The Purge of Domain Zones: How It Affects Your Business?

• Oct 25 2023
• by Ilona K.

In the past few years, ICANN has conducted two extensive purges of new top-level domains (nTLDs): the .ICU in 2021 and the .GA in 2023 – and it won’t be the last one. What exactly is a TLD purge, and why should you care as a business owner?

nTLDs are becoming popular again, showing a good performance growth in 2022. They cost less than traditional TLDs and provide more options to get aesthetically pleasing and easy-to-remember domain names. However, they also have their pitfalls, and one of them is large domain zone cleanups, aka TLD purges, initiated by ICANN or the government of the country managing the zone.

What is a TLD purge and why is it necessary?

A purge of TLDs is the removal of millions of domains from use because they have been compromised. This happens because companies, for various reasons, neglect monitoring the “purity” of domain zones. As a result, a huge number of domains end up being used for spam or fraudulent activities.

Let’s see what happened in the .ICU and .GA zones to understand why such domain names appear in large numbers and why eventually a purge is required.

.ICU zone

Several new generic top-level domains that attackers use for criminal purposes appeared after ICANN’s decision to launch the New gTLD programme, allowing an unlimited number of new gTLDs.  

The .ICU was the fifth TLD to appear since the programme started. At first, everything went fine; as of June 2019, there were over 900,000 registered .icu websites across the world. However, in a short timeframe this nTLD has gained unprecedented popularity among scammers. For most of 2019, many users’ incoming mail servers were inundated with spam from thousands of .ICU domains. By December 2019, 6,799 attempts to deliver spam from .ICU domains had been reported.

The situation hasn’t changed, and ICANN started purging the .ICU in 2021. Many .ICU domains were removed from the Domain Name System (DNS) that year, and the renewal rate for this nTLD dropped to only 3%. In comparison to 2,695 create operations in 2020, there were only 457 in 2021.

.GA zone

In June 2023, news appeared that the Government of Gabon was planning to remove up to 7 million malicious names from the .GA domain zone. Freenom, a registrar which allowed free registration of domains in zones it managed, including .GA, has lost its contract with the Government of Gabon to manage the .GA domain as it quickly became a haven for cybercriminals.

Free registration was part of Freenom’s business model. The company hoped to eventually reclaim domains and monetise them after they expired or were suspended due to abuse such as spam and phishing.

Seems like the purge of these domain zones was necessary. The catastrophic dominance of spam and scammers compromised domain zones, and they could no longer perform their functions properly.

What are the consequences?

As the .ICU and .GA zones’ case studies showed, mass purges typically target the so-called penny TLDs. A penny TLD is a TLD that is either free or sold at a very low price. They may also feature a very high creation rate combined with a very low renewal rate. 

These TLDs are popular but unfortunately they pose a significant threat to the sector as they attract many scammers. They serve as tools for distributing spam, phishing, and other illegal activities. Moreover, they introduce a destabilising element into the nTLD market, initially causing  a sharp increase in the number of registered domains and subsequently leading to a reduction after a purge.

As a result, confidence in nTLDs is falling as business people and members of the public are beginning to doubt the reliability of all new TLDs. After all, if a domain zone compromises itself, it will lead to massive purges. These domain zone purges can have serious consequences for businesses and the domain market:

• User trust in these domain zones decreases because they are associated with fraud and spam. This may affect the reputation of companies that use domains in these zones, as well as leading to a decrease in demand for them and a corresponding fall in their value.
• Many domain names become unavailable, which may result in inconvenience and a loss of potential clients for the companies that use them.
• Google can reveal websites with compromised TLDs in its index. Users can’t see websites on this list when they search for them, which means all your website promotion efforts will be in vain.
• Purges require additional efforts on the part of registrars and domain name owners to maintain the security and “cleanliness” of the zone. This may result in additional costs and complexity in managing the domain names ecosystem.

Why should you care about these purges? If your website is hosted in a domain zone subject to a purge, it may have significant implications. 

• Firstly, your website’s reputation may be adversely affected. Users tend to distrust compromised domain zones and they are less likely to visit a website if its domain zone is associated with spam or phishing. 
• Additionally, your website’s visibility on the Google search engine will suffer; Google readily removes compromised domain zones from its index. 
• Finally, if your domain zone undergoes a purge, you’ll likely need to switch to a different one, incurring additional costs for a new domain name, not to mention the accompanying risks.

As purges impact online security, trust, business operations, and company finances, understanding their consequences is vital for anyone involved in the domain industry, from registries to domain name owners.

Is there a solution?

Currently, ICANN is constantly fighting the problem of mass domain zone purges in order to avoid having to impose new ones in the future. The corporation is trying to find a suitable tool that will improve their new gTLD programme.

In April 2023, ICANN announced the start of the INFERMAL (Inferential Analysis of Maliciously Registered Domains) project with the main goal of studying the conditions that facilitate the registration of malicious domains. INFERMAL will be integrated into ICANN’s broader programme to improve DNS security and combat phishing, malware, spam, and other threats.

The results of the project will assist registrars and registries in developing strategies to fight DNS abuse and improve overall security in the domain name industry. In addition, these results may serve as a basis for the development of new ICANN policies, which is especially important in light of the second phase of the new gTLD programme.

Until the tools for combating malicious domain registrations have been perfected, you can turn to other methods that can protect you when choosing a domain zone for your website.

Here are a few of them:

• When choosing domain zones, you should adhere to simple but reasonable principles: research the history of domains; follow news and discussions on forums. Don’t rush to choose the first available domain zone, even if you’re attracted by a price which may seem reasonable.
• Buy domain names from reliable companies. You shouldn’t contact private sellers or search for domains on forums.
• Don’t be deceived by low prices. As mentioned earlier, cheap domain zones often attract scammers. You certainly don’t want your website to be associated with illegal or intrusive activity, such as spam. It’s better to overpay a little, but be sure that the selected domain zone won’t be compromised.
• Explore third-level domains. If you don’t have confidence in new top-level domains (nTLDs), and domains in popular zones such as .com, .net, .org, etc. are either too expensive or the name you need has already been taken, then third-level domains, such as .it.com may be just what you need. Domain zones like .it.com offer the same benefits as well-known domains with the .com extension, including high recognition, no territorial restrictions, and a non-specific business type.

Mass purges of TLDs don’t occur very often, but they may occur. They help to fight the serious problem of TLDs being used for illegal activities, albeit in a radical way. Thanks to the new ICANN program, they may no longer be needed in the future. In the meantime, you should be careful when choosing a domain zone.

Want to stay on top of domain name industry trends? Visit it.com Domains’ blog and contact us on social media.

---