Most discussions about domain abuse begin after something has already gone wrong. A phishing page has been detected, a domain appears on a blocklist, an abuse report has been filed, or a security provider adds another domain to its dataset.
Earlier this year, when I wrote about why malicious-domain statistics can be difficult to compare, I was looking at that part of the problem: what exactly are we counting once suspicious or malicious domains have been identified?
There is another part that happens earlier.
Before a domain can appear in a phishing feed or on a blocklist, somebody has to register it. That transaction takes place in a competitive market, with different prices, discounts, APIs, bundled services, verification requirements, and registration policies.
ICANN’s INFERMAL project provides one of the more detailed attempts to measure whether those conditions are associated with where malicious registrations concentrate. Its phishing-focused analysis found that domains used for phishing were registered at an average price of $4.71, compared with $8.62 for safe domains.
The difference is large enough to make price worth looking at, but price alone does not explain the story.
Small Price Differences Become Large Numbers
For a company registering its primary domain, the difference between paying $5 and $9 is unlikely to determine the entire decision. The domain may be used for years, and the registration fee will eventually become a very small part of what the business invests in it.
The calculation changes when domains are purchased in volume.
INFERMAL found that a one-dollar decrease in the regular registration price was associated with a 6.6% increase in malicious registrations. Separately, a one-dollar registration discount was associated with a 49% increase.
Those are statistical associations from a model focused on phishing, not evidence that reducing a price by one dollar will directly produce a specific amount of abuse. What they do show is that relatively small differences in unit cost can matter in a market where the same purchase is repeated many times.
One dollar across 10,000 registrations is $10,000.
For a legitimate business registering one or a handful of domains, that calculation is mostly irrelevant. For an operation in which domains are part of the infrastructure and are expected to be replaced, it becomes much more important.
Promotional pricing is particularly interesting in this context. A registrar may use a low first-year price to acquire customers it expects to retain for many years. A customer who never intends to renew the domain sees the same promotion very differently.
The offer has not changed. The economics behind using it have.
Automation Is Not the Problem by Itself
INFERMAL also found a strong association between malicious registrations and registrar API access, particularly when automation could be combined with low-cost registrations and repeated access to promotional offers.
This is where I think the context matters even more.
I have spent much of my career building APIs, so I would be very reluctant to treat automation itself as a security problem. APIs exist because doing the same work manually thousands of times makes little sense. Hosting companies, resellers, SaaS platforms, registrars, portfolio owners, and developers all depend on automation for perfectly legitimate reasons.
WhoAPI is built around the same basic idea on the data side: software should be able to query domain information without requiring someone to perform every lookup manually.
Automation changes scale. It does not determine intent.
The relevant question is what surrounds that automation. Who receives unrestricted access? How are accounts created and verified? Can promotional pricing be repeatedly accessed through multiple accounts? What happens when unusual registration patterns begin to appear?
We have already looked at how registration rules differ across the domain system. Some TLDs restrict eligibility, reserve particular names, or impose additional requirements before a domain can be registered.
Registrar-level controls add another layer. Verification, payment requirements, account controls, API access, and registration limits all affect how much friction exists between wanting a domain and acquiring one at scale.
The difficult part is maintaining enough friction to make abuse harder without making legitimate automation unnecessarily difficult.
Abuse Does Not Spread Evenly Across the Market
If low prices or APIs alone explained domain abuse, we would expect providers offering similar services to produce relatively similar outcomes.
They do not.
Interisle Consulting Group analyzed nearly 85 million gTLD domains registered during 2025 and found that 8.5 million had appeared on blocklists by mid-May 2026. More important for this discussion, five registrars accounted for half of all blocklisted gTLD domains created during the year.
At some registrars and registries, more than half of new registrations were eventually blocklisted, while other providers managed to grow without attracting anything close to the same concentration of abuse.
That difference is important.
It suggests that the economics of abuse cannot be reduced to a price list. The same market also includes verification practices, payment methods, promotions, account controls, monitoring, registrar relationships, and decisions about how quickly providers respond when suspicious patterns become visible.
Spamhaus’ latest Domain Reputation Update provides another view of the scale involved. It reported 57.1 million newly observed domains between April and September 2026, 21.8% more than during the previous six months, while malicious and suspicious domain listings increased to 3.37 million.
I would not turn those two figures into an abuse rate. As we discussed in The Trouble With Counting Malicious Domains , registration counts, blocklist counts, and maliciously registered domains are not interchangeable measurements.
But at this scale, even small differences in which registration models attract abusive demand can translate into very large numbers of domains.
The Next gTLD Round Adds Another Reason to Watch This
This becomes especially interesting after ICANN’s 2026 New gTLD Reveal Day.
In our recent analysis of the 1,615 applications in the new gTLD round, the main point was that the application count hides very different businesses. Some applicants are building large registry portfolios, 333 applications are for brand TLDs, and others may eventually operate open namespaces selling domains to the public.
For those open TLDs, the string itself will only be one part of the business.
Pricing will matter. Registrar distribution will matter. Promotions will matter. So will automation, verification, and the policies that determine what happens when abuse begins to concentrate.
Interisle’s research is useful here because it also shows that high levels of malicious registration are not an unavoidable consequence of growth. Some providers have expanded without attracting the same levels of abuse as others.
That means a successful namespace and a high-abuse namespace are not necessarily two sides of the same growth strategy.
Today, most attention around the new gTLD round is naturally focused on strings, contention, applicants, and which proposed extensions may eventually reach the DNS.
Once those TLDs begin operating, another set of questions will become more important: how they are priced, how they are distributed, how easily registrations can be automated, and what kind of demand those choices attract.
Conclusion
Domain abuse is usually treated as a security problem, and ultimately it is one. But before the phishing page, the blocklist entry, or the abuse report, there is usually a much more ordinary transaction.
Someone registers a domain.
Low prices, discounts, APIs, and automation all have legitimate roles in a competitive domain market. They make domains easier to access, lower costs for businesses and developers, and allow services to operate efficiently at a scale that would otherwise be impossible.
The recent research does not make those features inherently problematic. What it shows is that they can have different effects depending on how they are combined and who is using them.
A few dollars make little difference when a business is choosing one domain it expects to keep for a decade. They look different when the purchase is repeated thousands of times. An API saves legitimate businesses from repetitive work, but it can remove the same friction for someone building phishing infrastructure.
After working with domains for many years, I find that distinction more useful than trying to identify a single feature responsible for abuse. Price matters, but not by itself. Automation matters, but not by itself. Registration policies matter, but their effect depends on the rest of the market around them.
We usually measure domain abuse after registration.
Some of the conditions that influence where it concentrates are established much earlier, at the point where the domain is sold.
