DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists

Author: Andrew Campling
Role: Community Contributor / Director of 419 Consulting Ltd
Affiliation: Trustee of the Internet Watch Foundation
Date: August 24, 2026
Reading Time: $\approx 8$ minutes

The Magnitude of Malicious Registrations

Recent data suggests that a frighteningly high percentage of new gTLD (generic Top-Level Domain) registrations may be under the control of criminal entities. While the exact figures are a point of contention, the central question is whether our current strategies for combating DNS abuse are sufficient to handle the systemic misuse of domain names.

Findings from Interisle Consulting Group

Research conducted by the Interisle Consulting Group indicates that cybercriminals claimed a massive slice of the new domain market in 2025. Their analysis revealed:

Direct Evidence: At least 10% of all new gTLD registrations in 2025 were identified on security blocklists.
Estimated Reach: When accounting for associated domains that haven't been flagged yet, the actual share of malicious registrations is likely closer to 20%.

During the ICANN 86 Policy Forum, Greg Aaron and Karen Rose expanded on these findings. They suggested that while 10% were already blocklisted, the final observed proportion would likely hit 12%. This projection is supported by ICANN's own research regarding the ratio of listed to unlisted malicious domains:

$\text{Ratio} = \frac{3 \text{ Blocklisted Domains}}{2 \text{ Associated Unlisted Domains}}$

"Any industry confronted with evidence that a material share of its output may be controlled by bad actors should be seriously concerned."

If a significant portion of a product is being weaponized, the industry must scrutinize its ~~commercial incentives~~ operational practices and contractual frameworks to ensure they aren't inadvertently helping criminals scale their operations.

Methodological Disputes and Definitions

In response, the ICANN Office of the CTO (OCTO) published a rebuttal. They argue that the "scale" of abuse is entirely dependent on how one defines "abuse" and what evidence is required for confirmation.

The Definitional Gap

ICANN maintains a very specific, narrow contractual definition of DNS Abuse. The following table illustrates the difference between ICANN's narrow scope and the broader reality of online harm:

Category	Included in ICANN's "DNS Abuse"?	Examples
Botnets	✅	C&C Infrastructure
Malware	✅	Payload delivery sites
Pharming/Phishing	✅	Credential theft pages
Specific Spam	✅	Spam used to deliver malware/phishing
General Fraud/Scams	❌	Investment scams, romance scams
General Spam	❌	Unsolicited marketing (non-malicious)

ICANN's OCTO criticized the Interisle report for not clearly explaining how their methods deviated from standard ICANN and COMAR protocols. They also highlighted ongoing efforts to improve safeguards for high-volume registrations.

The Reality of Technology-Facilitated Harm

While the technical debate over definitions is important for academic and legal precision, it should not overshadow the actual risk. A domain does not need to be on a blocklist to be dangerous. Criminals often:

Stage domains (registering them and letting them sit idle).
Deploy them in rapid-fire campaigns that evade detection.
Utilize them for harms that fall outside the narrow DNS Abuse definition, such as sextortion or financial fraud.

The Human and Financial Cost

The urgency of this issue is highlighted by the sheer scale of global harm:

Financial Loss: The Global Anti-Scam Alliance estimates that scams resulted in US$442 billion in losses during 2025, with developing nations suffering disproportionately.
Child Safety: The Childlight Into the Light index (2026 update) shows:
- $\approx 25\%$ of children have faced online sexual solicitation.
- $9\%$ of minors experienced online sexual extortion before age 18.

Conclusion: A Call for Action

Methodological disagreements must not lead to institutional paralysis. Whether the percentage of malicious domains is 10% or 20%, the fact that criminal actors control a substantial portion of the gTLD ecosystem requires a robust response.

The ICANN community must now determine if their current frameworks are too narrow.

Future Objectives

Re-evaluate contractual definitions of "abuse."
Implement stronger preventive obligations for registrars.
Bridge the gap between "blocklist detection" and "proactive prevention."
Address harms like fraud and exploitation that currently slip through the cracks.

Technical Note: For those analyzing these trends, the logic can be simplified as: if (domain == blocklisted) { status = "Confirmed Abuse"; } else if (domain == associated) { status = "Potential Risk"; }