---
id: "d62a2b79-b9e1-42c8-a91c-ad022354aa78"
kind: "link"
title: "ICANN study finds over half of flagged abusive domains have linked domains"
language: "en"
section: "security"
date: "2026-10-12T07:05:09Z"
updated: "2026-10-12T07:05:09Z"
canonical: "https://tldlog.com/l/icann-study-finds-over-half-flagged-abusive-domains-have/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/estudio-icann-halla-dominios-vinculados-mas-mitad-casos/"
  de: "https://tldlog.com/de/l/icann-studie-haelfte-gemeldeter-missbrauchsdomains-hat/"
  fr: "https://tldlog.com/fr/l/etude-icann-revele-noms-domaine-lies-domaines-malveillants/"
  it: "https://tldlog.com/it/l/studio-icann-rileva-che-oltre-1-2-nomi-dominio-segnalati/"
  pt-BR: "https://tldlog.com/pt/l/estudo-icann-revela-que-mais-metade-dominios-abusivos/"
  ru: "https://tldlog.com/ru/l/issledovanie-icann-bolee-poloviny-vredonosnykh-domenov/"
  zh-Hans: "https://tldlog.com/zh/l/icann-guanlian-yuming-yanjiu/"
source:
  name: "domainbrief.de"
  url: "https://domainbrief.de/artikel/mehr-als-die-haelfte-der-gemeldeten-missbrauchsdomains-ist-mit-anderen-domains-v"
  language: "de-DE"
  date: "2026-10-12T06:00:00Z"
---

# ICANN study finds over half of flagged abusive domains have linked domains

## in plain words

ICANN technical staff studied domains reported for scams, phishing or malware and checked public clues like who registered them, which servers they used, and when. More than half of the bad domains turned out to be linked to other domains registered around the same time. But the method mostly found these connections only after blocklists already had, not before, mainly because registry data often arrived too slowly.

ICANN’s Office of the Chief Technology Officer published a report on October 6, dated September 18 and written by four staff members, examining whether domains reported as malicious are connected to other domains. The work feeds into an ongoing GNSO policy effort on combating DNS abuse, whose working group has proposed that registrars check for related domains after confirming an abuse case, using customer and account data. The ICANN report instead relied only on public technical signals: registrar, nameservers, registration timing and IP addresses, without any owner or payment information.

Researchers started from newly registered gTLD domains that landed on blocklists such as Spamhaus or PhishTank by late September 2025, when roughly 4,000 domains were being added daily. They applied three methods: two looked for domains registered with the same registrar and nameservers within a short window of each other, the tightest requiring registration within five seconds; a third looked for domains sharing the same IP address and nameserver combination on the same day, later filtered for similar-looking names.

At least one linked domain was found for 56.4% of reported domains overall, rising to 57% for phishing cases and 43% for malware and botnets combined, though those samples were small. The method identified only 4.6% of linked domains before they appeared on blocklists, a gap attributed to registries at the time submitting registration data to ICANN only weekly. A model suggested that data delivered within 30 minutes could raise early detection to 10%; the latest registry agreement now requires at least daily data delivery.

The tightest method found an average of 2.32 additional domains per reported domain, though much of this came from a single campaign generating algorithmically produced six-character names under one extension, with batches exceeding 6,000 domains; excluding it sharply reduced the counts.

Source: [domainbrief.de](https://domainbrief.de/artikel/mehr-als-die-haelfte-der-gemeldeten-missbrauchsdomains-ist-mit-anderen-domains-v)

## also covered by

- [icann.org](https://www.icann.org/en/announcements/details/new-icann-report-introduces-a-method-for-associated-domain-detection-06-10-2026-en) (in English)