ICANN Contractual Compliance’s enforcement of DNS Abuse requirements for April 2024

DNS Abuse Complaints Received Against Registrars

Monthly Average of Complaints Received by DNS Abuse Type

One single complaint can refer to one or multiple domain names and report multiple types of DNS Abuse associated with the reported domain name(s). Therefore, the sum of the DNS Abuse types in these reports will not equal the total of individual DNS Abuse complaints received within the month, or the total of reported domain names used for DNS Abuse.

This includes all complaints received where the complainants selected one or more DNS Abuse type(s) in the Contractual Compliance webform. These do not equal the number of complaints received with validated and actionable allegations of DNS Abuse. Details about actionable complaints are in the relevant reports below.

Due to rounding, percentages may not always appear to add up to 100%.

Monthly Trend of Complaints Received by DNS Abuse Type

Monthly Detail of Complaints Received by DNS Abuse Type

DNS Abuse Type APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RAA: Phishing608608
DNS Abuse RAA: Malware354354
DNS Abuse RAA: Botnets324324
DNS Abuse RAA: Pharming360360
DNS Abuse RAA: Spam (vector)465465
Total2,1112,111

DNS Abuse RAA: Phishing

DNS Abuse RAA: Botnets

DNS Abuse RAA: Spam (vector)

DNS Abuse RAA: Malware

DNS Abuse RAA: Pharming

Number of Compliance Notifications Sent to Registrars Under DNS Abuse Requirements by DNS Abuse Type

DNS Abuse Type APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RAA: Phishing
1st Inquiry/Notice1818.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice11.0
Breach Notice--
Suspension Notice--
Termination Notice--
DNS Abuse RAA: Malware
1st Inquiry/Notice22.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Suspension Notice--
Termination Notice--
DNS Abuse RAA: Botnets
1st Inquiry/Notice11.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Suspension Notice--
Termination Notice--
DNS Abuse RAA: Pharming
1st Inquiry/Notice22.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Suspension Notice--
Termination Notice--
DNS Abuse RAA: Spam (vector)
1st Inquiry/Notice77.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice11.0
Breach Notice--
Suspension Notice--
Termination Notice--

One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual DNS Abuse notifications sent within the month. One single complaint can also report one or multiple domain names used for DNS Abuse.

Number of Compliance Notifications Sent to Registrars under 3.18.3 of the RAA
Complaints were submitted by Law Enforcement Agencies (LEA) or other authorities within the Registrar’s jurisdiction

DNS Abuse Type APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
Abuse Report RAA provision: under 3.18.3 RAA
1st Inquiry/Notice--
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Suspension Notice--
Termination Notice--

Monthly Detail of Reasons for Resolving Cases with Registrars by DNS Abuse Type

DNS Abuse RAA: Phishing Average Closed Per Month

DNS Abuse RAA: Malware Average Closed Per Month

DNS Abuse RAA: Botnets Average Closed Per Month

DNS Abuse RAA: Pharming Average Closed Per Month

DNS Abuse RAA: Spam (vector) Average Closed Per Month

Reasons why cases were resolved - action taken by the registrar or reasons why no action was taken APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RAA: Phishing
The registrar suspended or deactivated the domain name. This is a reasonable response to an abuse report.33.0
The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse.22.0
The domain is suspended and suspension is a reasonable response to the abuse report.11.0
DNS Abuse RAA: Phishing Total66.0
DNS Abuse RAA: Malware
--
DNS Abuse RAA: Malware Total--
DNS Abuse RAA: Botnets
--
DNS Abuse RAA: Botnets Total--
DNS Abuse RAA: Pharming
The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse.11.0
The registrar suspended or deactivated the domain name. This is a reasonable response to an abuse report.11.0
DNS Abuse RAA: Pharming Total22.0
DNS Abuse RAA: Spam (Vector)
The registrar suspended or deactivated the domain name. This is a reasonable response to an abuse report.11.0
The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse.11.0
DNS Abuse RAA: Spam (Vector) Total22.0
Grand Total1010.0

Monthly Detail of Reasons for Resolving Cases with Registrars by DNS Abuse Type
Complaints were submitted by Law Enforcement Agencies (LEA) or other authorities within the Registrar’s jurisdiction

DNS Abuse Type / Resolved Code APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
Abuse Report RAA provision: under 3.18.3 RAA
-
Abuse Report RAA provision: under 3.18.3 RAA Total-

DNS Abuse cases resolved with registrars involving maliciously registered vs. compromised domains

APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RAA: Maliciously Registered Domain33
DNS Abuse RAA: Compromised Domain11
Grand Total44

Invalid or Unactionable Complaints Received Against Registrars by DNS Abuse Type

Reason why complaint was deemed invalid APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RAA: Phishing
The complaint is out of scope because it is a duplicate of an open complaint.286286
The complaint is out of scope because it is regarding a country-code top-level domain.4343
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.2727
The complaint is out of scope because the complainant did not provide the requested information.1313
The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse.1111
The domain is suspended and suspension is a reasonable response to the abuse report.66
The complaint is out of scope because the domain is not registered.22
The complaint is out of scope because it is a duplicate of a closed complaint.11
The registrar demonstrated having reasonably and promptly investigated and appropriately responded to an abuse report.11
DNS Abuse RAA: Phishing Total390390
DNS Abuse RAA: Malware
The complaint is out of scope because it is a duplicate of an open complaint.286286
The complaint is out of scope because it is regarding a country-code top-level domain.1717
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.1616
The complaint is out of scope because the complainant did not provide the requested information.55
The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse.44
The domain is suspended and suspension is a reasonable response to the abuse report.11
DNS Abuse RAA: Malware Total329329
DNS Abuse RAA: Botnets
The complaint is out of scope because it is a duplicate of an open complaint.286286
The complaint is out of scope because it is regarding a country-code top-level domain.1818
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.1010
The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse.22
The domain is suspended and suspension is a reasonable response to the abuse report.11
The complaint is out of scope because the complainant did not provide the requested information.11
DNS Abuse RAA: Botnets Total318318
DNS Abuse RAA: Pharming
The complaint is out of scope because it is a duplicate of an open complaint.286286
The complaint is out of scope because it is regarding a country-code top-level domain.2626
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.1212
The complaint is out of scope because the complainant did not provide the requested information.44
The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse.11
DNS Abuse RAA: Pharming Total329329
DNS Abuse RAA: Spam (Vector)
The complaint is out of scope because it is a duplicate of an open complaint.286286
The complaint is out of scope because it is regarding a country-code top-level domain.3333
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.1616
The complaint is out of scope because the complainant did not provide the requested information.99
The domain is suspended and suspension is a reasonable response to the abuse report.55
The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse.44
The complaint is out of scope because the domain is not registered.22
DNS Abuse RAA: Spam (Vector) Total355355
Grand Total1,7211,721

One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual unactionable DNS Abuse complaints closed within the month.

DNS Abuse Complaints Received Against Registry Operators

Monthly Average of Complaints Received by DNS Abuse Type

One single complaint can refer to one or multiple domain names and report multiple types of DNS Abuse associated with the reported domain name(s). Therefore, the sum of the DNS Abuse types in these reports will not equal the total of individual DNS Abuse complaints received within the month, or the total of reported domain names used for DNS Abuse.

This includes all complaints received where the complainants selected one or more DNS Abuse type(s) in the Contractual Compliance webform. These do not equal the number of complaints received with validated and actionable allegations of DNS Abuse. Details about actionable complaints are in the relevant reports below.

Due to rounding, percentages may not always appear to add up to 100%.

Monthly Trend of Complaints Received by DNS Abuse Type

Monthly Detail of Complaints Received by DNS Abuse Type

DNS Abuse Type APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RA: Phishing1616
DNS Abuse RA: Malware77
DNS Abuse RA: Botnets33
DNS Abuse RA: Pharming77
DNS Abuse RA: Spam (vector)99
Total4242

DNS Abuse RA: Phishing

DNS Abuse RA: Botnets

DNS Abuse RA: Spam (vector)

DNS Abuse RA: Malware

DNS Abuse RA: Pharming

Number of Compliance Notifications Sent to Registry Operators Under DNS Abuse Requirements by DNS Abuse Type

DNS Abuse Type APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RA: Phishing
1st Inquiry/Notice22.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Termination Notice--
DNS Abuse RA: Malware
1st Inquiry/Notice11.0
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Termination Notice--
DNS Abuse RA: Botnets
1st Inquiry/Notice--
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Termination Notice--
DNS Abuse RA: Pharming
1st Inquiry/Notice--
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Termination Notice--
DNS Abuse RA: Spam (vector)
1st Inquiry/Notice--
2nd Inquiry/Notice--
3rd Inquiry/Notice--
Escalated Notice--
Breach Notice--
Termination Notice--

One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual DNS Abuse notifications sent within the month. One single complaint can also report one or multiple domain names used for DNS Abuse.

Monthly Detail of Reasons for Resolving Cases with Registry Operators by DNS Abuse Type

DNS Abuse RA: Phishing Average Closed Per Month

DNS Abuse RA: Malware Average Closed Per Month

DNS Abuse RA: Botnets Average Closed Per Month

DNS Abuse RA: Pharming Average Closed Per Month

DNS Abuse RA: Spam (vector) Average Closed Per Month

Reasons why cases were resolved - action taken by the registry or reasons why no action was taken APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RA: Phishing
--
DNS Abuse RA: Phishing Total--
DNS Abuse RA: Malware
--
DNS Abuse RA: Malware Total--
DNS Abuse RA: Botnets
--
DNS Abuse RA: Botnets Total--
DNS Abuse RA: Pharming
--
DNS Abuse RA: Pharming Total--
DNS Abuse RA: Spam (Vector)
--
DNS Abuse RA: Spam (Vector) Total--
Grand Total--

DNS Abuse cases resolved with registry operators involving maliciously registered vs. compromised domains

APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RAA: Maliciously Registered Domain--
DNS Abuse RAA: Compromised Domain--
Grand Total--

Invalid or Unactionable Complaints Received Against Registry Operators by DNS Abuse Type

Reason why complaint was deemed invalid APR 2024 MAY 2024 JUN 2024 JUL 2024 AUG 2024 SEP 2024 OCT 2024 NOV 2024 DEC 2024 JAN 2025 FEB 2025 MAR 2025 Average
DNS Abuse RA: Phishing
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.44
The complaint is out of scope because it is a duplicate of an open complaint.44
DNS Abuse RA: Phishing Total88
DNS Abuse RA: Malware
The complaint is out of scope because it is a duplicate of an open complaint.33
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.11
The complaint is out of scope because the complainant did not provide the requested information.11
DNS Abuse RA: Malware Total55
DNS Abuse RA: Botnets
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.11
The complaint is out of scope because the complainant did not provide the requested information.11
The complaint is out of scope because it is a duplicate of an open complaint.11
DNS Abuse RA: Botnets Total33
DNS Abuse RA: Pharming
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.22
The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse.11
The complaint is out of scope because it is a duplicate of an open complaint.11
DNS Abuse RA: Pharming Total44
DNS Abuse RA: Spam (Vector)
The complaint is out of scope because it is a duplicate of an open complaint.22
The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry.22
The complaint is out of scope because the complainant did not provide the requested information.11
The complaint is out of scope because customer service issues are outside of ICANN's contractual authority.11
The complaint is out of scope because ICANN is not a registrar.11
DNS Abuse RA: Spam (Vector) Total77
Grand Total2727

One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual unactionable DNS Abuse complaints closed within the month.