Freenom Is Back, and No Longer Free. The Free-Domain Registry Behind Years of Phishing.

Freenom, the registry that once handed out millions of domain names for free and in doing so became one of the internet’s biggest sources of phishing, has quietly returned. The trade publication Domain Incite reported on July 23 that the company is again selling domains in three of its country-code extensions, .tk, .cf and .gq, starting at €8.22 a year. The change from its old model is the whole point: the domains are no longer free.

That single word carries weight. Freenom’s free domains were the fuel for years of abuse, until Meta sued the company in 2023 and it said it would leave the domain business for good. Two and a half years later it is back, running the same registries it promised to exit, with the one part of its model that made the mass abuse possible now removed.

Key facts

• The news: per Domain Incite (July 23), Freenom has resumed paid sales in .tk, .cf and .gq from €8.22 a year, reversing its 2024 pledge to exit the domain business
• What Freenom was: operator of five free country-code domains; .tk was the world’s largest such extension, with more than 31 million registrations in 2016
• The abuse: the research firm Interisle found Freenom’s extensions were 5 of the 10 most-abused top-level domains in 2021, and over 60 percent of all country-code phishing domains by November 2022
• The reckoning: Meta sued in 2022 and 2023, seeking roughly $500 million; registrations stopped, phishing on the extensions fell from over 60 percent to under 15 percent, and Freenom settled in February 2024 on confidential terms
• The aftermath: ICANN cut off its registrar accreditation, about 12.6 million domains went dark, and Mali and Gabon reclaimed .ml and .ga

The empire built on free domains

Freenom’s business was giving domains away. Built around a deal to run Tokelau’s .tk extension and consolidated under the Freenom brand in 2012, it offered free registrations in five country-code domains, standing in for Tokelau, Mali, Gabon, the Central African Republic and Equatorial Guinea, or .tk, .ml, .ga, .cf and .gq. The offer worked. By 2016, .tk was the largest country-code domain in the world, with more than 31 million registrations, ahead of China’s .cn.

The money came from the domains themselves. Freenom gave a name away but reserved the right to take it back at any time, and it kept the valuable and expired ones for itself, pointing their traffic at pages of ads. A registrant got a free web address; Freenom got an enormous pool of names it could monetize and recycle. Its founder, the Dutch entrepreneur Joost Zuurbier, had turned a tiny Pacific territory’s domain into one of the most-registered strings on the internet.

How free domains became a phishing engine

Free and anonymous is an attractive combination if you send phishing emails. Because anyone could register a Freenom domain at no cost and without meaningful checks, criminals did so at scale, spinning up throwaway names for fake login pages and malware. The measurements were stark. The security research firm Interisle found that in 2021, Freenom’s five extensions accounted for five of the ten most-abused top-level domains anywhere. By November 2022, according to Interisle data cited by the security journalist Brian Krebs, Freenom’s domains made up more than 60 percent of all the phishing domains reported across every country-code extension on the internet. At the company’s peak, its names were used in around 14 percent of all phishing attacks worldwide.

The point was volume, not the ratio of bad to good on any single extension. Because .tk alone held tens of millions of names, its share of abuse looked smaller as a percentage, yet the sheer supply of free, disposable domains made Freenom’s extensions the default choice for large-scale abuse.

Meta sued, and the phishing collapsed

The reckoning came from a brand owner, not a regulator. In December 2022, and again in an amended complaint in March 2023, Meta, the owner of Facebook, Instagram and WhatsApp, sued Freenom and Zuurbier in a California federal court. Meta accused the registry of cybersquatting and of knowingly profiting from domains used to phish its users, and pleaded thousands of counts that together sought roughly $500 million.

Freenom’s response told its own story. Within days it stopped accepting new registrations, posting only a note blaming temporary technical issues. What happened next was the clearest evidence that the free model had been driving the abuse: phishing on its extensions fell off a cliff. Interisle’s measure of Freenom’s share of country-code phishing dropped from over 60 percent to under 15 percent. A separate tracker, NetBeacon, recorded the five extensions falling from about 13 percent of all the abusive domains it saw to roughly 1.4 percent in the space of a month.

Freenom’s share of country-code phishing domains before and after Meta’s lawsuit. Source: Interisle Consulting, via Krebs on Security.

The settlement that was supposed to end it

In February 2024, Meta and Freenom settled on confidential terms. Freenom admitted no wrongdoing but agreed to treat Meta as a trusted notifier, acting quickly on the company’s abuse reports, and to run a block list against future phishing, DNS abuse and cybersquatting. It also said something more sweeping: that it and its related companies had independently decided to exit the domain name business, including the operation of registries.

The exit looked real:

• ICANN stripped Freenom’s registrar arm, OpenTLD, of its accreditation, cutting it off from selling ordinary domains like .com.
• Around 12.6 million of its country-code domains stopped resolving during 2024.
• Mali reclaimed .ml.
• Gabon moved .ga to the French registry operator Afnic.

Freenom’s free-domain era looked finished.

Back, but paid, and unexplained

That is what makes the July return so striking. Freenom is once again operating three of the extensions it said it would leave, .tk, .cf and .gq, the three that were never reclaimed by their governments. This time, according to Domain Incite, the domains cost money, from €8.22 a year for an ordinary name to well over a thousand euros for a sought-after word. Nothing in the public record explains how a paid comeback squares with its own pledge to exit the registry business, and Meta has not publicly responded.

The price is the part worth watching. Charging for a domain, even a small sum, removes the free, frictionless, anonymous registration that made Freenom’s extensions a magnet for bulk abuse. That is not, on its own, a guarantee of clean domains, and Freenom has published no new identity checks or abuse rules for the relaunch beyond the block list it promised Meta. But the barrier that mattered most, a zero-cost supply of disposable names, is gone. Oddly, Freenom’s own public pages still advertise the domains as free; the new prices appear only once a visitor starts a search.

Why it took a lawsuit, not a regulator, to end this

Freenom’s arc is a case study in how domain abuse actually gets solved, and by whom. It was not a regulator or ICANN that broke the free-domain phishing machine; it was a private company with deep pockets and a trademark to defend. Meta’s lawsuit did in days what years of abuse reports had not, which says something about where the leverage in domain accountability really sits.

For registrars and hosts, a smaller, paid Freenom is a modest positive: fewer free throwaway domains means fewer of the phishing and malware links that fill customer inboxes and abuse queues. The open question is whether a company built on giving names away can make a business out of charging for extensions that many buyers now have every reason to distrust, and whether its return invites a second look from the brand owners, and the governments, that pushed it out the first time.

About the Data

This article draws on Domain Incite’s July 23, 2026 report of Freenom’s paid relaunch for the current pricing and the three extensions involved, a claim that Freenom’s own public pages had not yet reflected at the time of writing. The account of the company’s abuse record and the Meta case rests on Meta’s 2023 court complaint, reporting by Brian Krebs, and measurements from Interisle Consulting and NetBeacon. The settlement, ICANN’s registrar termination, and the reclaiming of .ml and .ga are drawn from Domain Incite, ICANN and Afnic. Settlement figures are confidential; the $500 million reflects what Meta sought, not what Freenom paid.