Summary

  • ICANN says a DNS-abuse case can remain open for months after the reported activity has been mitigated, while a registrar or registry addresses underlying weaknesses.
  • It reports more than 70 completed remediation plans and no recurrence indicators for 87.5% of them. That is a provisional finding, not a promise that every plan has passed an equally long test.

A registrar can deal with the abuse reported on a domain and still have an open file at ICANN months later. The unfinished business may be a weak reporting process, inadequate tools or staff who lack the expertise to act. Removing the immediate problem does not necessarily repair the way it was handled.

That is the distinction in ICANN Contractual Compliance's 15 October update. A complaint about one domain can expose a wider failure at the registrar or registry operator. The contracted party proposes a remedy; ICANN assesses it, follows its implementation and tests whether it works. There is no single repair prescribed for everyone. Training, monitoring tools, internal procedures, systems and oversight of resellers can all be part of the work.

One linked case shows why the response process matters. In an accreditation-termination notice to Fewmoretaps OU, trading as Trustname.com, ICANN says the registrar initially insisted on evidence that phishing credentials had actually been collected or transmitted, rather than assessing the available evidence as a whole. The notice describes mitigation taking place weeks after the initial reports. It also says measures implemented in February, and additional measures presented in June and July, had not demonstrated their effectiveness: further breach notices and new complaints followed.

Those are ICANN's findings in a particular contractual case, not a description of every registrar. They make the distinction tangible, though. Acting on a reported domain and improving the next response are separate achievements.

What happened after the first response?

ICANN says follow-up can involve new complaints, test reports, response and mitigation times, and industry data. A case may stay open while the contracted party refines its measures and ICANN checks whether the improvement holds.

The headline result is that 87.5% of more than 70 completed remediation plans had shown no recurrence indicators at the time of its account. ICANN says the remainder received expedited compliance action, including breach notices and, where warranted, termination. The post describes the monitoring methods, but does not supply each plan's observation period, a complete definition of the indicators or a full plan-by-plan results table. A recently completed plan and a long-observed one cannot simply be assumed to have faced the same test.

Nor does the recurrence sentence specify that its measurement date is the statistical cutoff used elsewhere in the post.

The broader investigation figures cover 5 April 2024 to 5 August 2026: more than 650 opened and more than 570 resolved. Among resolved matters, about 66% resulted in action to stop abuse and 8% in action to disrupt it. In 21%, the contracted party found no actionable evidence and supplied both an explanation and supporting evidence. That is not a tally of takedowns. The figures are approximate, and the post does not break out the remainder; turning the percentages into exact case counts would add precision the source does not have.

The same update reports eight Notices of Breach, more than 70 completed plans, further plans in development and one accreditation termination. Its termination link identifies the Trustname.com notice. But that document is dated 27 August, with termination effective on 11 September—both later than the stated 5 August statistics cutoff. The post does not reconcile those dates. The reported total and the dated notice should therefore be read separately, not forced into one consistent reporting window.

The remedy need not be a suspended domain

ICANN's 2024 advisory concerns duties under the Registrar Accreditation Agreement and the base gTLD Registry Agreement, with the amendments effective from 5 April 2024. Its definition of DNS Abuse covers malware, botnets, phishing and pharming, plus spam when used to deliver those other forms. It is not a general mandate over objectionable online content.

The roles differ. A registrar with actionable evidence must promptly take appropriate action reasonably necessary to stop or disrupt abuse involving a name it sponsors. A registry's duty is to contribute to stopping or disrupting it, at minimum through a supported referral to the sponsoring registrar or appropriate direct action. Evidence, the parties' roles and possible collateral damage matter. Suspending a compromised legitimate domain may also cut off its legitimate website, email and subdomains; suspension is not the only possible response.

Public visibility has a separate limit. ICANN says only remediation plans from its formal process are public, and formal matters are the smaller share of its overall compliance work. Those published plans are not a census of every investigation.

The June update reported nearly 530 investigations launched and more than 480 resolved through 5 April 2026. The October report's cutoff is four months later. Subtracting those rounded cumulative totals still cannot produce an exact four-month increase or a precise performance trend.

As of the cited updates, ICANN was also developing a proactive enforcement framework to complement complaints and audits. The October post does not announce a completed framework or a new rule. For now, the follow-up it describes returns to a practical question: not just whether this report was handled, but whether the measures taken make a better response repeatable.

Correction, 24 October 2026: the earlier article described the reporting cutoffs as two months apart; they are four months apart. It also overlooked the October post's direct link to the Trustname.com termination notice. This version identifies that record, distinguishes its dates from the statistics cutoff, and clarifies what the recurrence figure does and does not specify.