Mali Gave Away Its .ML Domain for Free. It Became a Spam Haven.

Mali became the first African country to give away registrations for its own country-code domain for free, announcing the program in April 2013 through Agence des Technologies de l’Information et de la Communication, the Malian government agency that had taken over management of the .ml domain from a privatized former state telecom operator. The pitch was straightforward: expand global awareness of Mali’s presence online and encourage broader internet adoption by removing the cost barrier to registering a website, with free .ml domains opening to users in Mali and abroad alike starting that July.

Mali’s government partnered with Freenom, a Netherlands-based domain registrar, to run the free-registration program, a 10-year arrangement that also covered several other small nations’ domains, including Tokelau’s .tk, Gabon’s .ga, the Central African Republic’s .cf and Equatorial Guinea’s .gq. All five became known collectively in the domain security industry as the “Freenom” ccTLDs, a designation that, within a few years, had less to do with their national origins than with a specific reputation the free-registration model earned them.

That reputation was overwhelmingly negative. Because Freenom’s domains cost nothing to register and required minimal verification, they became a preferred tool for spam operators, phishing campaigns and malware distributors worldwide, exploiting the free, low-friction registration process to churn through disposable domains faster than security researchers could blacklist them. Domain-security firm Spamhaus documented Freenom’s ccTLDs, .ml prominent among them, appearing consistently among the internet’s most abused top-level domains for years, with Freenom accounting for a striking share of all malicious domain registrations tracked globally at various points during the arrangement’s run. What Mali’s government had framed as a tool for expanding legitimate internet access instead became, in large part, infrastructure for exactly the kind of online abuse most governments actively try to suppress.

The free-registration era ended in July 2023, when Freenom’s 10-year contract with Mali expired and was not renewed, returning management of .ml fully to the Malian government agency and ending the no-cost registrations that had defined the domain for a decade. Security researchers subsequently documented a sharp decline in both new .ml registrations and associated abuse in the years following the contract’s end, a pattern that reinforced, after the fact, just how directly the free-registration model itself, rather than anything specific to Mali, had driven the domain’s troubled decade.