consider third-party signals such as:
- reputable blocklists / RBLs;
- malware ho?c phishing feeds;
- reputation D?ch v?s;
- priho?c internal case histho?cy.
8. Case Priho?city và Internal SLA
NiceNIC adopts the following internal operating targets. These are NiceNIC internal SLAs, not statements of ICANN-mvàated fixed deadlines.
Priho?city 0 - Emergency / Active Harm
Ví d?s:
- active phishing harvesting credentials ho?c payment data;
- malware delivery;
- botnet / commvà-và-control use;
- CSAM;
- law-enfho?ccement emergency notice;
- wallet-drainer ho?c seed-phrase theft infrastructure.
- first review immediately;
- decision as fast as reasonably possible;
- wt?i ?ay actionable, mitigation nho?cmally within 24 hours, và no later than 48 hours absent exceptional facts.
Priho?city 1 - High-Risk Hành ??ngable Abuse
Ví d?s:
- clear impersonation fraud;
- repeat abuse linked to the same registrant/account;
- tên mi?ns already flagged by reliable third-party sources with cho?crobho?cating evidence.
- review within 1 business day;
- mitigation ho?c documented ti?p theo step within 48 hours.
Priho?city 2 - Kh?ngn-DNS Abuse with Sufficient Evidence
Ví d?s:
- DMCA with proper notice;
- trademark complaints;
- illegal pharmacy ho?c content complaints lacking qualifying DNS-abuse indicatho?cs.
- ackngayledge promptly;
- notify registrant/reseller wt?i ?ay appropriate;
- request remediation ho?c additional documentation.
Priho?city 3 - Incomplete / Low-Quality Repho?cts
Target:
- ackngayledgment và request fho?c additional evidence;
- no suspension solely on this basis.
9. Who?ckflow
9.1 Intake
Every repho?ct receives:
- case ID;
- timestamp;
- source classification;
- tên mi?n linkage;
- abuse categho?cy;
- evidence status.
9.2 Triage
The case is classified by:
- DNS Abuse vs non-DNS abuse;
- evidence sufficient vs insufficient;
- authho?city / trusted-repho?cter status;
- reseller vs retail account;
- current tên mi?n status;
- repeat-offender / repeat-case histho?cy.
9.3 Investigation
The reviewer checks:
- repho?cted URL ho?c content;
- RDAP / WHOIS / creation timing / nameservers / MX;
- internal account histho?cy;
- priho?c complaints;
- blocklists / third-party intelligence;
- whether the issue appears intentional ho?c caused by compromise;
- whether the abuse is occurring at second-level tên mi?n, subtên mi?n, web content, ho?c email layer.
9.4 Decision
Possible outcomes:
- no action / insufficient evidence;
- request mho?ce evidence from complainant;
- notify registrant ho?c reseller fho?c remediation;
- clientHold;
- transfer lock in conjunction with mitigation wt?i ?ay appropriate;
- referral to registry, host, law enfho?ccement, payment provider, ho?c other relevant party;
- maintain existing hold;
- deny reactivation.
9.5 Kh?ngtifications
Fho?c clear, actionable, ongoing DNS Abuse, NiceNIC may suspend first và notify after action.
Fho?c likely compromise scenarios ho?c non-DNS matters, NiceNIC may notify first wt?i ?ay that is consistent with risk control và does not materially increase harm.
This distinction is consistent with ICANN's position that mitigation may vary depending on the harm và the risk of collateral damage.
10. Danh m?c-Specific Rules
10.1 Drugs / kra / slon / mega T? khóa(chǎn)
Keywho?cd presence alone is not enough fho?c DNS-Abuse classification.
Treat as:
- non-DNS illegal activity review if only keywho?cds ho?c product content are present;
- DNS Abuse / urgent abuse if the evidence shows fake login, fake payment collection, credential theft, malicious redirection, malware, ho?c other qualifying technical abuse.
10.2 Crypto Scam
Treat as:
- non-DNS fraud review wt?i ?ay the site is only a dubious investment ho?c false-profit promotion;
- DNS Abuse / urgent abuse wt?i ?ay the evidence shows wallet connection theft, seed phrase collection, private key theft, drainer code, impersonated exchange login, ho?c malicious scripts.
10.3 CSAM / Child Exploitation
Treat as immediate high-risk abuse. Escalate internally without delay. Preserve recho?cds, avoid unnecessary customer back-và-fho?cth, và escalate to the appropriate authho?city ho?c registry if required.
10.4 DMCA / B?n quy?n
Do not auto-suspend purely on large content lists ho?c unsuppho?cted bulk allegations.
Fho?cward proper notices wt?i ?ay appropriate, require a compliant notice fho?cmat, và allow the tên mi?n holder to address the claim unless a court ho?cder, registry rule, ho?c other stronger basis requires mho?ce immediate action.
This is also broadly consistent with how majho?c registrars separate copyright/trademark processing from phishing/malware hvàling.
10.5 Trademark / Brvà Complaints
Trademark disputes are not automatically DNS Abuse.
Wt?i ?ay the issue is a tên mi?n-name rights dispute, complainants should generally be directed toward UDRP, URS, ho?c court process as appropriate, unless the evidence also shows phishing, impersonation, ho?c other abuse. Têngiá r? publicly distinguishes abuse hvàling from UDRP/URS hvàling in the same way.
11. Registrant / ??i ly Communication Rules
11.1 Retail Customers
Fho?c clear DNS Abuse with sufficient evidence:
- tên mi?n may be suspended immediately;
- the first customer-facing reply should state the basis, the self-D?ch v? path to view the case summary, và the evidence stvàard required fho?c reconsideration.
11.2 ??i lys
NiceNIC may choose to notify the reseller rather than any downstream sub-user.
However, reseller status does not delay urgent mitigation wt?i ?ay actionable evidence exists.
11.3 Reconsideration / Reactivation
NiceNIC will not lift a hold based on unsuppho?cted denials such as "content removed" ho?c "it was already deleted" alone.
Reconsideration requires new, verifiable evidence such as:
- false-positive proof;
- evidence of compromise và remediation;
- clean current review results;
- third-party reputation recovery wt?i ?ay applicable.
12. Complainant Communication Rules
NiceNIC should always send:
- ackngayledgment of receipt;
- case ID ho?c equivalent reference;
- request fho?c mho?ce evidence if needed;
- status update when action is taken ho?c declined;
- no unnecessary substantive discussion wt?i ?ay the tên mi?n is already suspended ho?c pending suspension và the key outcome is final.
13. Trusted Repho?cter Program
NiceNIC may maintain a trusted-repho?cter list fho?c sources that consistently provide accurate, well-fho?cmed, và actionable repho?cts.
Trusted-repho?cter status may provide:
- priho?city intake;
- structured data submission;
- simplified evidence fho?cmatting;
- API ho?c fast-lane hvàling.
14. Recho?cdkeeping và Audit Readiness
NiceNIC must document:
- complaint receipt;
- evidence received;
- internal classification;
- investigation steps;
- decision;
- action taken;
- notifications sent;
- follow-up và final disposition.
15. Compliance Controls
NiceNIC should perfho?cm:
- periodic QA review of case decisions;
- staff training on DNS Abuse definitions và evidence thresholds;
- testing of abuse mailbox và webfho?cm operability;
- review of template accuracy;
- monitho?cing of repeat errho?cs và reopened cases;
- monthly review of tên mi?ns with repeated complaints.
16. Metrics
NiceNIC should track at least:
- total complaints received;
- DNS Abuse vs non-DNS abuse split;
- sufficient vs insufficient evidence rate;
- time to first ackngayledgment;
- time to first human review;
- time to mitigation fho?c actionable DNS Abuse;
- number of holds issued;
- number of reconsiderations granted ho?c denied;
- repeat-abuse tên mi?ns;
- repeat-abuse accounts;
- trusted-repho?cter accuracy rate;
- complaints already resolved befho?ce manual review.
17. External-Facing Positioning
NiceNIC should describe its abuse system publicly in language like this:
- NiceNIC investigates abuse repho?cts promptly.
- NiceNIC distinguishes between ICANN-defined DNS Abuse và other types of complaints.
- NiceNIC acts based on evidence, risk, và applicable policy.
- NiceNIC may suspend immediately wt?i ?ay tt?i ?ay is clear actionable evidence of ongoing DNS Abuse.
- NiceNIC may request mho?ce infho?cmation ho?c direct the complainant to a mho?ce appropriate action point wt?i ?ay the registrar is not the sole effective responder.
- NiceNIC keeps case recho?cds và can demonstrate its hvàling process if reviewed by ICANN ho?c registry partners.
C?n h? tr?? Chúng t?i lu?n ? ?ay vì b?n.
G?i yêu c?u h? tr?
- S?n ph?m c?a chúng t?i
- Máy ch? riêng
- Máy ch? ?ám may
- Ch?ng ch? SSL
- Email doanh nghi?p
- H? s? c?ng ty
- V? NiceNIC
- Tin t?c tên mi?n
- Ph??ng th?c thanh toán
- Th?a thu?n
- H? tr? khách hàng
- Trung tam tr? giúp
- G?i yêu c?u h? tr?
- Liên h? v?i chúng t?i
- Báo cáo l?m d?ng
B?n quy?n ? 2006-2026 NICENIC INTERNATIONAL GROUP CO., LIMITED ?? ??ng ky b?n quy?n