DNS Abuse and Criminal Infrastructure

Andrew Campling, who leads the tech‑focused public policy firm 419 Consulting Ltd and serves as a trustee of the Internet Watch Foundation, highlighted growing concerns that cybercriminals may control a sizable share of newly created generic top‑level domains (gTLDs). Research released by Interisle Consulting Group indicates that at least 10 % of all gTLD names registered in 2025 had already appeared on security blocklists, and when accounting for associated domains that were not yet listed, the proportion of registrations linked to malicious actors could be closer to 20 %. In a presentation at the ICANN 86 Policy Forum, Interisle’s Greg Aaron and Karen Rose reiterated these figures, noting that while 10 % of 2025 registrations were blocklisted at the time of analysis, later blocklisting could raise the observed share to around 12 %, and that for every three domains on blocklists, two additional related domains typically remain unlisted. The implication is that a material share of the gTLD market may be under the control of actors capable of facilitating a range of online harms.

The significance of these findings lies in the potential mismatch between the scale of malicious registrations and the current definition of DNS abuse used by ICANN. ICANN’s Office of the CTO cautioned that estimates of abuse depend heavily on how “abuse” is defined, the evidentiary standards applied, and the analytical methods employed, arguing that not every blocklisted domain should automatically be classified as confirmed DNS abuse. The organization’s contractual definition limits DNS abuse to botnets, malware, pharming, phishing, and spam used as a delivery mechanism for those harms, deliberately excluding broader categories such as fraud, scams, and non‑delivery‑mechanism spam. Interisle’s report was criticized for not fully explaining methodological departures from ICANN and COMAR practices, though the broader concern remains: domains owned by criminal actors can be held for future use, employed in campaigns not yet detected, or leveraged for harms—like fraud, sextortion, and scams—that fall outside ICANN’s narrow contractual scope. This gap raises questions about whether commercial incentives, operational practices, and contractual arrangements within the domain industry inadvertently enable large‑scale abuse.

The broader context underscores why the issue demands urgent attention. The Global Anti‑Scam Alliance estimated that scams caused $442 billion in losses worldwide in 2025, with developing nations facing especially high risks of financial harm. Meanwhile, Childlight’s “Into the Light” index reported that roughly one in four children experienced online sexual solicitation in 2025, and 9 % faced online sexual extortion before turning 18. Although these statistics do not directly measure the role of domain names, they illustrate the massive scale of technology‑facilitated harm that could be amplified by malicious domain registrations. Interisle’s findings, even if the exact proportion of bad‑actor‑controlled domains remains debated, suggest that the internet ecosystem must scrutinize whether its systems are being used to enable, sustain, or scale such serious threats. The ongoing policy work on associated‑domain checks and safeguards for high‑volume registrations, coupled with the need for clearer definitions and more robust evidence standards, will shape how the industry responds to the risk that a substantial share of new gTLDs may serve criminal purposes.

⚡ Effects Interpreter