GoKawiilInterisle research: up to 20% of new gTLD domains in 2025 tied to criminal registrants
A study by Interisle Consulting Group found that at least 10% of new generic top-level domain registrations in 2025 had already turned up on security blocklists, with the true share of malicious registrations potentially reaching 20% once related but unlisted domains are counted. Interisle's Greg Aaron and Karen Rose presented these figures at the ICANN 86 Policy Forum, citing ICANN's own research that for every three blocklisted domains, two associated ones often go undetected. ICANN's Office of the CTO has since pushed back somewhat, arguing the numbers hinge heavily on how 'abuse' is defined.
GoKawiil's interpretation of the reporting above, not reported fact.
If accurate, these figures suggest a large fraction of the domain name industry's growth is being driven by criminal actors exploiting cheap, easy registration processes rather than legitimate demand. The dispute over methodology also reveals a deeper tension between ICANN and researchers over how DNS abuse should be measured and whether existing anti-abuse policies are keeping pace with the scale of the problem.
- Interisle estimates 10-20% of new gTLD registrations in 2025 may be tied to malicious actors.
- ICANN's own research suggests blocklists undercount abuse, missing two associated domains for every three flagged.
- ICANN's OCTO disputes the scale of the estimates, citing differing definitions of 'DNS abuse'.
Firewalla Purple Smart Firewall — If domain-level abuse is exploding, blocking bad domains at your network edge is the practical defense. The Firewalla Purple plugs into your home or small-office router setup and offers DNS-based filtering, ad and malicious-site blocking, and per-device visibility from a phone app. It's a tidy way to keep sketchy newly registered domains from ever resolving on your network.
See Firewalla Purple Smart Firewall on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: labs.ripe.net, 2026-08-30
Published there as: “DNS Abuse and Criminal Infrastructure”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.