.bond: a finance-sounding TLD that is open to everyone and heavily abused

The detail most pages skip: it began as a university's brand TLD

.bond was applied for by Bond University Limited, an Australian university, as a brand-style extension. IANA's record for .bond shows that delegation in late March 2015, a report dated 23 March 2015 for the initial delegation, and a later transfer to Shortdot SA documented with a report dated 20 September 2019. ShortDot turned it into an open generic extension, so anything written about .bond before late 2019 describes a different plan.

Launch of the open version

ShortDot announced a sunrise period for trademark holders from 17 October to 18 November 2019, with general availability on 19 November 2019 and an early-access week at the start of GA where a daily fee decreased as the week went on. Those are the dates given in the registry's launch announcements as relayed in trade coverage; I treated the announcements as the source and did not independently check them against a registrar archive.

Does .bond restrict who can register?

Registrars and registry materials I reviewed describe it as open: no professional membership, no proof of being a financial institution, no local presence. That separates it from regulated, verified extensions such as .bank, where an applicant is screened. Since the rules could change, check the registry's current policy on the registrar page, but at the time of writing nothing found suggests a finance licence is needed or that registering a .bond name gives any official status.

Reputation, by the numbers

Interisle's Phishing Landscape 2025, which covers May 2024 to April 2025, is the most pointed source. It ranks TLDs by reported phishing domains and by a score that divides phishing domains by domains delegated, scaled per 10,000. For .bond it reports 79,875 phishing domains and a score of 1,759.0, compared with .com's 455,297 phishing domains at a score that is far lower because .com is enormous. By that measure a very large fraction of the .bond zone was observed in phishing reports in that year. The report is a good example of why score and count differ: .com has the highest count, but .bond stands out on concentration.

On a different measure, reported spam domains in the Cybercrime Information Center's table for December 2025 to February 2026, .bond did not appear among the top twenty on the page I read. Phishing and spam are different problems, and a TLD can rank differently in each. Together they say the same thing about priorities: security teams sometimes block or escalate .bond mail, and a finance-themed name in a cheap extension is a lure scammers like.

What blocklists and filters do

• Domain and URL blocklists (Spamhaus, SURBL and others) list individual domains seen in abuse; they do not, as a rule, list a whole extension, but some operators apply their own rules.
• Some corporate gateways treat messages with links on high-risk TLDs as suspicious or rewrite and scan the links.
• Browsers' safe-browsing systems flag specific phishing URLs rather than a TLD.

What a legitimate registrant should think about

1. Purpose fit. If you genuinely trade in bonds, savings, adhesives or James Bond fandom, the word helps. If you want to look like a bank, it will not.
2. Email. Use a different, established domain for important customer mail, or be ready to work through filter problems.
3. Brand protection. Check whether your brand's .bond equivalent is registered by someone else; the guide to lookalike domains describes the risk.
4. Costs. Pricing tends to follow the promo-then-renew pattern, with a notably higher price for single-word premium names. Check renewal in advance.

Notable examples

ShortDot's launch announcement said that large brands had secured names in the sunrise, but I am not naming any because I could not confirm individual registrations. The extension's best-known association is simply that it was once Bond University's own address space. The university's own main website is not on this extension.

Why finance-themed names deserve extra scrutiny

Words like bond, loan, trade and invest are attractive to fraudsters because they attract people already thinking about money. A visitor who sees a .bond link in a message claiming to offer investment returns is facing a pattern that investor-protection agencies warn about regularly. For site owners the lesson runs both ways. Do not use urgent, guaranteed-return or regulatory-sounding language that makes a legitimate page resemble those scams, and display licence numbers and company details where law requires them. Visitors, and automated scanners that read page text, both look for those cues. Domain age also matters: a name registered last week, hosted behind a privacy-protecting CDN and carrying a login form, will look suspicious to any scanner regardless of the extension. You can see how large daily waves of new registrations are by reading about newly registered domains.

Where it sits among the ShortDot extensions

.bond shares an operator with .icu and .cfd. Its distinguishing feature is meaning: of the group it is the one most likely to be mistaken for a finance extension. A comparison of cheap TLDs is in the budget new gTLD guide.

Frequently asked questions

Is .bond only for financial companies?

No. Sources reviewed describe registration as open with no licence, membership or location requirement. It is not a verified financial namespace like .bank.

Who runs .bond?

IANA lists Shortdot SA of Luxembourg, after a transfer documented in September 2019 from Bond University Limited, the original applicant.

When did .bond open for general registration?

ShortDot announced 19 November 2019 as general availability, after a trademark sunrise from 17 October to 18 November 2019.

Is .bond considered a high-risk TLD?

Interisle's Phishing Landscape 2025 reported 79,875 phishing domains in .bond for May 2024 to April 2025, a score of 1,759.0 per 10,000 delegated domains. That is high relative to size, so some filters are cautious, but each domain is still judged individually.

Can I use .bond for a legitimate small business?

Yes, if the name fits. Authenticate email, publish clear contact and legal details, and avoid imitating banks.