XYZ Registry takes a firm stance against DNS abuse to protect our domain space. Over the past decade, we’ve developed an adaptive anti-abuse program to address emerging threats. Our team proactively identifies and mitigates various forms of DNS abuse—including, but not limited to, phishing, malware, and spam—across our TLDs. With the help of cybersecurity partners, we enforce our Anti-Abuse Policy to protect internet users and uphold trust across our domain space.
To report abuse of .xyz or any XYZ Registry TLD, please open a ticket at https://gen.xyz/abuse or email [email protected].
This quarter, we’re highlighting recent actions the XYZ Anti-Abuse Team took to disrupt malvertising. Around the world, bad actors utilize both legitimate and malicious advertising networks to lead users to malware and other violations. This type of abuse is an unfortunate reality across every popular TLD. While most Registries face abuse, not all take the same approach to enforcement. XYZ Registry makes active abuse remediation a core part of our operations.
Through invaluable expertise and research done by our trusted partners, we were alerted to bad actors abusing domain names to support large-scale scam and traffic distribution systems (TDS). Just one of the difficult facets of identifying abuse within a TDS is unraveling the network of domain redirections that result in the user landing on a different domain than they started on. In particular, we worked with Infoblox to disrupt a specific TDS operation that manipulated hijacked websites to expose users to malware. Infoblox’s threat research provided key insights that enabled swift enforcement across affected domains.
Our Anti-Abuse Policies describes abusive use of a domain as an illegal, disruptive, malicious, or fraudulent action. Our policies are not limited to abuse hosted directly on the domain. We also consider domains abusive if they redirect users to malicious content or play a role in facilitating harmful activity elsewhere.
We also continue to work with community-based projects like URLAbuse. They are part of a tireless group of experts helping registries, registrars, hosting providers, and other stakeholders identify domains involved in abusive behavior. We greatly appreciate the people working at URLAbuse and similar organizations. We believe that enabling action should be an important goal in any abuse intelligence. Providing free, reliable reporting to organizations capable of enforcement is so important. It reduces barriers to response and helps keep the internet safer for everyone.
Malvertising campaigns can be difficult to detect and often rely on a network of compromised sites and evasive redirection tactics. By leveraging shared intelligence and threat analysis from trusted sources, we’re able to respond effectively and protect the integrity of our namespace. These collaborations are an essential part of our anti-abuse strategy. We welcome continued engagement with security researchers, vendors, and organizations working to address DNS abuse at its roots. If you have actionable threat data or are interested in working together, we encourage you to reach out.
Let’s continue building a safer internet together.
The Anti-Abuse Quarterly is published to the XYZ Registry Anti-Abuse hub on https://xyz.xyz/abuse. Visit to learn more about our monitoring process, find information on how to report abuse, and understand the actions we take in collaboration with industry partners and law enforcement.
As we continue to safeguard our domain space, these resources serve as a testament to our unwavering commitment to a safer internet. We encourage you to join us in the ongoing fight against online abuse.
XYZ is proud to share about the many incredible members that make up the XYZ community! We encourage you to do your own research before using the products and services of the websites we feature. The information about products and services contained in this blog post does not constitute endorsement or recommendation by XYZ.
