ICANN study finds over half of flagged abusive domains have linked domains
in plain words
ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN technical staff studied domains reported for scams, phishing Impersonating a trusted party to steal data, often with look-alike domains. Full definition of phishing or malware Harmful software, often spread or controlled using domain names. Full definition of malware and checked public clues like who registered them, which servers they used, and when. More than half of the bad domains turned out to be linked to other domains registered around the same time. But the method mostly found these connections only after blocklist A published list of domains or IP addresses to block for spam, phishing or malware. Full definition of blocklist already had, not before, mainly because registry The central database and system of a top-level domain, or loosely the organization that runs it. Full definition of registry data often arrived too slowly.
ICANN’s Office of the Chief Technology Officer published a report on October 6, dated September 18 and written by four staff members, examining whether domains reported as malicious are connected to other domains. The work feeds into an ongoing GNSO Generic Names Supporting Organization The ICANN body that develops policy for generic top-level domains. Full definition of GNSO policy effort on combating DNS abuse Harmful use of domains, defined in ICANN contracts as five specific threats. Full definition of DNS abuse, whose working group A volunteer team chartered to study a policy issue and make recommendations. Full definition of working group has proposed that registrar A company that registers domain names for customers with the registry. Full definition of registrar check for related domains after confirming an abuse case, using customer and account data. The ICANN report instead relied only on public technical signals: registrar, nameservers, registration Obtaining the right to use a domain name for a set period. Full definition of registration timing and IP Internet Protocol The internet's basic rules for sending data, using numeric addresses for every connected device. Full definition of IP, without any owner or payment information.
Researchers started from newly registered gTLD generic top-level domain A top-level domain not tied to a country, run under ICANN contracts. Full definition of gTLD domains that landed on blocklists such as Spamhaus A nonprofit that publishes widely used blocklists of abusive domains and IP addresses. Full definition of Spamhaus or PhishTank by late September 2025, when roughly 4,000 domains were being added daily. They applied three methods: two looked for domains registered with the same registrar and nameservers within a short window of each other, the tightest requiring registration within five seconds; a third looked for domains sharing the same IP address and nameserver combination on the same day, later filtered for similar-looking names.
At least one linked domain was found for 56.4% of reported domains overall, rising to 57% for phishing cases and 43% for malware and botnet A network of infected computers controlled by an attacker. Full definition of botnet combined, though those samples were small. The method identified only 4.6% of linked domains before they appeared on blocklists, a gap attributed to registries at the time submitting registration data The information kept about a domain and its owner. Full definition of registration data to ICANN only weekly. A model suggested that data delivered within 30 minutes could raise early detection to 10%; the latest registry agreement now requires at least daily data delivery.
The tightest method found an average of 2.32 additional domains per reported domain, though much of this came from a single campaign generating algorithmically produced six-character names under one extension, with batches exceeding 6,000 domains; excluding it sharply reduced the counts.