---
id: "3e5cccc8-2c80-4c4e-9db1-400242d32780"
kind: "link"
title: "Interisle finds cheap, bulk-registered and free-subdomain domains favored by cybercriminals"
language: "en"
section: "security"
date: "2026-10-20T17:28:51Z"
updated: "2026-10-21T10:53:03Z"
canonical: "https://tldlog.com/l/interisle-finds-cheap-bulk-registered-free-subdomain-domains/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/interisle-halla-que-dominios-baratos-registrados-masa/"
  de: "https://tldlog.com/de/l/interisle-stellt-fest-guenstige-massenhaft-registrierte/"
  fr: "https://tldlog.com/fr/l/interisle-domaines-bon-marche-enregistres-masse-sous/"
  it: "https://tldlog.com/it/l/interisle-trova-domini-economici-registrati-blocco/"
  pt-BR: "https://tldlog.com/pt/l/interisle-aponta-que-dominios-baratos-registrados-massa/"
  ru: "https://tldlog.com/ru/l/interisle-deshevye-domeny-massovoy-registratsiey-besplatnye/"
  zh-Hans: "https://tldlog.com/zh/l/interisle-lianjia-yuming-fanzui/"
source:
  name: "Domain Name Wire"
  url: "https://domainnamewire.com/2026/10/20/report-cheap-domains-bulk-registrations-subdomains-favored-among-cybercriminals/"
  language: "en-US"
  date: "2026-10-20T15:58:32Z"
---

# Interisle finds cheap, bulk-registered and free-subdomain domains favored by cybercriminals

## in plain words

Interisle, a security company, published its yearly report on crime linked to internet domain names. It found that cheap domain names, many registered at once, and free subdomains are often used by criminals. New domain endings made up far more of the criminal domains than their share of all registrations.

Security firm Interisle has released its annual Cybercrime Supply Chain 2026 report, which looks at how different layers of the internet contribute to cybercrime. The report follows the themes of earlier years and links cheap domains, bulk registrations and free subdomains with higher levels of criminal activity.

Interisle calculates that new top-level domains account for 15% of registered domains but 52% of maliciously registered domain names. Country-code domains, by contrast, make up 34% of registrations and 16% of malicious ones. The report notes that cybercrime data varies widely depending on which blocklist is used, but says the finding is not surprising, since new extensions often have cheap first-year registrations while country-code domains generally cost more and have stricter registration requirements.

Interisle’s Cybercrime Score, a per-capita measure, gives .qpon, .help and .xin the highest scores, and all of those domains are priced cheaply. The report also singles out .top as having the most reported cybercrime domains after .com.

The report finds that bulk-registered domains are often used for crime. ICANN has been investigating this issue. Free subdomains also remain popular with cybercriminals, and the report notes that Cloudflare subdomains such as pages.dev and workers.dev are frequently used.

Source: [Domain Name Wire](https://domainnamewire.com/2026/10/20/report-cheap-domains-bulk-registrations-subdomains-favored-among-cybercriminals/)

## also covered by

- [Domain Brief](https://domainbrief.de/artikel/neue-gtlds-stellen-15-prozent-der-domains-und-43-prozent-der-fuer-angriffe-gemel) (in German)