New gTLDs in 2025: 1 in 5 Registrations Was a Scam
A June 2026 Interisle report found that up to 20% of the ~85 million new gTLD domains registered in 2025 were malicious — and enforcement barely touches them. Here's what that means if you're building fintech or Web3 products.
By TRAGenX Desk
DNS is supposed to be boring, load-bearing infrastructure — you register a name, it resolves, done. But a new report puts a number on something builders have felt anecdotally for years: a meaningful share of new domain registrations exist purely to run scams, and almost nobody is taking them down.
The numbers
- Interisle Consulting Group's report, Malicious Registrations in the Domain Name Market, published June 1, 2026, found that of the roughly 85 million new generic top-level domain (gTLD) registrations made in 2025, 8.5 million (10%) had already appeared on security blocklists by mid-May 2026.
- Interisle's own projections — accounting for undetected and not-yet-blocklisted registrations — push the real abuse rate toward 20%, or an estimated 16.8 million domains.
- Abuse is heavily concentrated: 13 TLDs exceeded 50% blocklist rates, led by
.LOCKER(72.9%),.LGBT(72.2%), and.TOWN(70.2%), and five registrars were responsible for half of all blocklisted domains. - Enforcement lags badly — only 7.4% to 16.3% of blocklisted domains were ever suspended.
Terence Eden put it bluntly, in a post Simon Willison flagged after seeing Andrew Campling's analysis on RIPE Labs: "One in five newly registered domains with a gTLD are scams."
Why this matters if you're building fintech or Web3 products
Trading platforms, wallets, and exchanges are exactly the kind of high-value, high-urgency brands that phishing infrastructure loves to impersonate — a lookalike domain with a fresh SSL cert is cheap to stand up and short-lived by design, which is precisely why blocklist-based takedown struggles to keep pace. The Interisle numbers quantify the base rate of that risk across the entire gTLD namespace, not just your brand's corner of it.
There's a second, more novel angle for anyone shipping AI-assisted or agentic systems: an LLM agent that autonomously fetches a URL, follows a link in a support ticket, or pulls off-chain data for an on-chain process has no innate skepticism about domain age or registrar reputation. It resolves and reads. If a fifth of new registrations in the namespace are adversarial, treating a resolvable domain as trustworthy input is a mistake — the same trust-boundary discipline you'd apply to any other untrusted data belongs on URLs an agent visits unsupervised.
What it changes for how you ship
- Treat TLD and registrar as a fraud-detection feature, not just a branding decision — "newly registered on a historically high-abuse TLD" is a legitimate, cheap signal for a KYC/AML or account-fraud pipeline.
- If your product includes agentic browsing, auto-fetching, or link-following (support bots, research agents, oracles), don't let resolution alone confer trust — pair it with domain-age and blocklist checks the way you'd validate any other external input.
- Monitor for lookalike registrations of your own brand rather than assuming users will notice a wrong TLD or an extra hyphen — by the time a scam domain hits a blocklist, most of its damage is already done.
None of this means DNS is broken beyond repair — it means the economics currently favor high-volume, low-friction registration over verification, and builders who treat that as a known, measurable risk will catch more fraud than those who don't.
FAQ
Frequently asked questions
- What counts as "DNS abuse" in this report?
- Interisle measured domains that appeared on security blocklists shortly after registration — typically phishing, malware, or scam sites — as a proxy for malicious intent behind the registration itself.
- Which report is this based on, and when was it published?
- Interisle Consulting Group's "Malicious Registrations in the Domain Name Market," published June 1, 2026, analyzing 2025 gTLD registrations against blocklist data as of mid-May 2026.
- Should crypto and trading platforms do anything differently because of this?
- The report doesn't break down abuse by target industry, but phishing infrastructure broadly targets high-value brands like exchanges and wallets — so brand-monitoring for lookalike domains and treating domain reputation as a fraud signal are reasonable, low-cost defenses regardless of what any single report says about your sector specifically.
Sources
- The purpose of DNS is to spread scams — Simon Willison
- The purpose of DNS is to spread scams — Terence Eden (Shkspr.mobi)
- Malicious Registrations in the Domain Name Market — Interisle Consulting Group
- DNS abuse and criminal infrastructure: beyond definitions and blocklists — RIPE Labs