Disposable domains can lower the cost and effort of building replacement links for phishing campaigns, but there is no verified Nigeria-specific figure for how many campaigns use them or how quickly they are taken down. In Nigeria, ngCERT has warned that phishing arrives through email, SMS, WhatsApp and social platforms. Stopping it depends on identifying where the abuse sits—and getting the right registrar, host, platform or site operator to act.
What “disposable domains” means in this context
“Disposable domains” is a useful shorthand for domains that an attacker can register and use for a short time, then abandon or replace after detection. It is not a measured category in the Nigerian advisory or in ICANN’s global study. Nor does every phishing link use a newly registered domain: criminals may compromise a legitimate website or use a legitimate subdomain service instead.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters because a phishing page’s visible web address does not by itself show who controls the underlying infrastructure or what kind of intervention is safe. ICANN’s INFERMAL report distinguishes domains registered maliciously from legitimate domains compromised later and abuse hosted through legitimate subdomain providers.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow low costs and automation can help campaigns scale
A cheap domain is only one part of the economics. In its global analysis, ICANN examined registration and hosting features linked with maliciously registered domains. Discounts can make replacement infrastructure less expensive; free hosting and registration APIs can lower setup friction or support bulk activity. The report’s conclusion says attackers prioritize registrars offering lower costs and features that enable bulk registration, which allows them to scale operations efficiently.
#1 Best Overall
The figures below are associations in the report’s registrar/TLD model, not proof that any feature caused abuse. They describe global observations, not Nigerian campaign costs or rates.
| Feature in ICANN’s model | Reported association | Scope and interpretation |
|---|---|---|
| A one-dollar registration discount | Associated with a 49% increase in malicious registrations | Registrar/TLD model in ICANN’s 2024 global study; not a Nigeria-specific estimate or a causal finding. |
| Free web hosting | Associated with an 88% increase in malicious phishing domains | Registrar/TLD model in ICANN’s 2024 global study; not a Nigeria-specific estimate or a causal finding. |
| Registrar API access | Associated with a 401% increase in malicious domains | Registrar/TLD model in ICANN’s 2024 global study; not a Nigeria-specific estimate or a causal finding. |
| More stringent registrar restrictions | Associated with a 63% decrease in maliciously registered domains | Registrar/TLD model in ICANN’s 2024 global study; not a Nigeria-specific estimate or a causal finding. |
| Registrant email or phone validation | Associated with a 70% decrease in malicious registrations | Registrar/TLD model in ICANN’s 2024 global study; not a Nigeria-specific estimate or a causal finding. |
Those percentages should not be read as a price list, a prediction for an individual domain, or evidence that all discounted registrations are abusive. They indicate relationships in one model. ICANN’s report also notes that findings vary across models.
What ICANN’s sample can—and cannot—show
ICANN’s 2024 INFERMAL report began with 534,000 blocklisted URLs gathered from APWG, PhishTank and OpenPhish feeds for August 2023 through January 2024. The study extracted 108,000 registered domains from those URLs before filtering and classification. Its final analysis identified 14,474 maliciously registered domains across 165 top-level domains and 31 registrars.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →This is a feed-based sample processed with filtering heuristics, including a 90-day registration window and evidence of DNS-level mitigation. It is not a census of phishing activity. The figures help explain patterns in the study’s global data; they do not establish how many malicious domains target Nigerians, what attackers there pay, or what share of Nigerian phishing uses newly registered domains.
Rank #3
Why taking a phishing link offline is not one simple takedown
Once a report reaches responders, the first question is where the malicious content is hosted. The responsible party—and the risk of collateral damage—changes with the answer.
| Where the abuse sits | Who may need to act | Response consideration |
|---|---|---|
| A domain registered for phishing | The registrar or registry may be able to suspend or delete it at the DNS level, where evidence supports action. | Suspension can disrupt access to the phishing domain. It may not erase copies, messages or other infrastructure. |
| A legitimate website compromised to host a phishing page | The hosting provider or site webmaster may need to remove the malicious content and secure the site. | Taking the entire legitimate domain out of DNS can disrupt the site owner and ordinary visitors. |
| A legitimate subdomain service abused by a criminal | The platform or service operator may need to address the abusive account or content. | The service’s shared infrastructure makes it important to identify the offending content rather than assume the whole provider is malicious. |
A campaign can also benefit from even a short period online: ICANN notes that attackers may have time to collect credentials or obtain financial benefit before infrastructure is disrupted. If a domain is suspended, an operator may try to move to a replacement. These dynamics make response a coordination problem among registrars, registries, hosting providers, website operators, platforms and incident responders—not simply a matter of finding a suspicious-looking URL.
ICANN’s report does not measure Nigerian takedown times, and the sources available here do not establish a typical response delay in Nigeria. It would be misleading to assign one.
What the Nigerian advisory says phishing looks like
In its advisory published January 15, 2025, ngCERT warned of phishing across email, SMS, WhatsApp and social media. The messages may impersonate reputable organizations and direct people to fake websites or forms that request personal or bank information. The advisory also warns that clicking may lead to malware installation, with possible financial loss, identity theft, data theft, device compromise and reputational harm.
Best Value
ngCERT’s practical advice is to check support-scheme claims with the relevant organization’s official sources: “Always verify claims of support schemes by checking official sources of relevant organizations.” It also recommends avoiding unexpected links and attachments, not sharing personal or financial details with unverified parties or sites, reporting suspected scams to ngCERT, and having administrators screen social-media groups.
How to respond to a suspicious message
- Do not follow the message’s link or attachment. If it claims to offer support or come from an organization, reach that organization through a channel you already know is official.
- Do not submit sensitive details. Treat requests for bank or personal information as unverified unless you have independently confirmed the request with the organization.
- Report the suspected scam to ngCERT. Include the message and link in the report if you can do so safely, rather than forwarding the message to others.
- If you administer a social-media group, screen suspicious posts. Removing a deceptive post can limit exposure in that group, though it does not take down the underlying site.
What government-domain rules tell us—and what they do not
NITDA documents an authorization process for Nigerian government websites or portals and long-term government projects seeking registration in the .GOV.NG or .MIL.NG zones. The procedure includes an authorization letter signed by an institutional head or delegated officer, named administrative and technical contacts, verification and approval.
This is a bounded example of controls for government namespaces. It does not establish that the same checks apply to general-purpose domain registrations in Nigeria, or that commercial phishing domains are covered by equivalent procedures.
What is known about Nigeria, and what is not
The Nigeria-specific evidence here is ngCERT’s warning about channels, impersonation and protective steps. The registration-economics findings come from ICANN’s global study, and NITDA’s process describes only government-domain registration. These sources do not establish a Nigeria-specific disposable-domain share, phishing-domain count, victim total, campaign registration cost or takedown time. Keeping those boundaries clear is essential: global associations can illuminate how abuse may scale, but they cannot be presented as Nigerian incident statistics.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
