A domain name is often the most valuable digital asset a business owns. It is the storefront, the brand, and the address customers trust. Because that trust has commercial value, an entire economy has grown up around abusing it.

This abuse rarely looks dramatic. It looks like a lookalike domain registered the week of a product launch. A name with one letter swapped that quietly sends traffic to a competitor’s ads or a counterfeit store. A trusted company domain that expired, was re-registered seconds after it dropped, and now trades on years of goodwill its new owner never earned. Cybersquatting, brand impersonation, speculative trademark registrations, and the exploitation of expired names impose real costs on registrants, brand owners, and consumers. And the problem is growing.

The numbers tell the story. Trademark owners filed a record 6,282 UDRP complaints with WIPO in 2025, the highest volume since the procedure began more than twenty-five years ago. That was up from 6,168 cases in 2024, filed by brand owners from 133 countries. More than 4,000 cases have already been filed in 2026, which puts this year on pace to break the record again. About 70 percent of these cases end with the domain transferred to the trademark owner. That success rate also reveals the problem. By the time a UDRP complaint is filed, the harm is already done, and each dispute costs the brand owner thousands of dollars and months of process. Practitioners widely regard the filed cases as the tip of the iceberg.

The domain industry does not lack enforcement tools. It lacks early visibility. For generic top-level domains, the mechanism for that visibility has existed for over a decade: ICANN’s Centralized Zone Data Service.

Zone File Access Through CZDS

A zone file is the authoritative record of a top-level domain. It lists every delegated domain name under that TLD, together with the nameservers each one points to. It is the map of the namespace.

Before 2014, getting this data meant negotiating access registry by registry, under inconsistent terms. The new gTLD program changed that. ICANN’s base Registry Agreement requires participating gTLD registries to provide zone file access through a single portal, the Centralized Zone Data Service (CZDS). Today CZDS covers more than a thousand gTLDs. Any party with a legitimate, lawful purpose, including brand owners, researchers, registrars, and market analysts, can request access and download fresh zone files daily.

The service itself is simple: large text files, one per TLD, published once a day. Yet that daily, registry-authoritative snapshot of the global gTLD namespace is exactly what the fight against domain abuse has been missing.

From Reactive Disputes to Early Warning

Zone data becomes useful the moment it is treated as daily business intelligence instead of a static archive.

Seeing lookalike registrations the day they appear. Comparing today’s zone file with yesterday’s produces a complete list of newly delegated domains across every participating gTLD. Sweeping that list for variations of a protected brand, such as swapped characters, added hyphens, brand-plus-keyword combinations, or internationalized homographs, surfaces squatted names on the day they are delegated. Brand protection shifts from litigation to early warning. A cease-and-desist letter sent in week one is a very different conversation from a UDRP complaint filed after an infringing site has established itself.

Recognizing serial abusers by their infrastructure. Zone files map each domain to its nameservers. Professional cybersquatters operate portfolios, not single names. Starting from one confirmed infringing domain, a nameserver search across zone data reveals the other registrations parked on the same infrastructure, often dozens or hundreds of names targeting many brands at once. UDRP panels weigh patterns of bad-faith registration heavily, and comprehensive zone visibility is how complainants document those patterns. Registries and registrars can use the same view to spot bulk speculative campaigns in their own namespaces.

Watching the drop. Some of the most damaging abuse involves names that were once legitimate. When a company lets a domain lapse, drop-catching services can re-register it the instant it returns to the pool. The new owner inherits the accumulated digital equity: inbound links, bookmarked visitors, residual search rankings, and customer trust. Sometimes the goal is resale at a steep markup to the original owner. Sometimes it is trading on that residual reputation, a practice serious enough that Google now classifies expired-domain abuse as spam. Daily zone history makes this lifecycle observable. A brand team can be alerted when any domain in its portfolio drops out of a zone or reappears under new nameservers.

Bringing transparency to the market. Beyond individual brands, zone data over time shows the health of the domain market itself: registration surges around product launches and major events, concentrations of speculative activity in particular TLDs, and the effect of registry pricing and policy changes on registration behavior. Regulators, registries, and researchers debating how to curb abusive registration practices need this evidence base, and zone files are its foundation.

Limitations of Zone Data

Zone data is powerful, but it has limits worth stating plainly.

Coverage is the largest one. CZDS obligations apply to gTLDs. Country-code TLDs are under no equivalent requirement, and most publish no zone data at all. Domain abuse does not respect that boundary. Voluntary zone transparency would be a meaningful commitment for any ccTLD serious about protecting its local market.

Scale is real too. The .com zone alone contains well over a hundred million names. Downloading, parsing, and indexing a thousand TLDs every day is a serious engineering task, which is why so much CZDS access goes unused.

Finally, presence in a zone file proves existence, not intent. A lookalike name may be a legitimate reseller, a fan site, or a coincidence. Zone data is the starting point of an investigation, to be combined with RDAP registration data and the content the domain actually serves. It is not a verdict.

Making Zone Data Operational

Downloading zone data is easy. Using it well is the hard part. Turning daily zone files into an early-warning system takes several pieces working together: daily downloads across more than a thousand TLDs, an index that makes hundreds of millions of names searchable, matching that flags lookalike and internationalized variants of protected brands, nameserver analysis to find related registrations, and RDAP enrichment to tie each finding to a registrar and an abuse contact.

Organizations can build these capabilities in house, and some large brand-protection teams do. Others use third-party services. Our team built ZoneFeeds to apply this approach, combining CZDS zone data with search and RDAP registration information, and we mention it here as one example of how it can be done. Either way, the goal is the same: zone data used as daily working intelligence, not a dataset nobody opens.

Conclusion

The domain industry has spent two decades building enforcement mechanisms that activate only after abuse is found. Record dispute volumes show what that reactive posture yields: the largest caseload in the system’s history, and an iceberg of unaddressed harm beneath it.

CZDS offers the other half of the answer. A daily, authoritative view of the entire gTLD namespace already exists, and any legitimate party can request it. Used well, it moves detection from months after registration to the day of it: before the counterfeit store opens, before the lapsed domain’s goodwill is spent, before the dispute becomes necessary.

Zone data will not solve everything. It covers only gTLDs, it updates once a day, and a new entry in a zone does not prove bad intent. Even so, seeing abuse earlier makes a real difference. A warning letter sent in the first week can prevent a dispute. A cybersquatter’s portfolio can be documented before it grows. A lapsed domain can be flagged before its reputation is misused.

The data to curb domain abuse already exists. The question is whether the industry chooses to use it.