FYI fellow members of the DNS Abuse PDP Part 1, The new Interisle study is out and underscores the importance of this PDP getting it right and resulting in something that is meaningful, including in particular, having measurable and enforceable obligations (see https://interisle.net/insights/cybercriminaldomaindemand<https://urldefense.com/v3/__https:/interisle.net/insights/cybercriminaldomaindemand__;!!DUT_TFPxUQ!FfDi89N72mvRDxT00WYlsd9yGjYu4CACzJeSlj8hPxfqnhjnPDX11kS4-ERuAR7I5x1ANhp2Ri3erNn8Qw$>). The report indicates that 10% to 20% of domains are registered for bad purposes, but it might be even higher. The report further indicated that 10% of gTLD domains registered in 2025 have been added to blocklists, and almost all of these were registered for malicious purposes rather than being compromised. As an aside, WhoisXML API analyzes 8-10 million new registrations every month and generally estimates that about a quarter of them are registered for malicious purposes<https://main.whoisxmlapi.com/blog/april-2026-domain-activity-highlights>). Notably for this PDP, the report also addresses Associated Domains - see in particular pg 17: A recent study about associated domains was performed by the research team in ICANN’s Office of the CTO (OCTO). This study found that “at least 16% of newly registered gTLD domains, [created] in the first quarter of 2025, exhibited batch registration patterns.” Starting with an initial set of “seed” RBL- listed domains, the researchers found an additional 80% more domains that were associated with the blocklisted ones. This “indicates that for every three newly registered malicious domains reported through RBL feeds, batch expansion (using conservative filtering) identifies an additional two neighboring domains.” The researchers stated that “the true rate is likely to be higher” since they excluded ”many valid batches” such as those containing more than 1,000 domains. The results “indicate that batch registrations are prevalent, significantly predict overall abuse rates, and are useful for pivoting and expanding from known malicious ‘seed’ domain sets, particularly in certain TLDs and registrar environments.” Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [Greenberg Traurig Logo] [Greenberg Traurig Logo] ---------------------------------------------------------------------- If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
