Interisle finds cheap, bulk-registered and free-subdomain domains favored by cybercriminals
in plain words
Interisle, a security company, published its yearly report on crime linked to internet domain names. It found that cheap domain names, many registered at once, and free subdomains are often used by criminals. New domain endings made up far more of the criminal domains than their share of all registrations.
Full summary
Security firm Interisle has released its annual Cybercrime Supply Chain 2026 report, which looks at how different layers of the internet contribute to cybercrime. The report follows the themes of earlier years and links cheap domains, bulk registration Obtaining the right to use a domain name for a set period. Full definition of registration and free subdomain A name created under a registered domain, like shop.example.com. Full definition of subdomain with higher levels of criminal activity.
Interisle calculates that new top-level domains account for 15% of registered domains but 52% of maliciously registered domain name A readable internet name made of labels separated by dots. Full definition of domain name. Country-code domains, by contrast, make up 34% of registrations and 16% of malicious ones. The report notes that cybercrime data varies widely depending on which blocklist A published list of domains or IP addresses to block for spam, phishing or malware. Full definition of blocklist is used, but says the finding is not surprising, since new extensions often have cheap first-year registrations while country-code domains generally cost more and have stricter registration requirements.
Interisle’s Cybercrime Score, a per-capita measure, gives .qpon, .help and .xin the highest scores, and all of those domains are priced cheaply. The report also singles out .top as having the most reported cybercrime domains after .com.
The report finds that bulk-registered domains are often used for crime. ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN has been investigating this issue. Free subdomains also remain popular with cybercriminals, and the report notes that Cloudflare subdomains such as pages.dev and workers.dev are frequently used.