A teenager in one of my NGO sessions almost handed over her family’s personal details to a fake government job portal last year. The website looked exactly like the real one. Same layout, same language, same form fields asking for Aadhaar numbers, phone numbers, family details. The only difference was one letter in the domain name. She had no idea. Nobody had ever explained to her what a domain name was or why it mattered. Her internet dropped before she hit submit. That was the only thing that saved her.

I think about that moment a lot. Not just because of how close it was, but because of everything that happened after. Or more accurately, everything that didn’t happen.

The fake domain stayed up. The registrar that sold it faced no immediate consequence. The person who registered it moved on. And the next teenager who clicked that link wasn’t as lucky.

The Question Nobody Asks

When DNS abuse stories get told, the focus almost always lands on the victim and the attacker. The person who was deceived. The bad actor who built the fake domain. What gets skipped is the entity sitting between them: the registrar that sold the domain name, processed the payment, and handed over the keys to the infrastructure that made the attack possible.

Registrars are not passive participants in DNS abuse. They are the entry point. Every malicious domain targeting a vulnerable user in India started with a registrar accepting a registration, collecting a fee, and activating a domain without meaningful scrutiny of what it would be used for.

That’s not an accusation. It’s a description of how the system currently works. And it’s the specific gap that India’s DNS abuse problem keeps falling through.

What the Data Says About Registrar Concentration

The Forescout analysis of 11,894 domains observed in malware communication between December 2024 and June 2025 found that the top 10 registrars accounted for 54% of all malicious domains. The top 100 accounted for over 90%.

This is not a distributed problem. DNS abuse is concentrated at a small number of registrars, which means targeted accountability pressure would have disproportionate impact. The technical capacity to act exists. What has been missing is the regulatory and contractual pressure to use it consistently.

ICANN’s 2024 amendments to the Registrar Accreditation Agreement created explicit mitigation obligations for registrars and registries. The DNS Research Federation found that by early 2025, 20% of abusive domains were being mitigated within 24 hours, up from 13% in September 2024. That improvement is real. It also means eight out of ten malicious domains are still active beyond the first 24 hours, the window during which most victims encounter them and most damage is done.

For a first-generation internet user in India clicking a link from a WhatsApp group, that 24-hour window is the entire story.

Why India’s Context Makes the Accountability Gap Worse

Global registrar accountability statistics don’t capture the specific dynamics of India’s situation. Two things make the gap here structurally worse.

The first is the DPI overlap. India’s Digital Public Infrastructure has moved essential government services online at speed. Every scheme with a digital registration portal is a high-value impersonation target. The people searching for these portals are often desperate, moving fast, and trusting that a government service would not deceive them. That combination of urgency and trust is exactly what lookalike domains exploit.

The second is the reporting infrastructure. India’s CERT-In handles cybercrime reporting, but the process assumes a level of digital literacy that the most vulnerable users simply don’t have. The teenager from my session is not filing an abuse report with a domain registrar. She doesn’t know registrars exist. She’s trying to figure out what almost happened and who she can tell.

This is the enforcement gap that aggregate statistics consistently miss. The victims generating the most harm are the least represented in formal abuse reports. The registrars hosting the infrastructure that harms them face the least accountability pressure because their victims are invisible in the data.

What Accountability Actually Requires

The ICANN framework has moved in the right direction. Explicit mitigation obligations are better than voluntary guidelines. Domain Metrica’s launch in February 2025 gives the community visibility into abuse concentrations that didn’t exist before. These are genuine improvements.

What they don’t yet address is the asymmetry at the heart of the problem. Registrars profit from every domain registration, including malicious ones. The cost of that malicious domain is borne entirely by the victim. Until that asymmetry changes through stronger financial penalties, mandatory abuse response timelines with real consequences for non-compliance, and reporting infrastructure designed for low literacy complainants, the incentive structure favors inaction.

For India specifically, this means pushing for registrar accountability frameworks that account for the DPI attack surface. Government domains and scheme portals are predictable impersonation targets. A registrar that processes a lookalike registration for a known government scheme portal without additional scrutiny is not a neutral party. They are a participant in a predictable harm.

The Girl From My Session Deserved Better

She qualified for the scheme the fake portal was impersonating. She was trying to access something she was legally entitled to. The domain that nearly deceived her cost less than a dollar to register and was live within hours.

The registrar that sold it faced no consequence proportionate to the harm it enabled. That’s not a technology problem. It’s an accountability problem. And until the governance frameworks around registrar obligations catch up with the scale and specificity of DNS abuse in India’s DPI context, the next teenager clicking the next link is relying on the same thing she was: luck.