Security Report · raw.githubusercontent.com

Interisle Estimates Cybercriminals Bought Up to 20% of New gTLD Domains in 2025

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Interisle found 8.5 million domains registered in 2025 had been blocklisted by May 2026. Its report projects malicious buyers may have acquired 20% of new gTLD registrations, highlighting bulk purchases and limited suspensions.

Key points

By May 18, 2026, 8.5 million of approximately 85 million gTLD domains created in 2025 had been blocklisted; Interisle assessed that about 98% appeared maliciously registered rather than subsequently compromised.
The estimate of 16.8 million potentially malicious purchases combines projected future blocklist additions with associated domains missed by blocklists; the report explicitly identifies the 20% figure as a projection.
Five registrars accounted for half of blocklisted 2025 registrations, while 13 gTLDs had more than half of their new registrations flagged for abuse.
Researchers combined reputation feeds, registration records, DNS data, and zone files. Case-study expansion linked domains through registration timing, registrar, hosting, and distinctive naming patterns, identifying 38%–63% more associated domains.
Interisle found that FUNNULL continued registering domains after U.S. sanctions in May 2025. In the .LOAN, .PINK, and .GIFT case studies, none of the additional domains identified through association had been suspended by September 2025.
The report links disposable criminal infrastructure to exceptionally low renewal rates: .BOND renewed just 0.5% of domains in 2025, following large-scale registrations associated with information-stealing malware distribution.
Interisle argues that bulk discounts and volume-based incentives can reward abusive demand, and calls for enforceable policies and stronger registrar and registry abuse controls.

Article Details

Publisher: Interisle Consulting Group
Report Period: 2025-01-01 to 2025-12-31
Scope: Malicious registrations in the gTLD market, with associated-domain case studies of .LOAN, .PINK, .BOND, and .GIFT; blocklist observations extend into 2026.
Sample Size: 84,961,989 gTLD domains created in 2025.
Key Statistics: As of 2026-05-18, 8,496,811 domains created in 2025 had been blocklisted, representing 10% of new gTLD registrations; approximately 98% appeared maliciously registered rather than subsequently compromised.
Five registrars accounted for 50% of blocklisted domains created in 2025; thirteen gTLDs had more than half of their new registrations flagged for abuse.
Expansion analyses of four case-study TLDs identified 38% to 63% more associated domains beyond the blocklisted seed sets; these additional domains were assessed as likely registered by abusive actors.
Only 56.6% of the more than 332,000 FUNNULL infrastructure domains published by the FBI appeared on the blocklists monitored by Interisle.
.BOND's overall renewal rate in 2025 was 0.5%, following extensive malicious registration activity.
Recommendations: Use associated-domain checks to expand investigations from blocklisted seeds using registration timing, registrar, hosting, and distinctive domain-string patterns.
Adopt better contractually binding and enforceable domain-abuse policies.
Suspend maliciously registered domains, while referring compromised legitimate domains to their hosting providers and registrants for remediation to avoid disrupting innocent users.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`12529[.]loan`	FUNNULL domain observed by the FBI in registrations distributed across TLDs and registrars.
DOMAIN	`12538[.]loans`	FUNNULL domain observed by the FBI in registrations distributed across TLDs and registrars.
DOMAIN	`22238[.]pink`	FUNNULL numerical-registration example detected by Infoblox and SURBL.
DOMAIN	`22274[.]pink`	FUNNULL numerical-registration example detected by Spamhaus.
DOMAIN	`22277[.]pink`	FUNNULL numerical-registration example identified by the FBI.
DOMAIN	`22290[.]pink`	FUNNULL numerical-registration example identified by the FBI.
DOMAIN	`22301[.]pink`	FUNNULL numerical-registration example detected by Infoblox and Spamhaus.
DOMAIN	`22319[.]pink`	FUNNULL numerical-registration example detected by Spamhaus.
DOMAIN	`22320[.]pink`	FUNNULL numerical-registration example detected by Spamhaus.
DOMAIN	`27271[.]one`	Domain explicitly identified as a FUNNULL registration logged by the FBI.
DOMAIN	`27272[.]loan`	Domain explicitly identified as a FUNNULL registration logged by the FBI.
DOMAIN	`272722[.]me`	Domain explicitly identified as a FUNNULL registration logged by the FBI.
DOMAIN	`272777[.]cn`	Domain explicitly identified as a FUNNULL registration logged by the FBI.
DOMAIN	`272788[.]loan`	Domain explicitly identified as a FUNNULL registration logged by the FBI.
DOMAIN	`bcnkvs[.]top`	Related domain identified as a suspicious redirect destination from mzvzq.gift.
DOMAIN	`cremation-services-37263[.]bond`	Example of Revolver Rabbit domains used to distribute information-stealing malware.
DOMAIN	`mzvzq[.]gift`	Associated-domain example assessed as linked to FUNNULL; redirected visitors and offered a suspicious APK download.
DOMAIN	`security-apps-25597[.]bond`	Example of Revolver Rabbit domains used to distribute information-stealing malware.
DOMAIN	`telegbftc[.]pink`	Domain shown hosting a phishing page targeting Telegram users.
DOMAIN	`work-abroad-18297[.]bond`	Example of Revolver Rabbit domains used to distribute information-stealing malware.
IPV4	`203[.]210[.]16[.]175`	Spamhaus-blocklisted IP address associated with the suspicious redirect and APK-download domain mzvzq.gift.
URL	`hxxp[:]//e-zpass[.]com-etcww[.]loan/`	Example URL from a batch of 86 domains used for toll-road phishing.