Tiny Islands, Massive TLDs: How Tokelau, Tuvalu, and Niue Built Some of the Internet's Largest Domain Extensions

Tokelau is three coral atolls in the South Pacific with a combined land area of 10 square kilometers, no airport, no deep-water harbor, and roughly 1,500 permanent residents. It is a non-self-governing territory of New Zealand — the kind of place that appears on maps only if you zoom in far enough. Its GDP was first measured in 2017: NZ$14 million, the smallest economy of any nation on Earth.

Tokelau's country-code TLD, .tk, peaked at 31.3 million domain registrations in 2016 — more than China's .cn, more than Germany's .de, more than any other country-code domain on the planet. At that peak, Tokelau had roughly 20,875 domains per resident. The atolls had one computer per island when the scheme began.

The .tk story is not unique. Across the Pacific, a handful of island nations and territories discovered that the two-letter country codes assigned to them by ISO 3166 — codes allocated based on geographic names, not commercial value — could be worth more than their fisheries, their copra exports, and in some cases their entire GDP. Tuvalu's .tv now generates an estimated $10 million per year for an 11,000-person nation that used the first payment to join the United Nations. Niue's .nu — worth "now" in Swedish — generates millions annually, but none of it reaches the island. The Cocos Islands, population 600, have 10.7 million domains under .cc.

We analyzed 2.3 billion domains across 1,519 TLDs in the DomainsProject dataset and cross-referenced the data with Verisign Domain Name Industry Briefs, ICANN registry records, Interisle Consulting phishing landscape reports, Meta v. Freenom court filings, and government financial disclosures from Tuvalu, Tokelau, and Niue.

The headline: the world's smallest nations produced some of its largest TLDs — but the three dominant models for island ccTLD monetization (free registration, commercial licensing, and third-party delegation) produced radically different outcomes. Tuvalu retained sovereignty and earned $127 million. Tokelau became the global capital of phishing. Niue lost its domain to Sweden and is suing to get it back.

The Data

DomainsProject continuously crawls and indexes domains across every delegated TLD in the IANA root zone. Our dataset covers:

Domain counts reflect active DNS resolution — we count domains that resolve, not registry marketing figures. This distinction matters for island TLDs: Freenom's reported .tk registration count often included expired domains that were never deleted from the zone, inflating figures so severely that Verisign removed all five Freenom TLDs from its Domain Name Industry Brief in 2022 due to "unexplained change in estimates" and "lack of verification."

The Scorecard: Domains vs. Population

Island and Micro-Territory ccTLDs by Domain Count

*BIOT has no permanent civilian population; the territory is a US-UK military facility.

These ten territories have a combined population smaller than Tulsa, Oklahoma — yet they host 37.3 million domains, well below .org's 61.3 million but more than most major nations achieve under their own ccTLDs. France (.fr) has 20.4 million domains for 67 million people. The Cocos Islands have 10.7 million for 600.

The Domains-Per-Resident Extreme

Tokelau has 4,784 domains per resident in our dataset — and this is the post-collapse figure. At peak in 2016, .tk's 31.3 million registrations implied 20,875 domains per resident. Germany, which operates the world's largest ccTLD by any normal measure, has 0.83 domains per person. The ratio between .tk at peak and .de was 25,150 to 1.

The Freenom Experiment: Free Domains, Massive Scale, Total Collapse

The .tk phenomenon began with a Dutch entrepreneur, a 36-hour boat ride, and routers purchased for $50 on eBay.

In 2000, Joost Zuurbier — based in Amsterdam — conceived a model inspired by Hotmail's free email: give away domain names, monetize the traffic with advertising. He traveled to Tokelau, installed Internet connectivity on all three atolls, and signed a deal in Hawaii in 2001. His company, OpenTLD B.V. (later branded Freenom), would operate .tk as a free-registration ccTLD. Tokelau would receive a share of revenue. It took five years to convince ICANN — officials insisted on meeting local elders to verify the arrangement was legitimate.

The Growth Trajectory

At its 2016 peak, .tk was almost as large as .cn and .de combined. A territory where Internet access had consisted of one computer per atoll and email-only connectivity a decade earlier had more domain registrations than any country on Earth. By 2012, CNN reported that .tk domain revenue accounted for "about one-sixth" of Tokelau's economy — though Teletok, the territory's telecommunications entity, later disputed this, telling MIT Technology Review that .tk revenue was "very small" and "nothing to my revenue."

The revenue Freenom actually paid Tokelau was never publicly disclosed. Zuurbier claimed on LinkedIn that the arrangement "adds over 10% to the atolls' GDP." Other analysts estimated 10-20% of GDP, which would imply NZ$1.4 million to NZ$2.8 million per year — significant for a territory that receives NZ$4 million in annual New Zealand development aid, but a fraction of what the .tk zone was worth in aggregate advertising revenue.

The Expansion: Five Countries, One Company

Between 2012 and 2014, Freenom replicated the .tk model across four additional ccTLDs — all belonging to developing nations:

A single Dutch company controlled the domain registries of five sovereign nations — four of them among the world's least developed countries — with a combined 22.6 million domains still in our dataset. The countries received undisclosed revenue shares while bearing the reputational consequences of what those domains were used for.

The Abuse Economy: When Free Means Fraudulent

The structural problem with free domain registration was visible from the beginning. McAfee's 2007 "Mapping the Mal Web" report found that 10.1% of .tk websites contained malicious content — the worst rate of 265 TLDs examined. The incentive was straightforward: cybercriminals prefer disposable infrastructure, and a domain that costs nothing to register costs nothing to abandon when it gets flagged.

Freenom TLDs and Phishing

Five free-registration TLDs operated by a single company in Amsterdam accounted for 14% of all phishing attacks worldwide and more than 60% of all phishing on country-code domains. Spamhaus coined a term for it — the "Freenom Effect" — describing what happens when a registry's abuse rate distorts security statistics across the entire ecosystem.

The abuse was not incidental to the business model. It was the business model's structural output. Free registration with minimal identity verification meant that cybercriminals could register hundreds of domains for phishing campaigns impersonating Facebook, Instagram, and WhatsApp — and when those domains were blocked, register hundreds more at zero cost. The asymmetry was total: a phishing campaign using 100 paid domains costs $800-$1,500 in registration fees. The same campaign using Freenom domains costs nothing.

The Collapse

In December 2022, Meta filed suit against Freenom in the Northern District of California, alleging trademark infringement, cybersquatting, and violations of the California Anti-Phishing Act. The complaint cited thousands of typosquatted Meta trademarks — domains like faceb00k.ga — and sought $500 million in damages (5,000 counts at $100,000 each under the Anti-Cybersquatting Consumer Protection Act). Separately, a Dutch investor sued in the Enterprise Chamber of the Amsterdam Court of Appeal, where judges found Freenom had violated corporate reporting rules and appointed a supervisory director.

When Freenom stopped registrations in March 2023, phishing on its five TLDs plummeted — providing what the Interisle Consulting Group described as natural-experiment evidence that free registration was the primary driver of abuse, not some inherent property of the country codes themselves. But the attackers did not disappear. They migrated to cheap new gTLDs, which saw their share of phishing domains jump from 25% to 42% in the following year.

Tokelau's telecommunications entity, Teletok, is now attempting to manage .tk directly, negotiating with New Zealand's .nz registry operator for technical assistance. New registrations have effectively stagnated since October 2024. The .tk zone, once the world's largest ccTLD, is a digital ruin — 7.2 million domains in our dataset, down 77% from peak, with its reputation as a phishing vector likely permanent.

Tuvalu's .tv: How a Two-Letter Code Funded a Nation

Tuvalu's story is the counterpoint to Tokelau's — a case study in how a tiny nation can monetize its ccTLD without destroying it.

Tuvalu is nine islands in the South Pacific, population approximately 11,000, with no point higher than 4.6 meters above sea level. The country's GDP is roughly US$67 million. Climate projections suggest 50% of the capital Funafuti could flood by mid-century. By the standard metrics of national viability, Tuvalu should not matter to the global Internet.

But "TV" — Tuvalu's ISO 3166-1 alpha-2 country code — is universally understood as "television." That accident of alphabetic assignment created one of the most valuable ccTLDs on Earth.

The Deal History

The origin story reads like fiction. In 1998, Canadian entrepreneur Jason Chapnik negotiated .tv marketing rights and predicted $100 million per year in returns. When those projections collapsed, Pasadena venture firm Idealab interceded, forming dotTV Corporation and signing a deal worth approximately $50 million over 12 years — $1 million per quarter plus 20% equity in the new company.

With its first $1 million .tv payment, Tuvalu paid the approximately $100,000 fee to join the United Nations. On September 5, 2000, Tuvalu became the 189th member state — its seat at the table of global governance funded by a two-letter Internet code. The early payments also electrified outer islands and renovated the country's sole airstrip.

Cumulative Revenue

Tuvalu has earned an estimated $127 million or more from .tv over 27 years — for a country whose entire annual GDP is $67 million. At the current $10 million per year, .tv domain revenue represents approximately $909 per citizen per year, or roughly 15% of per-capita GDP. By 2019, .tv royalties accounted for 8.4% of government revenue — a figure that has likely increased since GoDaddy doubled the annual payment.

The Streaming Multiplier

The story of .tv's value is inseparable from the story of streaming video. When VeriSign acquired dotTV Corporation for $45 million in 2001, the dot-com bust had deflated .tv's premium pricing. Streaming changed the equation entirely.

Twitch.tv — launched in 2011, acquired by Amazon for $1 billion in 2014 — is now the 30th most-visited website globally. A single .tv website has more monthly active users (~140 million) than Tuvalu has citizens (~11,000) by a factor of 12,700. Eurovision.tv, Fox News's foxnews.tv, and Dropout.tv all operate under Tuvalu's country code. The streaming era is the reason GoDaddy was willing to pay double VeriSign's rate: "tv" as a brand signal for video content is now worth more than it has ever been.

The Climate Paradox

Tuvalu faces an existential irony. The nation's highest point is 4.6 meters above sea level. The Intergovernmental Panel on Climate Change projects that 95% of Funafuti could be flooded by 2100. Tuvalu is investing .tv revenue into the "Future Now Project" — climate adaptation infrastructure and digital preservation of maritime boundaries.

.tv, a purely digital asset, may outlive the physical nation that owns it. If Tuvalu becomes uninhabitable — a scenario the government is actively planning for — the question of who controls a lucrative ccTLD with no resident population has no precedent in ICANN policy.

Niue's .nu: The Domain That Got Away

If Tuvalu is the success story, Niue is the cautionary tale — a case study in what happens when a small nation loses control of its digital sovereign asset.

Niue is a single raised coral island in the South Pacific, population approximately 1,800, in free association with New Zealand. More Niueans live in New Zealand (~30,000) than on the island itself. In 1997, American businessman Bill Semich approached Niue authorities and obtained delegation of the .nu ccTLD to his Massachusetts-based nonprofit, the Internet Users Society - Niue (IUSN). He reportedly told officials the domain "has no value" — comparable to an international dialing code. In exchange, he promised free unlimited Internet access for the island.

"Nu" means "now" in Swedish, Danish, and Dutch. In the late 1990s, Sweden's own .se domain was heavily restricted — registration required a Swedish corporate identity number. Swedish Internet users began registering .nu domains en masse as an accessible alternative. At peak, .nu held over 550,000 active registrations and became the third most popular TLD in Sweden with 7% market share, behind only .se and .com.

The Transfer and the Lawsuit

In 2013, the IUSN Foundation transferred .nu operations to the Swedish Internet Foundation (Internetstiftelsen, or IIS) — the same organization that operates Sweden's .se. Niue's government claims this transfer occurred without its consent. Since the transfer, IIS has earned approximately 210 million Swedish kronor (~$20-25 million) from .nu registrations.

Niue estimates $150 million in total lost revenue across the IUSN and IIS periods. The Stockholm District Court found that IIS had "acted in accordance with applicable regulations" and did not require Niue's permission. Former Premier Toke Talagi called the ruling "a form of neo-colonialism."

The contrast with Tuvalu is stark. Both are tiny Pacific nations. Both hold ccTLDs with accidental commercial value in European languages. Tuvalu retained sovereign control, renegotiated progressively better deals, and now earns $10 million per year. Niue's ccTLD generates millions annually — for an organization in Stockholm. Niue receives nothing.

.tv vs. .nu: Two Models, Two Outcomes

The difference is not the value of the code — it is who controls it. Tuvalu negotiated as a sovereign government, hired lawyers, demanded equity stakes, and switched operators when better terms were available. Niue delegated to an American nonprofit that transferred operations to a Swedish foundation, and is now fighting in foreign courts to reclaim what was always its national asset.

The Broader Pacific: From .cc to .fm

Tokelau, Tuvalu, and Niue are the most dramatic cases, but the pattern extends across the Pacific and beyond. Small territories hold disproportionately large TLDs because ISO 3166 country codes were assigned based on geography, not demographics — and commercial value follows linguistic coincidence, not population.

The Linguistic Lottery

None of these nations chose their codes. ISO 3166 assigned them based on country names and colonial-era geography. "TV" happened to mean television. "IO" happened to resonate with software developers. "AI" happened to match the biggest technology trend of the decade. The commercial value is pure accident — and for the territories that recognized it early, that accident became a national resource.

.io is the extreme case: the British Indian Ocean Territory has no permanent civilian population (it is a US-UK military facility on Diego Garcia), yet .io hosts 13.1 million domains — the 25th-largest TLD in our dataset. The tech industry adopted .io as its de facto startup domain, and the territory's ccTLD is now worth more than most nations' digital infrastructure. .cc is similar: VeriSign acquired the Cocos Islands' ccTLD operator in 2001, and now 10.7 million domains resolve under a code belonging to a territory of 600 people.

.fm offers a different model — niche branding done well. BRS Media has operated .fm since 1998, initially targeting radio stations, but the rise of podcasting transformed the domain's market. Eight of the top ten .fm websites are now podcasting platforms, with Anchor.fm (Spotify's podcasting service) generating 2.2 billion hits in 2024. The Federated States of Micronesia earns a revenue share through a partnership that has been continuously renewed for over 26 years.

The pattern extends beyond the Pacific. Anguilla, a Caribbean island of 16,000 people, holds 3.5 million .ai domains in our dataset — a gold rush driven by the artificial intelligence boom. Unlike .tk, these are overwhelmingly paid registrations at premium prices, making .ai one of the highest-revenue ccTLDs per registration in the world. The linguistic lottery has no geographic boundary.

What's at Stake

The island TLD data reveals structural patterns that extend far beyond the Pacific:

• Ten island territories with a combined population under 500,000 host 37.3 million domains — demonstrating that ccTLD value is determined by linguistic coincidence and commercial branding, not by the country's population, economy, or Internet infrastructure. ISO 3166 codes are sovereign assets whose value is largely accidental.
• The free-registration model produced the Internet's largest abuse vector — Freenom's five ccTLDs accounted for 14% of all phishing attacks worldwide and more than 60% of all ccTLD phishing. When registrations stopped, phishing plummeted — proving the causal link between zero-cost domains and cybercrime infrastructure.
• Tuvalu has earned an estimated $127 million from .tv over 27 years — approximately twice the nation's annual GDP — by retaining sovereign control and renegotiating with successive operators. This is the gold standard for small-nation ccTLD monetization: sovereign ownership, competitive bidding, and escalating terms.
• Niue has earned effectively nothing from .nu despite the domain generating $20-25 million for its Swedish operator — a failure of initial negotiation that Swedish courts have upheld, and that ICANN has not yet resolved. For any nation that has delegated its ccTLD to a foreign entity, .nu is a warning.
• The post-Freenom attack migration proves that domain abuse is economic, not geographic — when Freenom's five free TLDs shut down, attackers moved to cheap new gTLDs (whose phishing share jumped from 25% to 42%). The problem is price, not provenance. Any registration model that approaches zero cost will attract abuse proportional to the discount.
• Climate change creates an unprecedented governance question for .tv — if Tuvalu becomes uninhabitable within decades, a $10-million-per-year ccTLD will exist without a resident population. ICANN has no framework for ccTLD governance when the "country" in "country-code" ceases to physically exist.

What Would Help

1. Small nations: treat your ccTLD as sovereign critical infrastructure, not a licensing deal. Tuvalu's progressive negotiation — from $2 million per year to $10 million, with operator changes when terms stalled — demonstrates the approach. Niue's delegation to a foreign nonprofit without meaningful oversight demonstrates the risk. Any nation that has outsourced ccTLD operations should review its contract terms, revenue share, and reversion rights with the same seriousness it applies to fisheries licenses or mineral rights.

2. ICANN: establish binding standards for ccTLD delegation and sovereign consent. The .nu dispute — where a Pacific island nation has spent six years in Swedish courts trying to reclaim its country code — exposes a governance gap. ICANN's ccTLD delegation framework should require demonstrable sovereign consent for any transfer of operational control, with automatic reversion mechanisms when consent is disputed. The current system allowed a Massachusetts nonprofit to transfer a nation's digital identity to a Swedish foundation without that nation's agreement.

3. Security researchers: use the Freenom shutdown as a natural experiment. The March 2023 registration halt and March 2024 domain kill produced the cleanest before-and-after dataset in phishing research history. Interisle's findings confirm the causal link between free registration and abuse volume. Researchers should analyze the migration patterns — which TLDs absorbed the displaced abuse, at what rates, and whether price thresholds exist below which abuse becomes inevitable. Start with our TLD statistics pages for .tk, .cf, .ml, .ga, and .gq.

4. Registries and ICANN: establish minimum pricing floors to prevent the next Freenom. The data is unambiguous: TLDs with registration costs approaching zero attract abuse rates orders of magnitude higher than paid TLDs. Interisle's reports consistently show correlation between registration price and abuse rate. A minimum wholesale price — even $1 per domain per year — would eliminate the economic incentive for disposable phishing infrastructure without materially affecting legitimate registrations.

5. Climate and governance researchers: address the .tv precedent before it becomes urgent. Tuvalu is actively planning for the possibility that its islands become uninhabitable. The nation's "Te Lafiga o Tuvalu" adaptation plan includes digital preservation of maritime boundaries and sovereignty. .tv — worth $10 million per year and growing — needs to be part of that planning. ICANN, the Pacific Islands Forum, and the UN should establish frameworks for ccTLD continuity when sovereign states face existential geographic threats. The precedent set for .tv will apply to every low-lying nation with a ccTLD.

This analysis was conducted using the DomainsProject dataset, which continuously indexes domains across all 1,519 active TLDs in the IANA root zone. Dataset domain counts reflect active DNS resolution as of March 2026. Historical .tk registration figures are from ZookNIC/Verisign Domain Name Industry Briefs and Freenom corporate filings. Tuvalu revenue estimates are compiled from dotTV Corporation records, VeriSign contract disclosures, GoDaddy Registry announcements, and government financial reports. Niue legal proceedings are sourced from Stockholm District Court filings and ICANN correspondence. Phishing data is from the Interisle Consulting Group Phishing Landscape 2024 report and earlier editions (2021-2023), the Cybercrime Information Center, Spamhaus, and APWG. Explore island TLD statistics on our TLD statistics pages, browse the full TLD dashboard, or access the complete dataset for your own research.