Malicious gTLD registrations may reach 20% of new domains

New data on domain registrations has raised concerns about the scale of criminal activity within the generic top-level domain (gTLD) market. Evidence compiled by Interisle Consulting Group and presented at ICANN forums suggests that malicious actors may have secured a substantial portion of newly created gTLD names in 2025, with estimates ranging between 10% and 20% of all registrations for that year.

Scale of the problem

Interisle’s analysis found that at least 10% of new gTLD domains registered in 2025 had already appeared on security blocklists by mid-2026. The firm’s researchers, Greg Aaron and Karen Rose, later projected that the figure could rise to 12% once delayed blocklist additions were accounted for. Their methodology also factored in associated domains—those linked to confirmed malicious registrations but not yet flagged—leading to an upper estimate of 20% of new gTLDs potentially under criminal control.

ICANN’s Office of the Chief Technology Officer (OCTO) has since challenged aspects of Interisle’s approach, particularly the definition of "DNS Abuse" and the treatment of blocklisted domains as confirmed abuse. ICANN’s contractual framework currently limits DNS Abuse to five specific harms: botnets, malware, pharming, phishing, and spam used as a delivery mechanism for these threats. Broader categories, such as fraud or scams, fall outside this definition, complicating efforts to quantify the full scope of misuse.

Broader risks beyond blocklists

Even domains not yet flagged on blocklists pose risks. Criminals may register domains for future use, deploy them in undetected campaigns, or exploit them for harms not covered by ICANN’s narrow definition, such as sextortion or ransomware. The financial and social impact of such activity is substantial: the Global Anti-Scam Alliance reported $442 billion in global losses to scams in 2025, while Childlight’s 2026 Into the Light index found that 6.7% of children experienced online sexual solicitation that year.

These figures do not isolate the role of domain names, but they underscore the urgency for the DNS ecosystem to address how its infrastructure enables large-scale harm. Registries and registrars face growing pressure to implement preventive measures, such as risk-based know-your-customer (KYC) checks, to identify suspicious registration patterns—particularly high-volume accounts or those linked to known abuse.

Policy and operational gaps

ICANN’s current contractual obligations focus on post-registration enforcement rather than proactive prevention. While the organization has initiated policy work on associated domain checks and safeguards for bulk registrations, critics argue these efforts lack the speed and scope needed to curb industrial-scale abuse. ccTLD operators, by contrast, often have clearer legal mandates to act against broader categories of illegal activity, potentially creating disparities in trust across the DNS market.

The debate over definitions has not diminished the core concern: criminals appear to be exploiting gTLD infrastructure at scale. ICANN’s community is now being urged to evaluate whether its contractual frameworks, data-sharing practices, and enforcement mechanisms are sufficient to address the problem. Proposed reforms include clearer coordination with law enforcement and national authorities, while preserving ICANN’s role as a technical coordinator rather than a content regulator.

What’s next

The ICANN community is expected to discuss potential policy changes in upcoming forums, including whether to expand the definition of DNS Abuse to encompass a wider range of technology-facilitated harms. Any reforms will need to balance effectiveness with the principles of openness, privacy, and interoperability that underpin the DNS. Meanwhile, registrars and registries are likely to face increasing scrutiny over their ability to detect and prevent malicious registrations before they are weaponized.