Summary

  • Carlos Gañán separated two questions a single DNS-abuse rate often fuses: whether a gTLD-month records any malicious registration, and how large the campaign becomes after one appears.
  • In the RIPE 93 presentation, Category 1 names scored worse on occurrence but better on conditional scale; the combined model estimated 37% fewer maliciously registered domains per gTLD-month.

Analysis

The rate hides what happened next

A monthly abuse rate can make a policy look clean or useless while hiding what happened after the first malicious registration. Carlos Gañán, a Principal Security, Stability and Resiliency Scientist at ICANN, put Category 1 safeguards through two separate tests at RIPE 93: did abuse show up at all, and how far did it spread once it did?

That split changes the answer. Gañán’s presentation reported that Category 1 gTLDs had a 3.1 percentage-point higher modeled probability of recording at least one maliciously registered domain in a month. On the second measure, expected abuse scale was 38% lower once abuse occurred. Combining the two parts, his model estimated 37% fewer maliciously registered domains per gTLD-month overall.

Those figures track different stages. A safeguarded namespace can have more months with at least one recorded domain while carrying smaller campaigns in the months where abuse appears. A single count cannot show both.

Why the model needed two hurdles

The study tracked 1,106 new gTLDs across monthly observations from 2023 through 2025. Gañán said the analysis accounted for namespace size, registry architecture and shared monthly conditions. It counted maliciously registered domains in the study’s DNS-abuse scope; compromised domains and country-code TLDs were excluded because those safeguards were not designed to govern them.

Category 1 spans two registration settings. Gañán compared the more open, self-certified Level 3 group with the restricted Level 8 group. ICANN’s 2014 framework assigns safeguards 1–3 to open-entry strings and 1–8 to highly regulated, closed-entry strings. Safeguard 6 puts a registrant’s representation that it holds the relevant authorisations, licences or credentials into the registration terms. Safeguard 7 calls for registry operators to consult relevant authorities when a complaint questions those credentials; safeguard 8 requires registrants to report material changes to their validity.

The talk reported lower occurrence, conditional scale and total volume for Level 8 than for Level 3.

The effect varied by year and abuse type: phishing showed the clearest difference, malware a smaller one, and botnet command-and-control domains no statistically significant effect in a sparse sample. The observational study did not separate credential checks, rejected applications and complaint handling, or track removal times. Registry records linking those steps to the outcomes would show where the difference arose.

The three estimates belong on one line: 3.1 points more monthly occurrence, 38% smaller campaigns when abuse appeared, and 37% fewer maliciously registered domains per gTLD-month overall. That split puts registration access and containment on separate ledgers, where a single headline rate keeps hiding one of them.

Sources

RIPE 93 session and abstract; official plenary transcript; ICANN Category 1 safeguards; adopted 2014 Category 1 implementation framework; ICANN profile for Carlos Hernandez Ganan; RIPE 93 speaker portrait.