Significant Increase in Malicious gTLD Registrations by Cybercriminals

A recent analysis by Interisle Consulting Group reveals that cybercriminals registered at least 10% of new generic top-level domain (gTLD) registrations in 2025, with estimates suggesting the actual figure could be as high as 20%. This translates to approximately 16.8 million domains potentially controlled by malicious actors. The study highlights that certain registries and registrars experienced extreme levels of abuse, with some reporting over 50% of their new registrations being blocklisted. The report emphasizes the need for improved abuse prevention policies and practices among domain registrars and registries. ICANN has acknowledged the challenges in defining and measuring DNS abuse, stressing the importance of clear methodologies. The ongoing discussions within the ICANN community aim to refine the understanding of malicious domain registrations and improve mitigation strategies. The situation remains critical as new open gTLDs are expected to be introduced in 2027.

Key Points: • Cybercriminals registered 10-20% of new gTLDs in 2025, equating to 16.8 million domains. • Some registrars had over 50% of their new registrations blocklisted for malicious activity. • ICANN is reviewing its definitions and methodologies for assessing DNS abuse.