AIBRIEF
Industry study submitted to ICANN's chair on 26 June puts the blocklist floor at 10% and names five registrars holding half the problem.
Roughly one in five new generic top-level domain registrations in 2025, about 16.8 million of 85 million, were likely purchased by cybercriminals, per a June 2026 Interisle Consulting Group study delivered to ICANN Chair Tripti Sinha on 26 June.
That 20% is a projection. The observed floor sits lower: 8.5 million of the 2025 cohort, or 10%, had been added to third-party blocklists for malicious activity as of mid-May 2026, according to the full report. Interisle layers cybercriminal-demand signals on top of the blocklist data to reach 20%, a proxy rather than a confirmed-scam count. Blocklists can flag legitimate domains and miss others, so the true number lies between the 10% floor and the 20% projection.
The abuse is not spread evenly. Five registrars accounted for 50% of all blocklisted domains, the report's executive summary says, and the problem clusters at specific registries, registrars, and corporate families rather than across the domain-name system as a whole. ICANN, the nonprofit that coordinates the internet's address book, has discussed new-gTLD abuse for years without resolving the concentration. Its in-house research team contributed to the methodology behind the latest numbers.
The submission now puts the freshest measurement of that concentration directly in front of the regulator that oversees the registries and registrars behind it.