The Dark Side of Innovation: Why Cybercriminals Target New Domain Extensions

The Weaponization of the Domain Space

A .com domain costs somewhere around $12 a year. A .top on promotion costs less than a dollar. That single price difference explains more about modern phishing infrastructure than any amount of analysis of the phishing kits themselves, because it changes the economics of a domain that is going to be blocklisted within 48 hours from a real cost into a rounding error.

The expansion of the namespace was meant to open the web up — dedicated space for brands, communities, and creators, rather than an endless scramble for whatever .com remained. When ICANN began releasing new generic Top-Level Domains (gTLDs) such as .shop, .top, .xyz, and .zip, the framing was innovation and choice.

What arrived alongside it was a supply of cheap, disposable, minimally-verified identity. Phishing campaigns, malvertising redirect chains, and command-and-control infrastructure all need domains they can burn, and the new gTLD market supplies them at volume.

Why New gTLDs Attract Cybercriminals

The imbalance shows up consistently across threat intelligence reporting: new gTLDs represent a small share of total registrations while accounting for a disproportionate share of domains reported for abuse — commonly cited figures put them near 11% of registrations against over 37% of reported malicious domains. Exact percentages move between vendors and quarters, and they depend heavily on whose reporting pipeline is doing the counting. The direction of the gap is the stable finding, not the decimal.

Four things drive it, and none of them are accidental.

1. Rock-Bottom Registration Costs

Bulk phishing is a volume business, and the operators plan for their domains to be dead inside 24 to 72 hours. At .com prices, the domain is a real line item against campaign yield.

Registry promotions routinely drop .xyz, .top, or .work below a dollar. At that price a thousand domains costs less than a hundred traditional ones, and takedown stops being a deterrent — it becomes an operating expense the attacker has already budgeted for. This is the part defenders tend to underestimate: a takedown that feels like a win on your side is, on theirs, a scheduled rotation.

2. Frictionless Registration and Lack of Verification

ICANN requires registrant contact verification, but enforcement across the registrar market is uneven. Budget registrars compete on automation, and automated bulk registration APIs with thin validation are a selling point for legitimate resellers as much as for abusers. Stolen cards, cryptocurrency payment, and fabricated registrant details do the rest. The absence of real KYC at the registrar tier is not an oversight — meaningful identity checks add friction and cost in a market where margin per domain is measured in cents.

3. Evading Legacy Security Filters

Reputation-based filtering has a structural gap: a domain registered ten minutes ago has no reputation. Most gateways treat “unclassified” as allow, because blocking it breaks legitimate business traffic against newly launched sites and generates a helpdesk queue.

That gap between registration and classification is the golden window, and campaigns are timed to fit inside it. The defensive answer — treating newly registered domains as suspicious by default — is covered below, and it comes with its own cost.

4. Typosquatting and Pretexting Availability

The legacy namespace is saturated; the new one is wide open. Rather than fighting for a plausible .com, an attacker registers brandname-support.shop, brandname-security.xyz, or brandname-update.top outright — no typo required, because the brand string itself is available.

This works because of how people actually read URLs. Users scan left to right, recognise the brand, and stop. Recognition of the brand string satisfies the check before the TLD is ever evaluated, and with several hundred TLDs now in circulation, most users have no baseline for which ones are unusual.

[!WARNING]

Case Study: The Release of .zip and .mov Domains (2023)

In May 2023, Google Registry released several new gTLDs, including .zip and .mov — strings that had been common file extensions for thirty years before they were also hostnames. The collision was the entire problem.

• The Attack Vector: An attacker could craft a link like https://github.com∕kubernetes∕archive∕refs∕tags@v1.27.2.zip. Everything before the @ is treated as URL user-info and ignored by the browser, so the victim is actually connected to the host v1.27.2.zip — an attacker-controlled domain — even though the link appears to point at GitHub. Unicode look-alike slashes (∕, U+2215) replace the real / characters to make the fake path convincing.
• File Handler Abuse: In some operating systems, typing local file paths ending in .zip into search bars or file managers could prompt the OS to perform a DNS query and attempt to open the remote website, providing a vector for drive-by downloads.
• Defensive Response: Many corporate security teams simply blocked .zip and .mov at the secure web gateway. Blunt, effective, and cheap — the cost being that any legitimate business eventually built on those TLDs is unreachable from a large fraction of corporate networks, with no feedback loop telling anyone why.

Subdomains: The Shared Reputation Threat

Cheap gTLDs are one supply line. Free subdomains on high-reputation platforms — blogspot.com, weebly.com, Cloudflare Pages (pages.dev) — are the other, and they are harder to deal with, because the thing making them dangerous is that they are genuinely legitimate.

• Reputation Hijacking: pages.dev carries an excellent reputation, earned by thousands of real deployments. Block the apex and you break all of them. That constraint is well understood by attackers, which is why the landing page goes on a free subdomain: it forces your controls down to per-URL inspection, and any tool in your stack that only evaluates registrable domains is now blind by design rather than by misconfiguration.
• Subdomain Takeover: Delete an S3 bucket, an Azure App Service, or a GitHub Pages site, and forget the CNAME still pointing at it, and you have a dangling record. Attackers scan for exactly this at internet scale, claim the freed resource name on the platform, and inherit a subdomain that is legitimately yours — with valid TLS, since the certificate authority will happily validate a host the attacker now controls. Phishing from careers.yourcompany.com defeats every user-education message you have ever sent about checking the domain.

The Regulatory Dilemma: ICANN and the Industry

ICANN oversees the namespace, and the standing criticism is that its policy posture is too permissive relative to the abuse evidence. Further expansion rounds continue to be planned while abuse concentration in existing new gTLDs remains well documented.

The structural problem is an incentive one rather than a malicious one. Registries and registrars earn on registration volume. Every control that would reduce abuse — identity verification, rate limits on bulk registration, holding periods on promotional pricing — reduces volume, and the cost lands on the party implementing it while the benefit lands on everyone else. That is a textbook collective action problem, and it does not resolve on its own.

John Levine, a long-standing voice in internet governance and email security, put it more directly: “ICANN needs to decide whether it’s a neutral regulator or just a domain speculator trade association.” Until ICANN mandates strict KYC regulations and faster registrar response times, the security community will remain on the defensive.

Defensive Playbook: Enterprise Mitigation Strategies

No single control handles this. The four below stack, and the ordering matters — the third is the only one that survives a user who does everything wrong.

1. Implement Newly Registered Domain (NRD) Restrictions

Configure the Secure Web Gateway or DNS firewall to block resolution for domains registered within the last 15 to 30 days. Because malicious domains are typically weaponised within hours of registration and abandoned within a week, an NRD policy removes a large share of zero-hour phishing without needing to know anything about the specific campaign.

It will also block legitimate things, and you should expect that before you turn it on. New vendor portals, marketing microsites for a launch your own company is running, and freshly migrated partner domains all trip it. Ship an exception path that a service desk can action in minutes, or the policy will be switched off after the first executive complaint rather than tuned.

2. Block High-Abuse gTLDs

Pull 30 days of outbound DNS and sort by TLD. Most organisations find that .top, .work, .click, .rest and similar carry no business traffic at all, at which point blocking them at the resolver costs nothing and removes a standing category of risk. Measure first — a blocklist copied from a blog post is how you discover that a supplier in another market uses a ccTLD you assumed was noise.

3. Transition to FIDO2/WebAuthn Authentication

This is the control that makes the rest into defence in depth rather than a single line. SMS codes, push approvals, and TOTP are all relayable through reverse-proxy phishing frameworks such as Evilginx — the user authenticates correctly, and the attacker captures the resulting session.

FIDO2 breaks that mechanically. The credential is bound to the origin during registration, so a browser on microsoft-login.xyz will not produce an assertion for login.microsoftonline.com. The user can be entirely fooled and the authentication still fails. That is the property worth paying for, and the price is real: hardware keys cost money, enrolment is an operational project, and you need a recovery path for lost keys that is not itself a phishable helpdesk call.

4. Continuous DNS Auditing

Scan your own zones for dangling CNAMEs on a schedule and remove them. This closes subdomain takeover, and it is worth automating specifically because the records are created by the same teams who are decommissioning something and consider the job finished — the DNS entry outlives the resource, and nothing errors. Silent failure, indefinitely, until someone else finds it.

Protecting Your Own Brand and Domains

Everything above defends your users from other people’s domains. The mirror image is stopping attackers using your brand against everyone else — customers, suppliers, and your own staff — across a namespace where the raw material costs a dollar.

1. Lock Your Registrations

Set Registrar Lock (clientTransferProhibited, clientUpdateProhibited) on every corporate domain. For anything genuinely load-bearing, pay for Registry Lock: a manual out-of-band verification at the registry tier that holds even when the registrar account itself is compromised. Domain hijacking is rare and catastrophic — losing control of the apex takes down mail, SSO, and every service behind it simultaneously.

Pair it with MFA on the registrar portal and a monitored role-based admin address. The classic failure is an expiry notice going to a personal inbox belonging to someone who left in 2021.

2. Enforce Email Authentication (SPF, DKIM, DMARC, BIMI)

Look-alike domains exist mainly to send mail as you. A DMARC policy at p=reject, aligned with SPF and DKIM, makes receivers discard anything that cannot prove origin. BIMI on top puts a verified logo in supporting inboxes — a positive trust signal a brandname-support.shop spoof cannot reproduce.

Get to p=reject via p=none and then p=quarantine, reading the aggregate reports at each stage. Going straight to reject is how you discover, in production, that your billing system, your CRM, and a regional office have all been sending legitimate mail on your behalf through paths you never enumerated.

3. Monitor the Namespace for Impersonation

You cannot act on what you never see. Run typosquat and look-alike discovery on a schedule with dnstwist or urlcrazy, and monitor Certificate Transparency logs for newly issued certificates containing your brand string.

CT monitoring is the highest-value item in this section. A certificate issued for brandname-secure.xyz typically appears in the logs while the phishing site is still being built — hours to days before the first email goes out. That gap is the only point in the timeline where you get to act before your customers do.

4. Harden Your Own DNS

DNSSEC signs your zone against response forgery and cache poisoning. Be clear-eyed about it: DNSSEC is unforgiving, and a botched key rollover takes your domain off the internet entirely for the duration of the TTL. It belongs on a managed provider that handles rollover for you unless you have someone who genuinely owns it.

CAA records are the cheap win in the same area — a few lines that constrain which certificate authorities may issue for your domains, narrowing the mis-issuance surface with essentially no operational risk.

5. Defensive Registrations and Takedown Readiness

Pre-register the highest-risk permutations of your brand on the cheapest abused gTLDs so nobody else does. Accept that this does not scale: with hundreds of TLDs and unbounded permutations, defensive registration covers the obvious dozen and nothing more. It buys you the cases an unimaginative attacker would try first.

Which is why the takedown workflow matters more. Have the abuse contacts, registrar escalation paths, hosting-provider report forms, and your own evidence template written down before the incident. During one, the difference between a live phishing site lasting four hours and lasting four days is almost never technical — it is whether someone had to work out who to email.

Final Thoughts

None of this gets solved at the policy layer any time soon. The incentives that make cheap domains profitable for registries are the same ones that make them cheap for attackers, and no amount of reporting shifts that from the outside.

So the practical position is to assume abundant, disposable, cheap adversary infrastructure and build accordingly: NRD restrictions to close the classification window, resolver-level blocks on TLDs your business demonstrably never touches, CT monitoring so impersonation surfaces early, and origin-bound authentication so that when a user does click — and one will — the credential simply cannot be replayed. That last one is the only control on this page that does not depend on the user getting anything right.

For more insights into threat mitigation and network security, visit rokibulroni.com.