Cybercriminals routinely register domains in large, time-bound batches to launch phishing campaigns, distribute malware, and establish botnet command-and-control infrastructure at scale. Yet systematic, large-scale measurement of this behavior and its operationalization into actionable defender tooling has remained limited, particularly since the post-GDPR disappearance of registrant-level WHOIS data.
This talk presents the first comprehensive, empirical analysis of batch domain registrations across the gTLD landscape, drawn from 16.6 million newly registered domains in Q1 2025. We introduce a clustering methodology using only publicly available thin registration features (registrar identity, authoritative nameservers, and creation timestamps) to reliably identify coordinated registration batches at scale. Applied to ICANN's BRDA dataset and cross-referenced against seven major threat intelligence feeds (Spamhaus, PhishTank, APWG, URLhaus, SURBL, WMC-Global, and Urlscan), our results reveal that at least 16% of all newly registered gTLD domains exhibit batch registration patterns, with abuse rates reaching 45.7% for spam and over 24% for phishing domains.
We will demonstrate that batch registration rates are a statistically significant predictor of registrar-level abuse, and show how batch-based domain expansion (pivoting from a single known-malicious seed domain to all co-registered domains in the same batch) increases detected malicious domains by 80%, uncovering an additional 289,000 likely-abused domains beyond what threat intelligence feeds would flag alone, and enabling early detection of domains days before they appear in any blocklist.
Attendees will leave with a practical, open framework for real-time batch detection deployable by registrars, registries, CERTs, and threat intelligence analysts, with direct implications for proactive DNS abuse mitigation, incident response pivoting, and ICANN policy discussions around registrar API controls and registration verification requirements.
