ICANN is looking at “Associated Domain Checks” when one domain has actionable evidence of DNS abuse. For webmasters, the awkward case is a hacked site: one domain gets compromised and used for phishing while your other sites are clean. Checking the rest could catch the same compromise elsewhere, but it could also turn one hacked site into account-wide scrutiny. Would “review the rest, but don't suspend without separate evidence” feel fair?
Yes, I’d check all related domains. If one site has already been compromised, it’s better not to assume the problem is limited to that one. I’d check access credentials, the CMS and plugins, DNS, email, and logs, and also change passwords and enable 2FA. I’d also check for any unfamiliar files or redirects
Absolutely—flagging the rest of the account for a security review is fine, but suspending clean sites without concrete evidence of abuse crosses the line. A hacked site is an infection issue, not a policy violation by default.
Good checklist. One correction to my original example though the current ICANN draft actually excludes compromised domains from the ADC trigger. That's the important distinction. Same account can be a reason to take a closer look. That's especially true with reseller accounts, where domains under one account may belong to completely different end customers.
This is one of those ideas that sounds clean in theory but gets messy fast in practice. "Associated with the same account" means very different things depending on how the domains were registered. If one person registered twenty names under their own account, a review of the rest after one gets flagged seems reasonable. But under a reseller setup, one account can hold domains belonging to completely different end customers, so pulling every associated name into scrutiny can end up punishing people with no connection to the abuse at all. The other distinction that matters to me is intent. If the flagged domain is a throwaway registered for the explicit purpose of phishing, then checking its neighbors makes sense because the same actor likely staged others. But if the domain is a legitimate site that got hacked, suspending the owner's other clean domains punishes the victim. Review broadly, but suspend narrowly, only with independent evidence against each specific name. I would also want a notification step in the middle: tell the registrant what was found on the flagged domain and give them a window to self-audit the rest. That keeps the burden on the party that actually controls the names, and it avoids registrars having to play investigator over account structures they may not fully understand.
Thanks for taking the time to write this out. I like the notification step. Giving the registrant a little time to check the rest first could save a lot of unnecessary trouble, especially with reseller accounts.