Anti-Abuse Quarterly Report
Q3 2026

The XYZ Anti-Abuse Quarterly report highlights just some of the actions that the XYZ Anti-Abuse Team has taken in the quarter to proactively address abuse. Visit xyz.xyz/anti-abuse to see report archives and read more about how XYZ Registry goes above and beyond to protect the Internet.

Report Abuse

XYZ Registry: How our work with Netcraft supports anti-abuse efforts

XYZ Registry remains committed to combating DNS abuse and supporting efforts to promote a safer internet. The core end users of the .xyz domain extension and XYZ Registry TLDs (Top Level Domains) are legitimate businesses, communities, and individuals. When bad actors appear across any of our TLDs, we work with industry partners to identify and disconnect domains being used for illegal and otherwise abusive activity. Organizations that monitor online threats can provide registries and other infrastructure providers with information that helps them address potentially abusive activity.

This quarter, we are highlighting our relationship with Netcraft, a cybercrime detection and disruption company. Netcraft identifies and validates online threats and provides infrastructure providers with evidence that can help them investigate and respond to malicious activity. Its work includes detecting threats such as phishing, malware, and fraud, and working with registrars, hosting providers, and other infrastructure providers to help disrupt them. XYZ Registry utilizes Netcraft’s reports in our ecosystem of anti-abuse efforts.

Netcraft has maintained a near-zero false positive rate for over a decade of reports to the XYZ Registry. These reports provide our Anti-Abuse Team with information to review and use to inform appropriate enforcement action. In Q3 2026, Netcraft reported over 3,500 unique domain names across XYZ Registry’s 10M+ domains under management. We value Netcraft’s detailed, actionable reporting and our longstanding collaboration as we work together to identify and respond to evolving forms of DNS abuse. Netcraft kindly shared more about the collaboration and the role it sees XYZ Registry playing in disrupting DNS abuse:

Netcraft has worked alongside XYZ to tackle DNS abuse since we sent our first report in May 2015. In 2019, we became a trusted reporter through XYZ's reporting API, which means our reports of malicious domains reach XYZ's team immediately and can be acted on promptly. So far in 2026, we've reported more than 13,000 malicious domains across XYZ's TLDs, with a median takedown time of just three hours. Registries that act quickly on high-confidence, well-evidenced intelligence make it much harder for threat actors to use a domain for malicious activities. XYZ has consistently been a key partner in this, especially in working with us on emerging attack types and preemptive disruption.

— Luke Wood, Global Infrastructure Partnership Lead, Netcraft

Netcraft also points to the longer-term impact of consistently acting on abuse reports:

By acting promptly on our reports, XYZ limits the lifetime of individual attacks. Sustained over years and thousands of domains, that consistency imposes a structural cost on threat actors’ business models, making the infrastructure they depend on more expensive to replace and less rewarding. Our close working relationship with XYZ also means we can adapt as attackers change their tactics, and increasingly that means acting on evidence of malicious intent before an attack is launched.

— Robert Duncan, Vice President at Applied Threat Research and Disruption, Netcraft

Working with organizations like Netcraft offers XYZ Registry an additional source of threat intelligence alongside our own anti-abuse processes and reports from other organizations and members of the internet community. Collaboration and information sharing across the industry can help registries and other infrastructure providers identify and respond to abuse across the internet.

Country domains added to Anti-Abuse reporting

Starting this quarter, these reports include 15 country domain endings that Gen.xyz has been providing anti-abuse services for, including .UK.COM, .US.COM, .EU.COM, .CN.COM, and .COM.DE. The XYZ Anti-Abuse Team handles abuse reports, investigations, and suspensions for these extensions using the same processes we apply across .xyz and our other domain extensions. Their figures are included in the tables below and will be part of each report going forward. The full list of domain extensions covered by our Anti-Abuse Team is available at xyz.xyz.

Complaints resolved

The XYZ Anti-Abuse Team promptly addresses complaints from individuals via email and by ticket at gen.xyz/abuse.

Q3 2026

DNS Abuse Type	# Tickets
Spam	64
Phishing	1,955
Malware	208
DDOS/Botnets	23
Other	357

New Anti-Abuse Partnerships

The XYZ Anti-Abuse Team has developed strong partnerships with many of the industry’s leading cybersecurity data providers to help identify and eliminate bad actors.

Q3 2026

DNS Abuse Type	# New Contributors
All/Other	1

Collaborations with registrar partners

XYZ delivers comprehensive daily domain suspension reports to our registrar partners.

Time Period	# Notices	Avg Per Day
Q3 2026	2,318	25.2
July 2026	898	28.9
August 2026	719	23.2
September 2026	701	23.4

DGA Threat Investigations

The Anti-Abuse Team additionally flags suspicious registrations for review, such as a large number of new domains created in a short period of time. XYZ’s enhanced initiatives target abuse at its source by addressing the actions of bad actors or registrants.

Q3 2026

Time Period	# Investigations
Q3 2026	17

Domains investigated by XYZ’s Anti-Abuse Team

XYZ monitors abuse through our proprietary in-house system. The Anti-Abuse Team suspends domains that are engaging in any activities in violation of the XYZ Acceptable Use & Anti-Abuse policies.

Q3 2026

TLD	# Domains Investigated
.ae.org	15
.autos	3,946
.baby	452
.beauty	543
.boats	421
.br.com	22
.ceo	554
.christmas	119
.cn.com	72
.college	245
.com.de	232
.de.com	219
.eu.com	237
.game	10
.gb.net	66
.hair	1,009
.homes	3,020
.hu.net	16
.jpn.com	53
.lat	4,547
.lol	42,846
.makeup	472
.mex.com	8
.mom	2,419
.monster	450
.motorcycles	215
.pics	1,933
.quest	911
.rent	142
.se.net	4
.skin	1,261
.uk.com	317
.uk.net	46
.us.com	714
.us.org	27
.xyz	27,390
.yachts	468

Law enforcement & court orders

Collaboration with legal entities is a crucial aspect of XYZ’s Anti-Abuse operations. This section outlines requests by various law enforcement agencies like the IRS, FBI, and the police. Additionally, it includes WHOIS requests and court orders.

Q3 2026

Law Enforcement/Court Orders
IRS	2
Police	0
FBI	1
Domain Transfer Orders	2
WHOIS requests	0
DHS	6

Unsuspension requests

When websites have been compromised, the XYZ Anti-Abuse Team promptly responds by suspending the affected domains to mitigate any potential risks. This immediate action is not only crucial for security but has also earned appreciation from users, as it directly aids in safeguarding their customers from being infected by their hacked website. While XYZ acts decisively against potential abuses, the Anti-Abuse Team also recognizes the importance of rectifications. This data presents the total number of unsuspension requests this quarter.

Q3 2026

Unsuspension Requests
Total # of requests	937

IWF data

IWF (Internet Watch Foundation) is an organization that combats online child sexual exploitation content and other malicious web activities.

In our mission to make the internet safer, XYZ is a member of the IWF. Together, we’re actively identifying and addressing URLs and domains that may host harmful content.

Q3 2026

IWF
Domains	86
URLs	589

The importance of anti-abuse

The XYZ Registry’s commitment to combating DNS abuse remains unwavering, and we advocate for a proactive approach to address online threats. Visit xyz.xyz/anti-abuse to see report archives and read more about how XYZ goes above and beyond to protect the Internet.