The investigation lock command can be used to lock down a domain name, preventing a number of operations upon it.

Guidelines

The command must only be used when a domain name or registrant is suspected of being involved in phishing. It must not be used for any other purposes. Please refer to the guidelines for further details.

The investigation lock command can be applied to either a domain name or a registrant's account.

Use of the command on a domain name has the following effect:

• Nameservers are removed from the zone file. The domain name will no longer resolve.
• Prevent any registrant transfers
• Prevent any registrar changes
• Prevent the domain name from being renewed.
• Prevent any modifications to the nameservers stored for the domain name in the registry.
• Prevent the registrant or registrar from cancelling the domain name. The domain name will be cancelled by Nominet 90 days after the lock has been activated.
• The domain name is displayed as suspended in the whois.

Use of the command on an account has the following effect:

• All the domain names on the account are locked having the effect listed above.
• Prevent any modifications on data that is displayed upon the whois.
• Prevent any new domain names from being created on that account
• Prevent any domain names on the account from being moved away from the account onto a different account (transfers and account merges).

<domain:lock> element

The <domain:lock> element contains the following sub-elements:

• A <domain:name> element giving the domain name to lock

and the following attribute:

• A type attribute of value "investigation".

<account:lock> element

The <account:lock> element contains the following sub-elements:

Either

• An <account:roid> element giving the account to lock

or

• An <account:domain-name> element giving the name of a domain name on the account to lock.

The element also has the following attribute:

• A type attribute of value "investigation".
  

Example of a domain lock operation

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0 epp-1.0.xsd">
  <command>
   <update>
    <domain:lock
     xmlns:domain="http://www.nominet.org.uk/epp/xml/nom-domain-2.0"
     xsi:schemaLocation="http://www.nominet.org.uk/epp/xml/nom-domain-2.0
     nom-domain-2.0.xsd" type="investigation">
     <domain:name>epp-example.co.uk</domain:name>
    </domain:lock>
   </update>
   <clTRID>ABC-12345</clTRID>
 </command>
</epp>

Example of an account lock operation

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0 epp-1.0.xsd">
   <command>
     <update>
       <account:lock
        xmlns:account="http://www.nominet.org.uk/epp/xml/nom-account-2.0"
        xsi:schemaLocation="http://www.nominet.org.uk/epp/xml/nom-account-2.0
        nom-account-2.0.xsd" type="investigation">
        <account:roid>12345678</account:roid>
       </account:lock>
     </update>
     <clTRID>ABC-123</clTRID>
  </command>
</epp>

Example of a successful response to a lock operation

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.nominet.org.uk/epp/xml/epp-1.0 
      epp-1.0.xsd">
  <response>
    <result code="1000">
      <msg>Command completed successfully</msg>
    </result>
    <trID>
      <clTRID>EPP-ABC-12345</clTRID>
      <svTRID>10012531</svTRID>
    </trID>
  </response>
</epp>