Skip to main content
EN
ENDEESFRRUITJAPT-BRHIVIIDTRARUKKOZH

OSINT investigation · The domain economy

The Illusion of Control: How ICANN is Bankrolling Global Cybercrime

An OSINT investigation into the fee-driven incentive structure of the domain industry.

  • 7.9M active domains
  • 7 abuse-heavy TLDs
  • A gross-fee / revenue-exposure model
See the numbers DestroyList Methodology
7,945,325
Active Domains In Scope (7 TLDs)
7,701
High-Confidence Abuse Leads
$0.27
Registry-Side Fee / Domain (model)
~$2.16M
Registry-Side Fee Intake / Year (model)

01Conflict of interest

The Conflict of Interest At The Center Of The Internet

ICANN presents itself as the supreme, independent regulator of the global domain market. It writes the rules, accredits the registrars, signs the contracts with the registries, and is supposed to police abuse across the entire namespace.

There is one detail that quietly breaks this picture: ICANN is paid by the very market it is supposed to police. Every domain that gets registered sends money upstream to ICANN. Imagine, for a moment, if the SEC literally owned a stake in Binance and collected a fee on every trade. That is the structural position the domain industry has built for itself.

The mechanics are not hidden. Launching a new top-level domain zone requires an application fee of $227,000. Once a zone is live, the registry pays an annual fee of $25,800. And once a zone crosses 50,000 registered domains, ICANN collects roughly $0.25 for every registered domain. The incentive this creates is plain: the more domains exist, the more money flows, whether those domains host a hospital or a wallet drainer.

What a zone sends upstream

application fee

$227,000

to launch a zone

annual registry fee

$25,800

every year, per live zone

after 50,000 domains

$0.25

per registered domain

02Scale

The Scale: One Year, Less Than 10% Covered

On July 5th, the PhishDestroy public database (DestroyList) (GitLab) turns one year old. It is open, free, and used by researchers, wallets, and security vendors around the world.

In twelve months of continuous work, it has not been able to cover even 10% of the phishing avalanche, because the supply of fresh malicious domains is effectively unlimited at the price point the system is built around. When a domain costs less than a cup of coffee and a regulator profits from each one minted, volume always wins.

DestroyList after twelve months
<10%of the phishing avalanche covered
  • Covered by one year of continuous work
  • Fresh supply the fee structure keeps refilling

03The model

The Numbers: A Fee-Intake Model

Across 7 of the most abuse-heavy new TLDs, our triage identified 7,945,325 active domains. From those domains alone, applying ICANN's own published fee schedule produces the model below.

3,047,348

Domains With IP (38.35%)

4,897,977

Domains Without IP (61.65%)

913,199

Domains With Hostname (11.49%)

7,701

High-Confidence Abuse Leads (0.10%)

Registry side

Registry-Side ICANN Fee Model

Source: ICANN Base Registry Agreement, Article 6.1: registry fixed fee of $6,250 per quarter per TLD, plus a registry transaction fee of $0.25 per annual increment after the 50,000-transaction threshold.

Base modelRegistry-side ICANN fee model
  1. Registry transaction fee7,945,325 × $0.25$1,986,331.25
  2. Registry fixed fee7 TLDs × $25,000/year$175,000.00
  3. Registry-side ICANN fee modeltransaction + fixed$2,161,331.25 / year-model
  4. Registry-side effective fee/domain÷ 7,945,325$0.27

Registrar side

Optional Registrar-Side Pass-Through Model

Source: ICANN Registrar Accreditation Agreement, Section 3.9. Note: the $0.18/domain-year figure is a modeling assumption, not a proven invoice. This layer is presented as a sensitivity scenario only.

Sensitivity onlyRegistrar-side pass-through
  1. Registrar admin model7,945,325 × $0.18$1,430,158.50
  2. Combined variable model7,945,325 × $0.43$3,416,489.75
  3. Combined variable + registry fixed—$3,591,489.75 / year-model
  4. Combined effective fee/domain÷ 7,945,325$0.45

04Seven zones

Breakdown By TLD

The seven zones are not equal. Some are pure volume plays; others concentrate the abuse. The .vip and .icu zones alone account for the overwhelming majority of high-confidence abuse leads.

TLDActive domainsWith IPHigh-conf abuse leadsRegistry-side modelCombined model
.sbs1,900,628632,352243$500,157.00$842,270.04
.vip1,891,8991,235,9094,388$497,974.75$838,516.57
.bond1,333,658104,650134$358,414.50$598,472.94
.cfd936,860402,780242$259,215.00$427,849.80
.icu934,951279,0932,607$258,737.75$427,028.93
.cyou744,378270,49874$211,094.50$345,082.54
.buzz202,951122,06613$75,737.75$112,268.93
TOTAL7,945,3253,047,3487,701$2,161,331.25$3,591,489.75
High-Confidence Abuse Leads By Reason
High-Confidence Abuse Leads By ReasonLeads
punycode_idn6,794
crypto_brand_plus_action_or_auth372
document_or_mail_brand_plus_auth_doc188
finance_brand_plus_auth_payment170
wallet_drainer_lure102
apple_icloud_plus_auth93
social_brand_plus_auth80
brand_auth_random_suffix23
cloudflare_plus_auth3
Leads By TLD
Leads By TLDLeads
.vip4,388
.icu2,607
.sbs243
.cfd242
.bond134
.cyou74
.buzz13
Leads By IP Country
Leads By IP CountryLeads
(blank / unresolved)5,166
US940
HK566
CN375
SG131
MY87
DE78
IN69
JP46
GB40
CA34
BG28

05Compliance

A Precedent Of Inaction

The standard defense is that ICANN has a compliance arm that handles abuse. In practice, the compliance machine is a place where well-documented complaints go to be filed away.

Consider the "Artists vs. NameSilo" ICANN compliance case. A fully substantiated complaint about a registrar's handling of abuse was escalated through the official channel, and ICANN effectively washed its hands of it. The pattern is visible directly in the ICANN compliance dashboard: a steady intake of complaints, closed out as "resolved" with little observable change in registrar behavior.

  1. Complaint ina steady intake of complaints
  2. Closed as "resolved"through the official channel
  3. Behavior unchangedlittle observable change at the registrar
Public record ICANN Compliance Dashboard (04/2026)compliance-reports.icann.org/compliance/dashboard/2026/0426/report.html

06The players

The Players

Registry operator

ShortDot SA: The Volume Engine

  • .icu
  • .bond
  • .cyou
  • .sbs
  • .cfd
  • .qpon
  • .buzz

Several of the zones in this report are operated by ShortDot SA (in which NameSilo reportedly holds a stake of around 11%). The ShortDot portfolio includes .icu, .bond, .cyou, .sbs, .cfd, .qpon and .buzz.

A fair question to put to anyone in the industry: when was the last time you saw a legitimate, well-known white-hat site on any of these extensions? The honest answer, for most people, is "never." These zones live almost entirely in the long tail of throwaway registrations.

Registrar · Belarus

TrustName: Bulletproof By Design

  • Bulletproof DNS
  • 2 days after launch
  • Unreachable by ICANN

Then there is TrustName, a Belarusian company that configured what amounts to bulletproof DNS just two days after launch and has remained effectively unreachable by ICANN ever since. Abuse reports go nowhere; the "regulator" has no working lever to pull.

The most striking part is the geopolitics: sanctions appear to bypass the regulator entirely. An entity that would be off-limits in nearly any other regulated industry continues to operate inside the ICANN ecosystem because the fee keeps arriving and no one is incentivized to cut it off.

Related investigationTrustName: bulletproof DNS configured two days after launch.Read the full TrustName report →

07Coming next

Coming Before July 5th: The One-Year Report

Before the database hits its first birthday, PhishDestroy will publish a one-year report exposing the registrars (including TrustName, NiceNIC, NameSilo and others) that ignored fully justified abuse reports for 300+ days, until the offending domains simply expired on their own.

It will include the original report texts, the follow-ups, and the exact timestamps, which together form a complete paper trail showing precisely how long a documented, actively-malicious domain can keep running while the people paid to police it look the other way.

  1. Day 0Abuse report sentfully justified, with evidence
  2. ThenFollow-upstimestamped, on the record
  3. Day 300+Still onlinenobody paid to police it acts
  4. FinallyDomain expireson its own, not by enforcement

08Primary sources

Sources

ICANN Base Registry Agreement, Art. 6.1Registry fixed fee + transaction fee schedule used in the registry-side model.itp.cdn.icann.orgICANN RAA, Section 3.9Yearly + variable accreditation fees used in the optional pass-through model.www.icann.orgICANN Compliance Dashboard 04/2026Public record of complaint intake and resolution outcomes.compliance-reports.icann.orgArtists vs. NameSilo Compliance CaseDocumented compliance complaint (UNY-783-11184) and its outcome.blog.aa419.org

09July 5th

The Database Turns One On July 5th

DestroyList is open, free, and built by operators. In a year it has fought to keep up with a flood the fee structure keeps refilling. Use it, mirror it, build on it, and watch for the one-year registrar report dropping before July 5th.

Open The Public Database GitLab Report a Domain More Investigations
  • #ICANN
  • #DomainAbuse
  • #OSINT
  • #PhishingEconomy
  • #RegistryFees

Share this investigation

X/TwitterTelegramReddit

Keep reading

InvestigationThe $155 million illusion: what ICANN does with the moneyDeep investigationTrustName: the bulletproof registrar ICANN can't reachInvestigationNameSilo defended a $100M crypto drainer, then had to defend itselfInvestigationNameSilo, Webnic, NiceNic: registrars enabling scams

Transparency notice. PhishDestroy is a non-commercial, independent project. The financial figures in this report are a transparent fee-intake / revenue-exposure model derived from public ICANN fee schedules — not a measurement of ICANN profit or income. Our research may reflect an inherent bias against scam infrastructure and the services that enable it. We encourage readers to evaluate all material critically and independently. Read our full transparency statement · Blog archive