Understanding top-level domain (TLD) abuse helps illuminate and predict domain threat trends

The report explains how TLD registration policies and ecosystem variations (ccTLDs vs gTLDs, registrar practices, verification, cost and batch registrations) can be exploited by malicious actors to register and operate abusive domains, and outlines reasons why such abuse can persist despite controls; it does not document a specific incident or technical indicators.