Abuse

This policy sets what GOpenCDR acts on, who acts first and how fast. It binds Tier 0, the root abuse desk and every TLD operator.

GOpenCDR acts on DNS abuse, meaning phishing, malware, botnets, pharming and spam that delivers them, and on binding orders of courts and competent authorities. It never judges content or speech at the DNS layer.

A claim that a name infringes somebody's rights goes through the name dispute policy, not the abuse desk.

Every report is acknowledged within 24 hoursfloor.

The TLD operator acts on a report passed to it within 48 hoursfloor, or within 12 hoursfloor where phishing or malware is active.

If the TLD has not acted in that time, the root abuse desk acts on the name itself in a hosted TLD, and escalates against a self-hosted TLD under its agreement, which can end in its delegation being suspended.

Where people are at immediate risk, for example from an active phishing campaign, the root may act at once and tell the TLD straight afterwards.

A person decides every restriction. Measures are proportionate: a hold rather than a deletion wherever a hold stops the harm, lifted once the abuse has stopped and its cause is dealt with.

The registrant gets a statement of reasons and may appeal under P-5 5.2. A reporter's identity is passed on only if they agree or the law requires it.

Every abuse action is recorded in the audit log and the transparency log.

Rule abuse.logged.

GOpenCDR acts on an order or request of a court or an authority only with valid legal process from a competent authority. An authority outside the EU routes its request through mutual legal assistance or an equivalent channel binding under German law. The registrant is told unless the law forbids it.

Every request and its outcome is counted in a transparency report published every 6 monthsfixed.