when ADC leads to bulk suspension and sweeps in innocent registrants-A real case
Dear all, I am providing a real-world example with false positives, bulk suspension, sweeping in innocent registrants and the account was suspended as “high risk” following ADC-related action. We are not asking this PDP to develop a fully fledged complaint mechanisms. However, registrars should at least be required to provide a means for a Registered Name Holder to submit a complaint regarding an account suspension or other actions. It can just be a form. It can be just one sentence in the recommendation. *Summary:* A registrant using [will provide the name of the registrar upon request] received a single form notice disabling 73 domains across their account and locking the account entirely. This is some part of the communication they received: "Following a thorough *review of your domain portfolio *and the associated abuse reports, we have assessed that your account poses a high risk." The notice cited one internal reference number and stated the domains "appear to have been recently registered for the purpose of abuse," with no domain-specific evidence, no explanation of the alleged abuse type, and no appeal path, the email explicitly stated the decision was "final and will not be reversed." I'm not including the domain list here but can share it, along with the original notice, upon request. Here we are dealing with a case that we are actually making policy about: - No individualized evidence. All 73 domains were suspended under one blanket determination, with no indication of what conduct, content, or signal triggered the assessment for any specific domain. - False positives. At least 4 of the suspended domains were reportedly not owned by the account holder and had never been part of their account activity, evidence of an error somewhere in the automated attribution/matching pipeline, not merely a disputed abuse judgment. - No appeal mechanism. Even with a clear factual error (domains that didn't belong to the account holder), the notice foreclosed any correction process. - Legitimate domains swept in. A substantial portion of the suspended names were short/brandable/dictionary-style domains consistent with ordinary domain investment and resale activity, not abuse indicators by any recognized definition. Honestly, I don't think a specific example should be necessary to establish that this is a problem because the incentive structure alone makes the outcome predictable. Registrars bear real compliance and reputational costs for under-responding abuse reports, and essentially no cost for over-suspending. (I have mentioned this before in numerous DNS abuse meetings we had, at least since 2019) Bulk, automated, low-specificity suspension is simply the cheapest way to comply. Absent a requirement for individualized evidence and a mandatory appeal/correction path, this outcome, broad account-level action, misattributed domains, no recourse is the rational result of the incentives registrars face. Happy to provide further documentation on request. Farzaneh
Farzi, As an initial matter I disagree (and suspect registers would as well) that there is no cost for over-suspending and that bulk, automated, low-specificity suspension is simply the cheapest way to comply. The cost for this is the loss of revenue the registrar would have received from renewal of the domains and the loss of the customer. You also seem to be disregarding the real compliance and reputational costs for over suspending. I doubt any registrar wants to be viewed as a provider that arbitrarily suspends customer domain names. These are all very string, and very real, incentives against over suspension. If you provide the domain list and notice I would be interested in seeing it. Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [Greenberg Traurig Logo] [Greenberg Traurig Logo] From: farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Thursday, July 2, 2026 10:21 AM To: gnso-dnsabuse-pdp@icann.org Subject: [Gnso-dnsabuse-pdp] when ADC leads to bulk suspension and sweeps in innocent registrants-A real case *EXTERNAL TO GT* Dear all, I am providing a real-world example with false positives, bulk suspension, sweeping in innocent registrants and the account was suspended as “high risk” following ADC-related action. We are not asking this PDP to develop a fully fledged complaint mechanisms. However, registrars should at least be required to provide a means for a Registered Name Holder to submit a complaint regarding an account suspension or other actions. It can just be a form. It can be just one sentence in the recommendation. Summary: A registrant using [will provide the name of the registrar upon request] received a single form notice disabling 73 domains across their account and locking the account entirely. This is some part of the communication they received: "Following a thorough review of your domain portfolio and the associated abuse reports, we have assessed that your account poses a high risk." The notice cited one internal reference number and stated the domains "appear to have been recently registered for the purpose of abuse," with no domain-specific evidence, no explanation of the alleged abuse type, and no appeal path, the email explicitly stated the decision was "final and will not be reversed." I'm not including the domain list here but can share it, along with the original notice, upon request. Here we are dealing with a case that we are actually making policy about: * No individualized evidence. All 73 domains were suspended under one blanket determination, with no indication of what conduct, content, or signal triggered the assessment for any specific domain. * False positives. At least 4 of the suspended domains were reportedly not owned by the account holder and had never been part of their account activity, evidence of an error somewhere in the automated attribution/matching pipeline, not merely a disputed abuse judgment. * No appeal mechanism. Even with a clear factual error (domains that didn't belong to the account holder), the notice foreclosed any correction process. * Legitimate domains swept in. A substantial portion of the suspended names were short/brandable/dictionary-style domains consistent with ordinary domain investment and resale activity, not abuse indicators by any recognized definition. Honestly, I don't think a specific example should be necessary to establish that this is a problem because the incentive structure alone makes the outcome predictable. Registrars bear real compliance and reputational costs for under-responding abuse reports, and essentially no cost for over-suspending. (I have mentioned this before in numerous DNS abuse meetings we had, at least since 2019) Bulk, automated, low-specificity suspension is simply the cheapest way to comply. Absent a requirement for individualized evidence and a mandatory appeal/correction path, this outcome, broad account-level action, misattributed domains, no recourse is the rational result of the incentives registrars face. Happy to provide further documentation on request. Farzaneh ---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
There are a number of Registars flying by night, and in the deepest darkness. el On 2026/07/02 18:45, trachtenbergm--- via Gnso-dnsabuse-pdp wrote: [...]
I doubt any registrar wants to be viewed as a provider that arbitrarily suspends customer domain names. [...] -- Eberhard W. Lisse \ /Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht\ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply
Responsible registrars that care about their reputation will care about this. I think that is the vast majority of registrars, and includes the ones that are already doing ADC. It is the few bad actors (and there are these in every industry and walk of life) which won't care about reputation. But on the other hand, these are also the registrars that are least likely to conduct ADC, much less effective ADC, and will prioritize revenue over abuse mitigation, so there is little risk that they will be overinclusive in their mitigation efforts much less their ADC. Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com | www.gtlaw.com | View GT Biography -----Original Message----- From: Dr Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Friday, July 3, 2026 8:20 AM To: gnso-dnsabuse-pdp@icann.org Cc: el@lisse.NA Subject: [Gnso-dnsabuse-pdp] Re: when ADC leads to bulk suspension and sweeps in innocent registrants-A real case *EXTERNAL TO GT* There are a number of Registars flying by night, and in the deepest darkness. el On 2026/07/02 18:45, trachtenbergm--- via Gnso-dnsabuse-pdp wrote: [...]
I doubt any registrar wants to be viewed as a provider that arbitrarily suspends customer domain names. [...] -- Eberhard W. Lisse \ /Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht\ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply
Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org ---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
Dear Farzi, Regarding your example of the registrant who had 73 domains disabled and their account locked, the BC agrees that registrars should have the autonomy to conduct ADC based on the information available to them. Whether a registrar chooses to take action on a single domain, apply a clientHold to all domains in an account, or suspend the account entirely, these specific enforcement methods fall outside the scope of this PDP. Our focus should remain on the registrar's contractual responsibility to conduct the ADC itself. This also raises a concern (i.e. Rr's flexiblity / autonomy) regarding ICANN Compliance enforcement. If ICANN issues a breach notice to a registrar for failing to conduct a required ADC after a confirmed abuse report, there is no way for the registrar to retroactively perform that check. Since ADC is based on the information available at the time of the review, a registrar cannot effectively remediate the breach months later (i.e. the result of an ADC check performed prior to / after the breach notice could be different). My dark / evil side also suggested that if I run a bulletproof-like registrar, I can alert / advise the customer to transfer non-reported domains to separate user account(s), and leave the reported domain in the origianl account to avoid ADC grouping. I apologize for raising these concerns, and I do not have answers for them at the moment. Best, Ching On Fri, Jul 3, 2026 at 10:41 AM trachtenbergm--- via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
Responsible registrars that care about their reputation will care about this. I think that is the vast majority of registrars, and includes the ones that are already doing ADC. It is the few bad actors (and there are these in every industry and walk of life) which won't care about reputation. But on the other hand, these are also the registrars that are least likely to conduct ADC, much less effective ADC, and will prioritize revenue over abuse mitigation, so there is little risk that they will be overinclusive in their mitigation efforts much less their ADC.
Best regards,
Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com | www.gtlaw.com | View GT Biography
-----Original Message----- From: Dr Eberhard W Lisse via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> Sent: Friday, July 3, 2026 8:20 AM To: gnso-dnsabuse-pdp@icann.org Cc: el@lisse.NA Subject: [Gnso-dnsabuse-pdp] Re: when ADC leads to bulk suspension and sweeps in innocent registrants-A real case
*EXTERNAL TO GT*
There are a number of Registars flying by night, and in the deepest darkness.
el
On 2026/07/02 18:45, trachtenbergm--- via Gnso-dnsabuse-pdp wrote: [...]
I doubt any registrar wants to be viewed as a provider that arbitrarily suspends customer domain names. [...] -- Eberhard W. Lisse \ /Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht\ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply
Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information. _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
This PDP is not targeting "responsible" Registrars only. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 3, 2026 at 16:41 +0200, trachtenbergm@gtlaw.com, wrote:
Responsible registrars that care about their reputation will care about this. I think that is the vast majority of registrars, and includes the ones that are already doing ADC. It is the few bad actors (and there are these in every industry and walk of life) which won't care about reputation. But on the other hand, these are also the registrars that are least likely to conduct ADC, much less effective ADC, and will prioritize revenue over abuse mitigation, so there is little risk that they will be overinclusive in their mitigation efforts much less their ADC.
Best regards,
Marc H. Trachtenberg […]
I agree completely. But this goes to the supposed risk of harm from the ADC, which I think is clear is minimal. Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [Greenberg Traurig Logo] [Greenberg Traurig Logo] From: Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Friday, July 3, 2026 10:54 AM To: gnso-dnsabuse-pdp@icann.org Subject: [Gnso-dnsabuse-pdp] Re: when ADC leads to bulk suspension and sweeps in innocent registrants-A real case *EXTERNAL TO GT* This PDP is not targeting "responsible" Registrars only. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA<mailto:el@lisse.NA> / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 3, 2026 at 16:41 +0200, trachtenbergm@gtlaw.com<mailto:trachtenbergm@gtlaw.com>, wrote: Responsible registrars that care about their reputation will care about this. I think that is the vast majority of registrars, and includes the ones that are already doing ADC. It is the few bad actors (and there are these in every industry and walk of life) which won't care about reputation. But on the other hand, these are also the registrars that are least likely to conduct ADC, much less effective ADC, and will prioritize revenue over abuse mitigation, so there is little risk that they will be overinclusive in their mitigation efforts much less their ADC. Best regards, Marc H. Trachtenberg […] ---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
The risk is real, which I agree with NCSG is clearly not minimal. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 3, 2026 at 19:07 +0200, trachtenbergm@gtlaw.com, wrote:
I agree completely. But this goes to the supposed risk of harm from the ADC, which I think is clear is minimal.
Best regards,
Marc H. Trachtenberg […]
From: Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Friday, July 3, 2026 10:54 AM To: gnso-dnsabuse-pdp@icann.org Subject: [Gnso-dnsabuse-pdp] Re: when ADC leads to bulk suspension and sweeps in innocent registrants-A real case
*EXTERNAL TO GT* This PDP is not targeting "responsible" Registrars only.
el […]
Based on what? A few hypotheticals and one real one with no details? Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1 970.300.5313 T +1 312.456.1020 M +1 773.677.3305 M +1 773.677.3305 trac@gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [Greenberg Traurig Logo] [Greenberg Traurig Logo] ________________________________ From: Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Saturday, 04 July 2026 00:09:16 To: gnso-dnsabuse-pdp@icann.org <gnso-dnsabuse-pdp@icann.org> Subject: [Gnso-dnsabuse-pdp] Re: when ADC leads to bulk suspension and sweeps in innocent registrants-A real case The risk is real, which I agree with NCSG is clearly not minimal. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA<mailto:el@lisse.NA> / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 3, 2026 at 19:07 +0200, trachtenbergm@gtlaw.com<mailto:trachtenbergm@gtlaw.com>, wrote: I agree completely. But this goes to the supposed risk of harm from the ADC, which I think is clear is minimal. Best regards, Marc H. Trachtenberg […] From: Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Friday, July 3, 2026 10:54 AM To: gnso-dnsabuse-pdp@icann.org Subject: [Gnso-dnsabuse-pdp] Re: when ADC leads to bulk suspension and sweeps in innocent registrants-A real case *EXTERNAL TO GT* This PDP is not targeting "responsible" Registrars only. el […] ---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
All of this is hypothetical, so let's close the PDP down? She offered details by the way. I believe the NCSG has a case for walking away here. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 4, 2026 at 08:27 +0200, trachtenbergm--- via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
Based on what? A few hypotheticals and one real one with no details?
Best regards,
Marc H. Trachtenberg
[…]
I have been thinking a little more about this and done some (re)search: ICANN sends on the order of 2,500–4,000 informal compliance notifications to contracted parties per year, of which about 15–20 escalate to formal breach notices (approximately half of which result in terminations). I have had Claude draw a Bell Curve of 2800 items (Accredited Registrars) with the first three Standard Deviations marked (see the Attachment, if it survives the Mailing List). On the 3rd SD there are 7. It's interesting that 3SD and Terminations are (roughly) the same. Even though, admittedly, ADC is not included in the above, since the problem is large enough to have caused a PDP, one would expect to be able to plot false positives (and false negatives) on Bell Curves too, eventually. Registrars underresponding are a fact of life already, and overreacting will happen too. Negating this as a position by a Stakeholder Group strikes me as short sighted, negotiationwise. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 4, 2026 at 09:58 +0200, Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
All of this is hypothetical, so let's close the PDP down?
She offered details by the way.
I believe the NCSG has a case for walking away here.
el
-- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 4, 2026 at 08:27 +0200, trachtenbergm--- via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
Based on what? A few hypotheticals and one real one with no details?
Best regards,
Marc H. Trachtenberg
[…]
Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Farzaneh, An entity registering a portfolio of at least 73 Domain Names, would in my view know what it is doing. And so part of the blame would fall under Caveat Emptor. On the other hand the Registrar's behavior would strike as havy handed. And fraudulent, if not at least a proportion of funds would be returned. The problem of course is the recourse if two or more jurisdictions are involved. So I do agree that we need to bake some form of recourse into this Policy, and that this would be clearly within scope (as otherwise would be silly, and worth dying in a ditch over). el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jul 2, 2026 at 18:22 +0200, farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
Dear all,
I am providing a real-world example with false positives, bulk suspension, sweeping in innocent registrants and the account was suspended as “high risk” following ADC-related action. We are not asking this PDP to develop a fully fledged complaint mechanisms. However, registrars should at least be required to provide a means for a Registered Name Holder to submit a complaint regarding an account suspension or other actions. It can just be a form. It can be just one sentence in the recommendation.
[…]
participants (5)
-
Ching Chiao -
Dr Eberhard W Lisse -
Eberhard W Lisse
-
farzaneh badii -
trachtenbergm＠gtlaw.com