Interisle-Malicious-Registrations-in-the-Domain-Name-Market-2026.md

**Executive Summary:** Interisle’s analysis finds that malicious actors purchased a substantial share of new gTLD registrations in 2025 (a conservative floor of ~8.5M blocklisted domains, projected to 10.1M–16.8M with associated domains), with abuse concentrated in a small set of gTLDs, registrars, and registry families; case studies (e.g., FUNNULL, Revolver Rabbit) demonstrate large-scale, algorithmic batch registrations used for phishing, malware/infostealer distribution, and fraud, while low renewal rates and market incentives (bulk discounts, low prices) enable sustained criminal supply of disposable domains.