ICANN DAAR Threat & Domain Abuse Index

Comprehensive security risk benchmarking compiled from ICANN Domain Abuse Activity Reporting (DAAR) telemetry, Spamhaus, SURBL, and registry compliance filings. Evaluates threat concentrations across phishing, malware, spam, and botnet command-and-control infrastructure per 10,000 active domain registrations.

Analyzed Registrations 264,912,600 Contracted & ccTLD zones

Total Active Threats 819,088 Verified malicious domains

Benchmark Abuse Rate 30.9 Threats per 10k domains

Clean Tier Registries 5 Sub-10 incidents per 10k

How ICANN DAAR and Specification 11(b) Regulate Registry Abuse

The Internet Corporation for Assigned Names and Numbers (ICANN) operates the Domain Abuse Activity Reporting (DAAR) system to monitor four core security threats across generic top-level domains: Phishing, Malware, Spam, and Botnet Command-and-Control. Under Registry Agreement Specification 11(b), contracted registry operators are legally required to conduct periodic technical audits and take immediate mitigation steps against abusive domains.

Registries with low retail price barriers (sub-$1 promotions) historically experience higher concentrations of automated spam campaigns, whereas extensions enforcing mandatory HSTS (.app, .dev) or restricted verification (.bank, .gov) maintain near-zero abuse levels.

Showing 25 registries

TLD	Risk Tier	Abuse Rate (per 10k)	Total Domains	Phishing	Malware	Spam	Botnets	Primary Threat Vector	Mitigation Policy
.com	Low Risk	13.3	160,800,000	68,420	22,150	114,500	9,340	Spam and Credential Phishing	Verisign Anti-Abuse API, 24/7 law enforcement coordination, automated registrar alert notifications
.net	Low Risk	13.1	12,900,000	5,120	1,840	9,200	710	Spam	Verisign Anti-Abuse Rapid Takedown, automated zone monitoring
.org	Clean	8.0	10,950,000	2,840	910	4,650	380	Targeted Phishing	PIR Quality Performance Index (QPI), registrar sanctions, proactive suspension of DNS abuse
.top	High Risk	403.5	3,450,000	24,300	12,800	95,400	6,700	Bulk Spam & Fast-Flux Malware	Reactive post-complaint review, notice-and-takedown upon verification
.xyz	Elevated	76.1	4,120,000	7,920	3,100	18,900	1,450	Spam and Cryptojacking Lures	Proactive machine-learning registration screening, zero-tolerance phishing takedown
.online	Moderate	59.3	2,650,000	3,840	1,420	9,850	610	Spam and Lures	Radix Abuse Remediation Engine, automated bulk registration throttling
.site	Elevated	89.3	1,980,000	4,120	1,580	11,200	780	Spam	Radix automated reputation checks, Registrar compliance alerts
.info	Moderate	45.3	3,780,000	4,200	1,650	10,400	890	Spam and Phishing	Identity Digital Domain Abuse Detection System (DADS), real-time DNS blocklisting
.biz	Moderate	51.3	1,320,000	1,560	620	4,300	290	Spam	GoDaddy Registry Threat Intelligence, automated abuse triage
.app	Clean	5.1	890,000	180	45	210	15	Targeted Phishing (Low Volume)	Mandatory HSTS preload, enforced HTTPS on all hostnames, automated threat scans
.dev	Clean	5.4	540,000	110	30	140	12	Developer-targeted phishing	Mandatory HSTS preload, Google Safe Browsing telemetry, zero spam tolerance
.bank	Clean	0.0	3,200	0	0	0	0	None (Gated Financial Registry)	Strict verification of banking charters, mandatory DNSSEC, mandatory DMARC, multifactor registry lock
.gov	Clean	1.1	9,400	0	0	1	0	Compromised Subdomain Misuse	US government authorization verification, mandatory DNSSEC, continuous CISA scanning
.de	Low Risk	11.7	17,800,000	5,400	1,950	12,300	1,100	Credential Phishing	DENIC abuse desk, German criminal police direct reporting interface, rapid dispute system
.uk	Low Risk	12.6	10,400,000	3,100	1,200	8,200	650	Phishing	Nominet Domain Watch automated screening, law enforcement expedited suspension scheme
.ru	Elevated	159.3	5,600,000	21,500	16,800	42,000	8,900	Malware Distribution & C2	Russian passport verification requirement, designated competent organization suspensions
.cn	Low Risk	33.3	20,100,000	18,200	9,400	34,100	5,200	Phishing and Financial Fraud	Mandatory real-name verification (ICP filing), biometric ID validation
.shop	Elevated	139.5	1,750,000	5,400	1,300	16,800	920	Counterfeit E-Commerce & Phishing	Brand protection monitoring, fake store detection engine
.store	Elevated	121.6	1,480,000	3,900	980	12,400	710	Fake Stores and Phishing	Radix fraud detection algorithms, merchant authenticity screening
.icu	High Risk	534.1	820,000	7,100	3,400	31,200	2,100	Bulk Spam & Malicious Redirects	ShortDot anti-abuse team, automated IP blocklist integration
.cyou	High Risk	509.2	650,000	4,800	2,200	24,500	1,600	Spam Botnets	Reactive takedowns based on security feed ingest
.bond	High Risk	489.0	310,000	2,100	920	11,400	740	Financial Scams & Spam	Daily feed synchronization with Spamhaus and SURBL
.vip	Elevated	243.5	780,000	2,800	1,100	14,200	890	Investment Scams & Phishing	Registry level blocklists, automated WHOIS verification
.io	Low Risk	37.4	1,350,000	1,420	510	2,800	320	Web3 Phishing & Wallet Drainers	Identity Digital abuse remediation pipeline, developer brand protection
.cloud	Low Risk	39.5	480,000	420	180	1,200	95	Hosting Lures and Phishing	Proactive abuse monitoring, strict registrar vetting

Methodology and Data Collection Pipeline

The DAAR Threat and Domain Abuse Index aggregates indicators of compromise from reputable security research organizations, including the Anti-Phishing Working Group (APWG), Spamhaus Composite Blocking List (CBL), SURBL, and the Malware Patrol project. All registration counts are normalized against audited monthly registry transaction reports submitted to ICANN.

Abuse scores reflect the number of unique abusive domain names active in a 30-day reporting window divided by every 10,000 active registrations in the zone file. Country-code domains (ccTLDs) are evaluated under equivalent criteria using public zone and registrar telemetry.