From 24 million addresses to 80.000: Tokelau's suffix shows how economic rules and controls are changing the geography of cybercrime.

For years .tk, the national domain of Tokelau, was one of the most crowded and least governable places on the Internet. The paradox: a territory made up of three Pacific atolls had accumulated tens of millions of Web addresses, almost all registered by users with no ties to the islands. Many were legitimate projects; a disproportionate share, however, served for Phishing, distribution of malware, spam and brand imitation.

The situation described in 2023 by MIT Technology Review has changed today. The “purification” of .tk did not come from a single technical intervention. It was a traumatic contraction of the entire operating model: a block on new registrations, legal pressure, the operator's exit from the market, and the shutdown of millions of names. The domain still exists, but the free resource that fueled its expansion has almost disappeared.

The case concerns the security and privacy Because the reputation of a DNS zone doesn't depend only on the code. price, identity of registrants, response to abuse and operator liability: If the incentives are wrong, the domain becomes raw material for cybercrime.

Zero price transformed a national good into a disposable resource

.tk is a country-code top-level domain, that is, a domain associated with a country or territory. IANA register still indicates the manager as the Telecommunication Tokelau Corporation, Teletok, while the technical contact is BV Dot TK in the Netherlands. The factsheet, updated to 2019, confirms the formal delegation but does not fully describe the transition following the collapse of Freenom.

The growth came from a simple choice: most of the names could be obtained free of charge and without a territorial connectionIt was an opportunity for students, associations, and small organizations, but it reduced to almost zero the loss incurred by those who registered hundreds of disposable addresses.

In phishing, the domain is often consumable: it hosts a fake page or impersonates a bank; when it ends up on blocklists, the attacker activates another. With free and automatable registrations, the cost of replacement becomes negligible, while countering it requires repeated interventions by registrars, security companies, hosting providers and owners of the imitated trademarks.

In 2023 Spamhaus He recalled that the suffixes managed by Freenom had been appearing in spam, phishing, and malware rankings for years. The company administered, in addition to .tk, also .cf, .ga, .gq, and .ml. The problem wasn't the people of Tokelau, but the global industrialization of a national good through a system that rewarded volume and passed the costs of remediation onto third parties.

The suffix delegation separated Tokelau from the commercial operator

The institutional history of .tk predates the expansion of free registration by several years. According to the root zone database of IANA, the domain was registered on November 7, 1997. In October 2005, the ICANN Board of Directors then approved his reassignment to the Telecommunication Tokelau Corporation, authorizing the completion of the delegation to the local public operator. The decision helps distinguish the territory owning the code from the companies that, in subsequent years, would handle its technical services, registrations, and international marketing.

In the Internet naming system, in fact, a national domain is not treated as an ordinary commercial property. IANA procedures for delegating ccTLDs They describe the manager as a trusted entity responsible for managing the resource in the best interests of the local and global communities. Delegation requires technical expertise, operational continuity, local support, and the ability to maintain the stable operation of the authoritative servers.

The possibility of outsourcing some activities to external companies does not eliminate the public liability associated with the suffix. This distinction also explains why the .tk case involves multiple levels. record maintains the set of names belonging to the area and defines its rules; register manages the relationship with those requesting an address; DNS providers make the name reachable; hosting providers and distribution networks host or transport the content.

A site can therefore be suspended by the registrar, removed from the server, filtered by a blocklist, or become unreachable because the domain no longer appears in the DNS zone. These are different actions, entrusted to different parties, and the consequences may not always coincide. Removing a fraudulent page, for example, does not necessarily result in the deletion of the name; similarly, a domain that is no longer resolvable may continue to appear in historical databases or previously issued certificates.

For this reason, the revocation of OpenTLD accreditation for generic domains did not, in itself, equate to the elimination of the national suffix. The actual downsizing came when the free registration service, renewals, and the termination of a huge portion of the names already distributed were discontinued. The cleanup was therefore not a one-on-one review of millions of sites, with the preventive separation of every legitimate registrant from the criminal operators, but the result of deactivating the structure that allowed for their continuous replacement.

This difference is also relevant for evaluating the future of .tk. A much smaller area is easier to control, but its reliability depends on the presence of public reporting procedures, up-to-date contact details, understandable registration rules, and clearly distributed responsibilitiesReducing numbers eliminates much of the area of ​​abuse inherited from the past; rebuilding reputations instead requires governance capable of demonstrating who makes decisions, according to what criteria, and in the best interests of which community.

Legal and contractual disputes have interrupted the vicious mechanism

The turning point began in 2023. After the legal action brought by Meta Due to cybersquatting, trademark infringement, and alleged failure to handle complaints, Freenom suspended new free registrations. The measure didn't cancel existing active domains, but it did interrupt the continuous turnover that had made the system resistant to blocking.

A second front concerned OpenTLD, the group company accredited by ICANN as a registrar for generic domains. On November 9, 2023, the organization announced the termination of the agreement, effective November 25, after three unresolved disputes. The decision cited issues with the availability of registration data, renewals, and transfers requested by holders.

“The termination is due to the failure to correct repeated and consistent violations of the agreement, despite multiple communications from ICANN.”

He wrote it Jamie Hedlund, then Senior Vice President for Contract Compliance and U.S. Government Relations, in official termination notification.

The revocation concerned generic domains and did not directly order the closure of the .tk ccTLD, subject to a different structure. However, it aggravated an already existing crisis and made the previous commercial structure unviable.

On February 12, 2024, Freenom announced the confidential agreement with Meta and the decision to abandon the domain name businessBetween February 8th and 10th, millions of addresses had already begun to disappear. More than a selective cleanup of malicious sites, it was a mass extinction of the free zone, also affecting legitimate users.

The numbers show a rapid, but not painless, cleanup.

The analysis published by Netcraft in March 2024 he quantified the collapse. Approximately 12,6 million domains belonging to .tk, .cf and .gq stopped resolving, with a decrease in the 98,7 percent compared to the previous month. This data does not only concern the Tokelau suffix, but .tk was the largest component.

The impact was visible on Cloudflare: the three suffixes accounted for 23,1 percent of the hosted domains; their number dropped by 99,8 percent, reducing the total detected by the provider by 22 percent. The statistic shows how much Freenom had inflated the apparent size of the Web.

Netcraft also recorded a decrease in86,9 percent of malicious URLs blocked in the affected suffixes compared to December 2023. It does not prove that every disappeared domain was criminal, but it does indicate that the closure of the free reserve quickly removed infrastructure from many attack campaigns.

In the relationship The Online World 2025 by Nominet, .tk goes from over 24 million domains about 80.000The suffix remains active, and some addresses continue to function. However, the situation that had transformed Tokelau into a statistical giant and a symbol of online crime has ended.

The reduction has produced collateral damagesPersonal sites and small free projects have become unreachable, sometimes without warning. Shutting down almost everything is quick, but it's not the same as a controlled migration. A reliable registry must ensure continuity and clear communications to legitimate users.

The lesson for registries is to design access together with controls.

The .tk case offers a less simple conclusion than “free equals dangerous.” A low price can broaden access to the Web and support the digital transformation of communities with limited resources. This becomes problematic when combined with Unlimited registrations, weak verification and slow responses to reportsThe risk arises from the configuration of incentives, not just the price list.

For registries and registrars, the alternative to shutdown is prevention: limits on mass registrations, risk-based controls, detection of trademark-imitating names, swift suspensions and appeals. Hosting providers and distribution networks can share indicators to identify mass-created domains.

Part of the work can be done at the time of registration, observing sequences of requests from the same individual, lexical combinations that mimic well-known brands, and inconsistent contact information. These checks shouldn't become a general barrier to access, but they could make the industrial automation of fraudulent campaigns more costly.

For businesses, the story confirms that the online brand protection It can't be limited to the most well-known suffixes. New registrations, spelling variations, and issued certificates must be monitored. The disappearance of the .tk reserve has increased the attackers' operational costs, but some of the abuse has spread to other economic domains and compromised legitimate accounts.

There remains a question of sovereignty. A ccTLD is also a reputational asset associated with a territoryTokelau has seen its code become infamous for activities elsewhere. Today, .tk is smaller and statistically cleaner; its future requires transparency and fundable controls without recreating the volume incentive.

The "purification" is real in numbers, but incomplete as an institutional project. The machine that produced millions of disposable domains has stopped; now we need a registry. smaller, more verifiable and operationally sustainable, so that Tokelau's reputation is not determined by subjects far from its atolls.

Here are three insights that might interest you:

There is the yes to the opening of the Web domain ".swiss" to natural persons
What is spear phishing and why is it so scary?
NIS 2, how Europe raises the wall against cyber attacks