XYZ Registry: How working with Netcraft supports anti-abuse efforts

XYZ Registry’s Q3 2026 Anti-Abuse Quarterly Report puts a spotlight on its work with Netcraft to disrupt DNS abuse.

Since Netcraft sent its first report in 2015, and became a trusted reporter through XYZ’s reporting API in 2019, the two teams have built a fast, evidence-led workflow. Netcraft has maintained a near-zero false positive rate across more than a decade of reports.

By acting promptly on our reports, XYZ limits the lifetime of individual attacks. Sustained over years and thousands of domains, that consistency imposes a structural cost on threat actors’ business models, making the infrastructure they depend on more expensive to replace and less rewarding. Our close working relationship with XYZ also means we can adapt as attackers change their tactics, and increasingly that means acting on evidence of malicious intent before an attack is launched.

— Robert Duncan, Vice President at Applied Threat Research and Disruption, Netcraft

By acting promptly on our reports, XYZ limits the lifetime of individual attacks. Sustained over years and thousands of domains, that consistency imposes a structural cost on threat actors’ business models, making the infrastructure they depend on more expensive to replace and less rewarding. Our close working relationship with XYZ also means we can adapt as attackers change their tactics, and increasingly that means acting on evidence of malicious intent before an attack is launched.

— Robert Duncan, Vice President at Applied Threat Research and Disruption, Netcraft

In Q3 alone, Netcraft reported over 3,500 unique domains, and so far in 2026 the team has reported more than 13,000 malicious domains across XYZ’s TLDs, with a median takedown time of just three hours. When registries act quickly on high-confidence intelligence, attacks have shorter lifespans and threat actors pay more to replace their infrastructure.

Read the full report on XYZ’s website.