Interisle Consulting Group counted roughly 85 million new gTLD domains registered in 2025. By mid-May, blocklists had flagged 8.5 million of them, or one in ten. Even so, Interisle calls that a floor, not a ceiling, and projects the real number sold to malicious actors could reach 16.8 million, closer to one in five.
The abuse isn’t spread evenly, either. Five registrars, for instance, accounted for half of all blocklisted domains in the report’s dataset, and individual rates swing wildly from there: GoDaddy sits at 4.7%, Gname at 40.2%, and NICENIC at 87.6% of its own new registrations. Most of that volume, an estimated 88%, arrived in bulk, meaning buyers registered the domains in batches with barely any gap between purchases. In one striking case, GMO Internet Group created 10,848 domains in just over five hours, all algorithmically generated strings in the .BOND extension.
ICANN, meanwhile, pushed back on 10 August. Its technical staff argued blocklist data show reports of suspicious activity rather than confirmed abuse, and that such figures “at best form an upper limit.” The organization also flagged Interisle’s methodology as diverging from ICANN’s own published approach, though it didn’t explain how or why.
Even so, what the report makes harder to dismiss sits buried in its own numbers. Newfold Digital, which owns Network Solutions and Register.com among hundreds of other registrars, kept its abuse rate at 3.9%, for example. Tucows, similarly, landed at 3.0%. Both, in other words, grew their businesses without anywhere near the exposure seen at the high end of the report’s rankings.
Interisle ties the wider pattern to pricing, too. Cheap first-year deals, wholesale discounts, and rebates that reward registrars for hitting growth targets all pull in customers who rarely renew, and cybercriminals fit that profile closely, which helps explain why renewal rates in the worst-affected extensions drop as low as 0.5%. As the report puts it, if those sales lost money consistently, providers would have already changed course.
Ultimately, ICANN disputes the scale and the method behind these figures. It doesn’t, though, dispute that some registrars run cleaner books than others, and that gap, in the end, is where the real story sits.
