ICANN Contractual Compliance’s enforcement of DNS Abuse requirements for September 2026
DNS Abuse Complaints Received Against Registrars
Monthly Average of Complaints Received by DNS Abuse Type
One single complaint can refer to one or multiple domain names and report multiple types of DNS Abuse associated with the reported domain name(s). Therefore, the sum of the DNS Abuse types in these reports will not equal the total of individual DNS Abuse complaints received within the month, or the total of reported domain names used for DNS Abuse.
This includes all complaints received where the complainants selected one or more DNS Abuse type(s) in the Contractual Compliance webform. These do not equal the number of complaints received with validated and actionable allegations of DNS Abuse. Details about actionable complaints are in the relevant reports below.
Due to rounding, percentages may not always appear to add up to 100%.
Monthly Trend of Complaints Received by DNS Abuse Type
Monthly Detail of Complaints Received by DNS Abuse Type
| DNS Abuse Type | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RAA: Phishing | 837 | 634 | 855 | 337 | 555 | 1,189 | 3,988 | 658 | 709 | 503 | 454 | 513 | 936 |
| DNS Abuse RAA: Malware | 64 | 73 | 65 | 60 | 63 | 80 | 68 | 83 | 309 | 129 | 139 | 120 | 104 |
| DNS Abuse RAA: Botnets | 19 | 23 | 26 | 30 | 17 | 29 | 23 | 26 | 144 | 69 | 77 | 61 | 45 |
| DNS Abuse RAA: Pharming | 37 | 37 | 52 | 21 | 40 | 49 | 36 | 46 | 167 | 106 | 85 | 52 | 61 |
| DNS Abuse RAA: Spam (vector) | 105 | 99 | 106 | 85 | 85 | 177 | 116 | 98 | 361 | 166 | 171 | 159 | 144 |
| Total | 1,062 | 866 | 1,104 | 533 | 760 | 1,524 | 4,231 | 911 | 1,690 | 973 | 926 | 905 | 1,290 |
DNS Abuse RAA: Phishing
DNS Abuse RAA: Botnets
DNS Abuse RAA: Spam (vector)
DNS Abuse RAA: Malware
DNS Abuse RAA: Pharming
Number of Compliance Notifications Sent to Registrars Under DNS Abuse Requirements by DNS Abuse Type
| DNS Abuse Type | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RAA: Phishing | |||||||||||||
| 1st Inquiry/Notice | 25 | 8 | 11 | 16 | 13 | 17 | 30 | 22 | 24 | 26 | 37 | 39 | 22.3 |
| 2nd Inquiry/Notice | 4 | 1 | 2 | 1 | 4 | 7 | 6 | 5 | 10 | 15 | 5 | 17 | 6.4 |
| 3rd Inquiry/Notice | - | - | - | - | - | 1 | - | - | - | 2 | - | 3 | 0.5 |
| Escalated Notice | 3 | 2 | - | 2 | - | - | 4 | 3 | 2 | 4 | 4 | - | 2.0 |
| Breach Notice | - | - | - | - | - | - | - | - | 1 | 1 | 1 | - | 0.3 |
| Suspension Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RAA: Malware | |||||||||||||
| 1st Inquiry/Notice | 1 | 1 | - | 3 | 1 | 3 | 3 | 3 | 3 | 1 | 5 | 5 | 2.4 |
| 2nd Inquiry/Notice | - | - | - | - | - | 1 | - | - | 2 | 2 | 1 | - | 0.5 |
| 3rd Inquiry/Notice | - | - | - | - | - | 1 | - | - | - | 1 | - | - | 0.2 |
| Escalated Notice | - | - | - | - | 1 | - | 1 | 1 | 1 | 2 | 1 | - | 0.6 |
| Breach Notice | - | - | - | - | - | - | - | - | 1 | 1 | - | - | 0.2 |
| Suspension Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| DNS Abuse RAA: Botnets | |||||||||||||
| 1st Inquiry/Notice | 1 | - | - | 3 | - | - | - | - | - | - | 1 | - | 0.4 |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | 1 | - | - | - | - | - | 0.1 |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Suspension Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RAA: Pharming | |||||||||||||
| 1st Inquiry/Notice | 1 | - | - | 1 | 1 | 1 | - | - | 2 | 1 | - | 2 | 0.8 |
| 2nd Inquiry/Notice | 1 | - | - | - | - | 1 | 1 | - | - | 3 | - | - | 0.5 |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Suspension Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RAA: Spam (vector) | |||||||||||||
| 1st Inquiry/Notice | 3 | 1 | 1 | 1 | 1 | 1 | 3 | - | 1 | - | 6 | 1 | 1.6 |
| 2nd Inquiry/Notice | - | - | - | - | - | - | 1 | - | 1 | - | 1 | 1 | 0.3 |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | 1 | - | 1 | 1 | - | 0.3 |
| Breach Notice | - | - | - | - | - | - | - | - | 1 | - | - | - | 0.1 |
| Suspension Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual DNS Abuse notifications sent within the month. One single complaint can also report one or multiple domain names used for DNS Abuse.
Number of Compliance Notifications Sent to Registrars under 3.18.3 of the RAA
Complaints were submitted by Law Enforcement Agencies (LEA) or other authorities within the Registrar’s jurisdiction
| DNS Abuse Type | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Abuse Report RAA provision: under 3.18.3 RAA | |||||||||||||
| 1st Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Suspension Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
Monthly Detail of Reasons for Resolving Cases with Registrars by DNS Abuse Type
DNS Abuse RAA: Phishing Average Closed Per Month
DNS Abuse RAA: Malware Average Closed Per Month
DNS Abuse RAA: Botnets Average Closed Per Month
DNS Abuse RAA: Pharming Average Closed Per Month
DNS Abuse RAA: Spam (vector) Average Closed Per Month
| Reasons why cases were resolved - action taken by the registrar or reasons why no action was taken | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RAA: Phishing | |||||||||||||
| The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse. | 6 | 6 | 9 | 11 | 11 | 10 | 15 | 23 | 10 | 22 | 24 | 29 | 14.7 |
| The registrar does not have actionable evidence to determine the domain name is being used for DNS Abuse. | 7 | 4 | 3 | 6 | 1 | 8 | 7 | - | 1 | 2 | 3 | 6 | 4.0 |
| The registrar requested the registrant and/or reseller to act on an abusive activity. The registrant and/or reseller then took action that resulted in the abusive activity being stopped. The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | 2 | 1 | - | - | - | - | 1 | 1 | - | - | 2 | 2 | 0.8 |
| The complaint is out of scope because ICANN terminated the registrar's accreditation. | - | - | - | - | - | - | - | - | - | - | 3 | 1 | 0.3 |
| The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | 2 | - | - | - | - | - | - | 1 | - | - | - | - | 0.3 |
| The registrar took appropriate mitigation action, other than suspension, to stop the use of the domain name for DNS Abuse. | - | - | 1 | - | - | - | 2 | - | - | - | - | - | 0.3 |
| The registrar requested the registrant and/or reseller to act on an abusive activity. This is an appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | 1 | - | - | - | - | - | 1 | - | - | - | - | - | 0.2 |
| The registrar corrected its noncompliance. | - | - | - | - | - | - | 1 | - | - | - | - | - | 0.1 |
| The registrar demonstrated compliance. | 1 | - | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The registrar demonstrated having reasonably and promptly investigated and appropriately responded to an abuse report. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The registrar published the required abuse contact. This contact provides a confirmation receipt to any party submitting an abuse report. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| DNS Abuse RAA: Phishing Total | 19 | 13 | 13 | 17 | 12 | 18 | 27 | 25 | 11 | 24 | 32 | 38 | 20.8 |
| DNS Abuse RAA: Malware | |||||||||||||
| The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse. | - | - | 1 | 1 | 1 | 1 | 1 | 3 | - | 2 | 2 | 2 | 1.2 |
| The registrar does not have actionable evidence to determine the domain name is being used for DNS Abuse. | 1 | - | - | - | - | 1 | 2 | - | - | - | - | 1 | 0.4 |
| The complaint is out of scope because ICANN terminated the registrar's accreditation. | - | - | - | - | - | - | - | - | - | - | 1 | 1 | 0.2 |
| The registrar demonstrated having reasonably and promptly investigated and appropriately responded to an abuse report. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | - | - | - | - | - | 1 | - | - | - | - | - | - | 0.1 |
| The registrar requested the registrant and/or reseller to act on an abusive activity. The registrant and/or reseller then took action that resulted in the abusive activity being stopped. The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | - | - | - | - | - | 1 | - | - | - | - | - | - | 0.1 |
| DNS Abuse RAA: Malware Total | 1 | 1 | 1 | 1 | 1 | 4 | 3 | 3 | - | 2 | 3 | 4 | 2.0 |
| DNS Abuse RAA: Botnets | |||||||||||||
| The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse. | 1 | - | - | - | - | 1 | - | - | - | - | - | - | 0.2 |
| The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | - | - | - | - | - | 1 | - | - | - | - | - | - | 0.1 |
| The complaint is out of scope because ICANN terminated the registrar's accreditation. | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| The registrar does not have actionable evidence to determine the domain name is being used for DNS Abuse. | - | - | - | - | - | 1 | - | - | - | - | - | - | 0.1 |
| DNS Abuse RAA: Botnets Total | 1 | - | - | - | - | 3 | - | - | - | - | 1 | - | 0.4 |
| DNS Abuse RAA: Pharming | |||||||||||||
| The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse. | - | - | - | - | - | 1 | - | - | - | - | 2 | 2 | 0.4 |
| The registrar does not have actionable evidence to determine the domain name is being used for DNS Abuse. | - | - | - | - | 1 | - | - | - | - | - | - | 1 | 0.2 |
| The registrar requested the registrant and/or reseller to act on an abusive activity. The registrant and/or reseller then took action that resulted in the abusive activity being stopped. The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | - | - | - | - | - | - | 1 | - | - | - | - | - | 0.1 |
| DNS Abuse RAA: Pharming Total | - | - | - | - | 1 | 1 | 1 | - | - | - | 2 | 3 | 0.7 |
| DNS Abuse RAA: Spam (Vector) | |||||||||||||
| The registrar suspended/deactivated the domain name. This is an appropriate mitigation action to stop the use of the domain name for DNS Abuse. | 1 | - | 1 | 2 | - | - | 1 | 1 | - | - | 1 | 1 | 0.7 |
| The registrar requested the registrant and/or reseller to act on an abusive activity. The registrant and/or reseller then took action that resulted in the abusive activity being stopped. The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | - | - | - | - | - | - | 1 | - | - | - | 2 | - | 0.3 |
| The registrar does not have actionable evidence to determine the domain name is being used for DNS Abuse. | - | 1 | - | - | - | - | 1 | - | - | - | - | - | 0.2 |
| The registrar took appropriate mitigation action to disrupt the use of the domain name for DNS Abuse. | - | - | - | - | - | - | - | 1 | - | - | - | - | 0.1 |
| The complaint is out of scope because ICANN terminated the registrar's accreditation. | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| DNS Abuse RAA: Spam (Vector) Total | 1 | 1 | 1 | 2 | - | - | 3 | 2 | - | - | 4 | 1 | 1.3 |
| Grand Total | 22 | 15 | 15 | 20 | 14 | 26 | 34 | 30 | 11 | 26 | 42 | 46 | 25.1 |
Monthly Detail of Reasons for Resolving Cases with Registrars by DNS Abuse Type
Complaints were submitted by Law Enforcement Agencies (LEA) or other authorities within the Registrar’s jurisdiction
| DNS Abuse Type / Resolved Code | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Abuse Report RAA provision: under 3.18.3 RAA | |||||||||||||
| - | - | - | - | - | - | - | - | - | - | - | - | - | |
| Abuse Report RAA provision: under 3.18.3 RAA Total | - | - | - | - | - | - | - | - | - | - | - | - | - |
DNS Abuse cases resolved with registrars involving maliciously registered vs. compromised domains
| OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RAA: Maliciously Registered Domain | 9 | 5 | 10 | 11 | 12 | 12 | 18 | 23 | 10 | 22 | 29 | 35 | 16.3 |
| DNS Abuse RAA: Compromised Domain | 2 | 1 | - | - | - | 2 | 1 | 2 | - | 1 | 2 | - | 0.9 |
| Grand Total | 11 | 6 | 10 | 11 | 12 | 14 | 19 | 25 | 10 | 23 | 31 | 35 | 17.3 |
Invalid or Unactionable Complaints Received Against Registrars by DNS Abuse Type
| Reason why complaint was deemed invalid | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RAA: Phishing | |||||||||||||
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 119 | 30 | 177 | 195 | 102 | 150 | 67 | 2,853 | 45 | 75 | 46 | 67 | 327.2 |
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 195 | 145 | 115 | 154 | 280 | 268 | 113 | 2,110 | 46 | 55 | 44 | 44 | 297.4 |
| The complaint is out of scope because the complainant did not provide the requested information. | 58 | 40 | 33 | 36 | 51 | 38 | 34 | 44 | 38 | 56 | 44 | 33 | 42.1 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | 21 | 34 | 46 | 17 | 27 | 72 | 44 | 19 | 71 | 23 | 28 | 26 | 35.7 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | 3 | 2 | 4 | 1 | 10 | 4 | 3 | 4 | 9 | 7 | 2 | 12 | 5.1 |
| The complaint is out of scope because it is a duplicate of an open complaint. | 9 | 2 | 2 | 3 | 6 | 3 | 12 | 3 | 4 | 4 | 4 | 6 | 4.8 |
| The complaint is out of scope because the domain is not registered. | 1 | - | - | - | - | 4 | - | 1 | - | 4 | 2 | 2 | 1.2 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | 1 | 1 | - | - | - | - | 1 | - | - | - | 0.3 |
| The complaint is out of scope because ICANN does not process complaints regarding website content. | 1 | - | - | - | - | 1 | - | - | - | - | - | - | 0.2 |
| The required abuse contact is displayed on the contracted party’s website and/or other designated place. | 1 | - | - | - | - | - | - | - | - | 1 | - | - | 0.2 |
| The complaint is out of scope because it is incomplete or broad. | 1 | - | - | - | - | - | - | - | 1 | - | - | - | 0.2 |
| DNS Abuse RAA: Phishing Total | 409 | 253 | 378 | 407 | 476 | 540 | 273 | 5,034 | 215 | 225 | 170 | 190 | 714.2 |
| DNS Abuse RAA: Malware | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 54 | 13 | 11 | 10 | 15 | 21 | 11 | 16 | 13 | 16 | 13 | 13 | 17.2 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | 7 | 11 | 15 | 4 | 5 | 29 | 7 | 5 | 40 | 9 | 12 | 16 | 13.3 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 11 | - | 4 | 5 | 8 | 11 | 6 | 3 | 5 | 6 | 8 | 12 | 6.6 |
| The complaint is out of scope because the complainant did not provide the requested information. | 6 | 4 | 4 | 9 | 6 | 7 | 4 | 6 | 6 | 10 | 9 | 5 | 6.3 |
| The complaint is out of scope because it is a duplicate of an open complaint. | 1 | 2 | - | - | 1 | 3 | 2 | 4 | - | 1 | 1 | - | 1.3 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | 1 | - | 1 | - | 1 | 2 | - | 1 | 2 | 1 | 1 | 1 | 0.9 |
| The complaint is out of scope because ICANN does not process complaints regarding website content. | - | - | - | - | - | 1 | - | - | - | 1 | - | - | 0.2 |
| The complaint is out of scope because it is incomplete or broad. | 1 | - | - | - | - | - | - | - | 1 | - | - | - | 0.2 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | 1 | - | - | - | - | - | - | - | - | - | 0.1 |
| The complaint is out of scope because the domain is not registered. | - | - | - | - | - | 1 | - | - | - | - | - | - | 0.1 |
| DNS Abuse RAA: Malware Total | 81 | 30 | 36 | 28 | 36 | 75 | 30 | 35 | 67 | 44 | 44 | 47 | 46.1 |
| DNS Abuse RAA: Botnets | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 17 | 3 | 4 | 5 | 7 | 2 | 6 | 5 | 7 | 6 | 7 | 4 | 6.1 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | 1 | 4 | 10 | 2 | - | 15 | 1 | 2 | 9 | 6 | 7 | 14 | 5.9 |
| The complaint is out of scope because the complainant did not provide the requested information. | 2 | - | 2 | 4 | 1 | 3 | - | 2 | 4 | 2 | 3 | 2 | 2.1 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 4 | - | - | 3 | - | 1 | - | - | 2 | 1 | 2 | 4 | 1.4 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | - | - | - | - | 1 | 2 | - | - | 2 | 1 | - | 1 | 0.6 |
| The complaint is out of scope because it is a duplicate of an open complaint. | - | - | - | - | 1 | 1 | 1 | 2 | 1 | - | - | - | 0.5 |
| The complaint is out of scope because it is incomplete or broad. | - | - | - | - | - | - | - | - | 1 | - | - | - | 0.1 |
| DNS Abuse RAA: Botnets Total | 24 | 7 | 16 | 14 | 10 | 24 | 8 | 11 | 26 | 16 | 19 | 25 | 16.7 |
| DNS Abuse RAA: Pharming | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 18 | 6 | 8 | 5 | 10 | 27 | 6 | 9 | 5 | 9 | 8 | 6 | 9.8 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | 5 | 3 | 11 | 3 | 5 | 16 | 3 | 2 | 8 | 10 | 6 | 3 | 6.3 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 8 | - | 1 | 4 | 3 | 11 | 3 | 2 | 3 | - | 3 | 6 | 3.7 |
| The complaint is out of scope because the complainant did not provide the requested information. | 6 | 5 | 3 | 2 | 3 | - | 2 | 1 | 2 | 5 | 3 | 4 | 3.0 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | - | 1 | 1 | - | - | 2 | - | - | 1 | 1 | - | 1 | 0.6 |
| The complaint is out of scope because it is a duplicate of an open complaint. | - | 2 | - | - | - | - | 1 | - | - | - | 1 | - | 0.3 |
| The complaint is out of scope because the domain is not registered. | - | - | - | - | - | - | - | - | - | - | - | 1 | 0.1 |
| The complaint is out of scope because it is incomplete or broad. | - | - | - | - | - | - | - | - | 1 | - | - | - | 0.1 |
| DNS Abuse RAA: Pharming Total | 37 | 17 | 24 | 14 | 21 | 56 | 15 | 14 | 20 | 25 | 21 | 21 | 23.8 |
| DNS Abuse RAA: Spam (Vector) | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 74 | 18 | 23 | 17 | 25 | 33 | 11 | 12 | 21 | 22 | 17 | 15 | 24.0 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | 7 | 10 | 21 | 6 | 8 | 28 | 6 | 9 | 46 | 9 | 14 | 13 | 14.8 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 22 | 4 | 6 | 10 | 17 | 21 | 10 | 5 | 11 | 11 | 11 | 13 | 11.8 |
| The complaint is out of scope because the complainant did not provide the requested information. | 17 | 8 | 4 | 12 | 10 | 8 | 3 | 9 | 11 | 7 | 12 | 15 | 9.7 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | 2 | 1 | - | 3 | 6 | 3 | - | 1 | 2 | 1 | 2 | 2 | 1.9 |
| The complaint is out of scope because it is a duplicate of an open complaint. | 1 | 2 | - | 1 | - | 2 | - | 3 | 1 | 1 | 3 | 5 | 1.6 |
| The complaint is out of scope because the domain is not registered. | 1 | - | - | - | - | 1 | - | - | - | - | 1 | - | 0.3 |
| The complaint is out of scope because it is incomplete or broad. | - | - | - | - | - | - | - | - | 1 | - | - | - | 0.1 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | 1 | - | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The complaint is out of scope because ICANN does not process complaints regarding website content. | - | - | - | 1 | - | - | - | - | - | - | - | - | 0.1 |
| DNS Abuse RAA: Spam (Vector) Total | 125 | 43 | 54 | 50 | 66 | 96 | 30 | 39 | 93 | 51 | 60 | 63 | 64.2 |
| Grand Total | 676 | 350 | 508 | 513 | 609 | 791 | 356 | 5,133 | 421 | 361 | 314 | 346 | 864.8 |
One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual unactionable DNS Abuse complaints closed within the month.
DNS Abuse Complaints Received Against Registry Operators
Monthly Average of Complaints Received by DNS Abuse Type
One single complaint can refer to one or multiple domain names and report multiple types of DNS Abuse associated with the reported domain name(s). Therefore, the sum of the DNS Abuse types in these reports will not equal the total of individual DNS Abuse complaints received within the month, or the total of reported domain names used for DNS Abuse.
This includes all complaints received where the complainants selected one or more DNS Abuse type(s) in the Contractual Compliance webform. These do not equal the number of complaints received with validated and actionable allegations of DNS Abuse. Details about actionable complaints are in the relevant reports below.
Due to rounding, percentages may not always appear to add up to 100%.
Monthly Trend of Complaints Received by DNS Abuse Type
Monthly Detail of Complaints Received by DNS Abuse Type
| DNS Abuse Type | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RA: Phishing | 18 | 30 | 33 | 23 | 17 | 45 | 37 | 32 | 28 | 277 | 35 | 26 | 50 |
| DNS Abuse RA: Malware | 2 | 11 | 15 | 12 | 2 | 18 | 13 | 14 | 20 | 250 | 25 | 9 | 33 |
| DNS Abuse RA: Botnets | - | 4 | 7 | 5 | - | 12 | 5 | 2 | 9 | 242 | 21 | 2 | 26 |
| DNS Abuse RA: Pharming | 2 | 7 | 10 | 7 | 5 | 16 | 10 | 4 | 9 | 247 | 22 | 2 | 28 |
| DNS Abuse RA: Spam (vector) | 9 | 15 | 16 | 16 | 11 | 25 | 23 | 16 | 20 | 261 | 25 | 5 | 37 |
| Total | 31 | 67 | 81 | 63 | 35 | 116 | 88 | 68 | 86 | 1,277 | 128 | 44 | 174 |
DNS Abuse RA: Phishing
DNS Abuse RA: Botnets
DNS Abuse RA: Spam (vector)
DNS Abuse RA: Malware
DNS Abuse RA: Pharming
Number of Compliance Notifications Sent to Registry Operators Under DNS Abuse Requirements by DNS Abuse Type
| DNS Abuse Type | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RA: Phishing | |||||||||||||
| 1st Inquiry/Notice | 2 | 1 | - | - | - | - | - | 1 | - | 1 | 1 | - | 0.5 |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RA: Malware | |||||||||||||
| 1st Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RA: Botnets | |||||||||||||
| 1st Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RA: Pharming | |||||||||||||
| 1st Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| DNS Abuse RA: Spam (vector) | |||||||||||||
| 1st Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 2nd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| 3rd Inquiry/Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Escalated Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Breach Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Termination Notice | - | - | - | - | - | - | - | - | - | - | - | - | - |
One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual DNS Abuse notifications sent within the month. One single complaint can also report one or multiple domain names used for DNS Abuse.
Monthly Detail of Reasons for Resolving Cases with Registry Operators by DNS Abuse Type
DNS Abuse RA: Phishing Average Closed Per Month
DNS Abuse RA: Malware Average Closed Per Month
DNS Abuse RA: Botnets Average Closed Per Month
DNS Abuse RA: Pharming Average Closed Per Month
DNS Abuse RA: Spam (vector) Average Closed Per Month
| Reasons why cases were resolved - action taken by the registry or reasons why no action was taken | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RA: Phishing | |||||||||||||
| The registry suspended/deactivated the domain name. This is an appropriate mitigation action to contribute to stopping the use of the domain name for DNS Abuse. | 1 | - | - | - | - | - | - | - | - | - | 2 | - | 0.3 |
| The registry published the required abuse contact. This contact provides a confirmation receipt to any party submitting an abuse report. | - | 2 | - | - | - | - | - | - | 1 | - | - | - | 0.3 |
| The registry referred the domain and evidence to the sponsoring registrar. This is an appropriate mitigation action to contribute to disrupting the use of the domain name for DNS Abuse. | 1 | - | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The registry referred the domain and evidence to the sponsoring registrar. The registrar then took action that resulted in the abusive activity being stopped. The registry took appropriate mitigation action to contribute to disrupting the use of the domain name for DNS Abuse. | - | - | - | - | - | - | - | - | 1 | - | - | - | 0.1 |
| DNS Abuse RA: Phishing Total | 2 | 2 | - | - | - | - | - | - | 2 | - | 2 | - | 0.7 |
| DNS Abuse RA: Malware | |||||||||||||
| The registry suspended/deactivated the domain name. This is an appropriate mitigation action to contribute to stopping the use of the domain name for DNS Abuse. | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| The registry referred the domain and evidence to the sponsoring registrar. The registrar then took action that resulted in the abusive activity being stopped. The registry took appropriate mitigation action to contribute to disrupting the use of the domain name for DNS Abuse. | - | - | - | - | - | - | - | - | - | 1 | - | - | 0.1 |
| DNS Abuse RA: Malware Total | - | - | - | - | - | - | - | - | - | 1 | 1 | - | 0.2 |
| Grand Total | 2 | 2 | - | - | - | - | - | - | 2 | 1 | 3 | - | 0.8 |
DNS Abuse cases resolved with registry operators involving maliciously registered vs. compromised domains
| OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RA: Maliciously Registered Domain | 2 | - | - | - | - | - | - | - | 2 | 1 | 2 | - | 0.6 |
| DNS Abuse RA: Compromised Domain | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Grand Total | 2 | - | - | - | - | - | - | - | 2 | 1 | 2 | - | 0.6 |
Invalid or Unactionable Complaints Received Against Registry Operators by DNS Abuse Type
| Reason why complaint was deemed invalid | OCT 2025 | NOV 2025 | DEC 2025 | JAN 2026 | FEB 2026 | MAR 2026 | APR 2026 | MAY 2026 | JUN 2026 | JUL 2026 | AUG 2026 | SEP 2026 | Average |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DNS Abuse RA: Phishing | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 12 | 13 | 15 | 23 | 9 | 25 | 23 | 21 | 17 | 265 | 26 | 15 | 38.7 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | 1 | 7 | 9 | 2 | 3 | 7 | 8 | 3 | 5 | 6 | 1 | 5 | 4.8 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 4 | - | 2 | 3 | 1 | 8 | 2 | 1 | 2 | 1 | 2 | 2 | 2.3 |
| The registry operator is not the best-equipped party to review and take appropriate, proportionate, mitigation action in the particular case. | 1 | 4 | - | - | - | - | 3 | 2 | 1 | 3 | 2 | 3 | 1.6 |
| The complaint is out of scope because the complainant did not provide the requested information. | - | 1 | - | - | - | - | 3 | 1 | - | 1 | - | 1 | 0.6 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | - | 1 | - | - | - | 2 | 1 | 1 | - | - | - | - | 0.4 |
| The required abuse contact is displayed on the contracted party’s website and/or other designated place. | - | - | - | - | - | - | 2 | 1 | - | - | - | - | 0.3 |
| The reported activity is not DNS Abuse (phishing, pharming, botnets, malware or spam as a delivery mechanism for the other four types of DNS Abuse.) Therefore, DNS Abuse requirements are not applicable. | 2 | - | - | - | - | - | - | - | - | 1 | - | - | 0.3 |
| The complaint is out of scope because it is not about an ICANN contracted party. | - | - | - | 1 | - | - | - | - | 1 | - | - | 1 | 0.3 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | - | - | - | - | 1 | - | - | - | - | 1 | 0.2 |
| The complaint is out of scope because it is a duplicate of an open complaint. | - | - | - | - | - | - | - | 1 | - | - | - | - | 0.1 |
| The complaint is out of scope because it is about a private dispute that does not implicate ICANN's contractual authority. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The complaint is out of scope because the domain is not registered. | - | - | - | 1 | - | - | - | - | - | - | - | - | 0.1 |
| DNS Abuse RA: Phishing Total | 20 | 27 | 26 | 30 | 13 | 42 | 43 | 31 | 26 | 277 | 31 | 28 | 49.5 |
| DNS Abuse RA: Malware | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 1 | 8 | 7 | 12 | 1 | 7 | 7 | 9 | 13 | 248 | 22 | 3 | 28.2 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | - | 1 | 3 | 2 | 1 | 3 | 3 | 1 | 5 | 1 | 1 | 4 | 2.1 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | - | - | - | - | - | 4 | - | - | 1 | - | - | - | 0.4 |
| The registry operator is not the best-equipped party to review and take appropriate, proportionate, mitigation action in the particular case. | - | - | - | - | - | 1 | 1 | - | 1 | - | - | 1 | 0.3 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | 1 | - | - | - | - | 2 | - | - | - | - | - | - | 0.3 |
| The complaint is out of scope because it is a duplicate of an open complaint. | - | - | - | - | - | - | - | 3 | - | - | - | - | 0.3 |
| The complaint is out of scope because the complainant did not provide the requested information. | - | 1 | - | - | - | - | 2 | - | - | - | - | - | 0.3 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | - | - | - | - | 1 | - | - | 1 | - | - | 0.2 |
| The complaint is out of scope because the domain is not registered. | - | - | - | 1 | - | - | - | - | - | - | - | - | 0.1 |
| The required abuse contact is displayed on the contracted party’s website and/or other designated place. | - | - | - | - | - | - | - | - | - | - | 1 | - | 0.1 |
| The complaint is out of scope because it is about a private dispute that does not implicate ICANN's contractual authority. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| DNS Abuse RA: Malware Total | 2 | 11 | 10 | 15 | 2 | 17 | 14 | 13 | 20 | 250 | 24 | 8 | 32.2 |
| DNS Abuse RA: Botnets | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | - | 3 | 2 | 6 | - | 5 | 1 | 1 | 6 | 242 | 20 | 1 | 23.9 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | - | - | 2 | - | - | - | 2 | - | 3 | - | 1 | 1 | 0.8 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | - | - | - | - | - | 4 | - | - | - | - | - | - | 0.3 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | - | - | - | - | - | 2 | - | - | - | - | - | - | 0.2 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | 1 | - | - | - | 1 | - | - | - | - | - | 0.2 |
| The complaint is out of scope because it is about a private dispute that does not implicate ICANN's contractual authority. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The registry operator is not the best-equipped party to review and take appropriate, proportionate, mitigation action in the particular case. | - | - | - | - | - | - | 1 | - | - | - | - | - | 0.1 |
| The required abuse contact is displayed on the contracted party’s website and/or other designated place. | - | - | - | 1 | - | - | - | - | - | - | - | - | 0.1 |
| The complaint is out of scope because the complainant did not provide the requested information. | - | - | - | - | - | - | 1 | - | - | - | - | - | 0.1 |
| DNS Abuse RA: Botnets Total | - | 4 | 5 | 7 | - | 11 | 6 | 1 | 9 | 242 | 21 | 2 | 25.7 |
| DNS Abuse RA: Pharming | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 2 | 3 | 4 | 10 | 3 | 7 | 7 | 2 | 5 | 246 | 20 | 1 | 25.8 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | - | 1 | - | - | - | 2 | 2 | 1 | 1 | 1 | 2 | 1 | 0.9 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | - | - | 1 | 1 | - | 5 | - | - | 1 | - | - | - | 0.7 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | - | - | - | - | - | 2 | - | 1 | - | - | - | - | 0.3 |
| The complaint is out of scope because the complainant did not provide the requested information. | - | - | - | - | - | - | 2 | - | - | - | - | - | 0.2 |
| The registry operator is not the best-equipped party to review and take appropriate, proportionate, mitigation action in the particular case. | - | 1 | - | - | - | - | - | - | 1 | - | - | - | 0.2 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | - | - | - | - | 1 | - | - | - | - | - | 0.1 |
| The complaint is out of scope because it is about a private dispute that does not implicate ICANN's contractual authority. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| DNS Abuse RA: Pharming Total | 2 | 6 | 5 | 11 | 3 | 16 | 12 | 4 | 8 | 247 | 22 | 2 | 28.2 |
| DNS Abuse RA: Spam (Vector) | |||||||||||||
| The complaint is invalid or not actionable because there is no evidence of an abuse report filed with a registrar or registry. | 7 | 10 | 10 | 12 | 5 | 14 | 15 | 11 | 11 | 258 | 23 | 4 | 31.7 |
| The complaint is out of scope because it is regarding a country-code top-level domain. | - | 3 | 3 | 2 | 3 | 3 | 3 | 1 | 5 | 1 | 2 | 1 | 2.3 |
| The domain name is suspended or disabled and suspension is a mitigation action to stop DNS Abuse. | 1 | - | 1 | 2 | - | 7 | - | - | 2 | 1 | - | - | 1.2 |
| The complaint is out of scope because it is a duplicate of a closed complaint. | 1 | - | - | - | - | 2 | 1 | 1 | - | 1 | - | - | 0.5 |
| The complaint is out of scope because it is a duplicate of an open complaint. | - | - | - | 2 | - | - | - | 2 | - | - | - | - | 0.3 |
| The complaint is out of scope because the complainant did not provide the requested information. | - | - | - | - | - | - | 2 | - | - | - | - | - | 0.2 |
| The registry operator is not the best-equipped party to review and take appropriate, proportionate, mitigation action in the particular case. | - | - | - | - | - | - | 2 | - | - | - | - | - | 0.2 |
| The complaint is out of scope because customer service issues are outside of ICANN's contractual authority. | - | - | - | - | - | - | 1 | 1 | - | - | - | - | 0.2 |
| The complaint is out of scope because ICANN does not process complaints regarding website content. | 1 | - | - | - | - | - | - | - | - | - | - | - | 0.1 |
| The complaint is out of scope because it is not about an ICANN contracted party. | - | - | - | - | - | - | - | - | 1 | - | - | - | 0.1 |
| The required abuse contact is displayed on the contracted party’s website and/or other designated place. | - | - | - | - | - | - | - | 1 | - | - | - | - | 0.1 |
| The complaint is out of scope because it is about a private dispute that does not implicate ICANN's contractual authority. | - | 1 | - | - | - | - | - | - | - | - | - | - | 0.1 |
| DNS Abuse RA: Spam (Vector) Total | 10 | 14 | 14 | 18 | 8 | 26 | 24 | 17 | 19 | 261 | 25 | 5 | 36.8 |
| Grand Total | 34 | 62 | 60 | 81 | 26 | 112 | 99 | 66 | 82 | 1,277 | 123 | 45 | 172.3 |
One single complaint can report multiple types of DNS Abuse associated with the reported domain name(s); therefore, the sum of the DNS Abuse types in these reports will be greater than the total of individual unactionable DNS Abuse complaints closed within the month.