Malicious Actors Accounted for as much as 20% of New Domain Name Registrations in 2025

Greg Aaron, Colin Strutt, and Karen Rose

A new analysis by Interisle Consulting Group finds that cybercriminals registered a significant share of new domain name registrations in 2025, representing a substantial percentage of the generic Top-Level Domain (gTLD) market.

The study establishes that malicious actors purchased at least 10 percent of all newly registered gTLD domains in 2025, with projections indicating that the actual share may be closer to 20 percent.

In 2025, nearly 85 million gTLD domains were newly registered. As of mid-May 2026, 8.5 million of those domains — 10 percent — had been added to blocklists for malicious activity. Applying conservative projections for additional future blocklisting and associated domains registered by criminals not identified by blocklists, the study estimates that bad actors may have purchased 16.8 million domains, or 20 percent of gTLD registrations.

The full study, Malicious Registrations in the Domain Name Market, is available at https://interisle.net/cybercriminaldomaindemand