Every country has a code—two letters assigned by the bureaucratic machine of ISO in the mid-seventies, long before anyone thought to hook those codes up to the internet. The irony is that the most unexpectedly liquid asset those two letters created lives in the registries that sell domain names under them. For a tiny territory, that asset can become one of its main sources of income—sometimes on a par with fishing and tourism.
I got pulled into this topic by a side detail. In the Nvidia options case that hit the feed the other day, it emerged that its central figure had, in parallel, been building up the national .TO zone together with the Crown Prince of Tonga. I noted it at the time: microstates started trading on their place on the internet before that became normal.
We already did a separate deep dive on Tonga’s paper satellites, where the kingdom leases orbital slots—they trade in a place in the ITU registry queue there. But the same thing happens one floor down, at the domain level, where the commodity is the name itself. What interests me here is the economics: a nation as a rentier, whose entire rental property consists of one legal fact about itself. And this economy has a second act—what happens to the rent when the country vanishes from the map or relocates.
Tuvalu got .tv without lifting a finger: its ISO code matched the standard abbreviation for television. Until 1998, it was a line in a registry with no commercial meaning. Then the government signed a deal with Canada’s Information.CA, which promised $50 million for exclusive management of the zone—the money arrived late, the contract was rewritten for California’s Idealab, and in 2001 Verisign bought the business for $45 million, including the buyout of Tuvalu’s own stake.
For twenty years, the islands received a fixed sum. First $550 thousand per quarter, then around $5 million a year—even as Verisign, according to PINA, was collecting roughly $25 million annually from 500 thousand domains: domains sold for an average of $50, while the cost of maintaining the registry was estimated at around 75 cents per name. Tuvalu’s finance minister, Lotoala Metia, publicly called that deal “peanuts.”
In 2021, Verisign simply did not submit a renewal bid—the “winner” field went to GoDaddy Registry, and Tuvalu changed its model: instead of a fixed check, the zone now receives a percentage of sales. In Tuvalu’s 2025–26 budget, the dotTV Marketing line stands at around 11 million Australian dollars, against 9.1 million actually received in 2023, and the growth is attributed to premium-name sales. For comparison, fishing licenses in the same budget bring in 41.7 million, while total government revenue is 114.1 million.
The number is secondary here: by 2019, this zone accounted for 8.4% of government revenue. Eight percent of the national treasury came from letters Tuvalu received from an international standard simply by alphabetical chance. The money went into a fund and into the Future Now project—a digital copy of the country in case its territory has to be abandoned.
Niue’s story is more elegant and more unpleasant. In 1997, the .nu zone was handed to the Massachusetts nonprofit IUSN, which came up with a brilliant move: “nu” means “now” in Swedish, Danish, and Dutch, while in English it sounds like “new.” It was marketed as an alternative to .com, with an untouched supply of short names.
Money from other people’s domains paid for free Wi-Fi across one hundred square miles of the island and for internet cafés—in 2003, Niue, with a population of around 1700, got connectivity that many parts of Europe did not have. In 2013, technical management of the zone passed to Sweden’s Internetstiftelsen, and two years later it emerged that two-thirds of active .nu domains belonged to Swedes.
Niue’s government considers this theft. In 2018, it filed suit in Stockholm District Court, calling the zone a national asset and putting its lost profits at $150 million—money an island with a budget of several million had, naturally, never seen. The district court rejected the case in March 2024; the appeal court did so in June 2025, and its reasoning was mockingly simple: the foundation had acted by the rules, while the claim had been aimed at the wrong defendant. Delegation of the zone belongs to IUSN; the Swedes merely service it under contract.
Niue’s diplomat in the dispute, Pär Brumark, calls what is happening “digital colonization.” It is a strong term, but it describes something specific: the island was deprived not of property it did not formally possess under the rules, but of control over its own name.
Tokelau is three atolls and around two thousand residents. In 2021, the .tk zone listed more than 24 million domains: Dutch company Freenom gave them away for free, earning on ancillary services, and an island with fewer people than a single Moscow courtyard nominally hosted the world’s largest zone.
Free names attract more than enthusiasts. In February 2023, the five zones managed by Freenom accounted for around 13% of all malicious names observed online. Then Meta filed a lawsuit estimated at roughly $500 million, Freenom stopped registering new names in January 2023, and in February 2024 announced its exit from the registry business.
The figures for what happened afterward explain the nature of that boom better than any words. The number of malicious domains in .tk collapsed by 94.8% in March 2023—from 1981 to 104—while the five Freenom zones’ share of the global pool of observed attacks fell from 13% to 1.4% in one month. By March 2024, around 12.6 million domains, almost 99% of the zone, had stopped resolving; at Cloudflare, which hosted half of them, the number of serviced domains dropped by 22%.
So the “world’s most popular zone” was not a collection of websites, but a warehouse of disposable trash. Today, .tk has around 76 thousand names left—three hundred times fewer, and that is perhaps the most honest measure of how much in the zone was real.
The Cocos Islands are an Australian territory more than two thousand kilometers from Perth, and in the nineties their .cc code was promoted by American entrepreneur Brian Cartmell under the slogan “the next .com.” Its visual resemblance to .com sold better than any promise: according to the Anti-Phishing Working Group, sites in this zone accounted for 6% of global phishing attacks in 2016. In 2011, Google purged more than 11 million addresses in the affiliated co.cc zone from its results.
The Cocos Islands Shire, in an interview with the Australian press, says rather vaguely that the registry has “always provided generous support” for the islands’ telecommunications needs. The territory’s own annual reports contain no revenue line for domain sales. The gap between “generous support” and a percentage of registry revenue is the whole story; the man who has represented Niue in its dispute for ten years puts it bluntly: a registry has absolutely no incentive to shut down domains that violate national laws—perhaps the customer comes precisely for the absence of rules.
Formally, all of this contradicts the document on which the system has stood since 1994. RFC 1591 says that the designated manager is “the trustee of the top-level domain for the designated country,” has a duty to serve the community, and that “concerns about ‘rights’ and ‘ownership’ of domains are inappropriate.” In thirty years, that text has remained an ethical wish: the “community” has neither a procedure nor an account. No code in ISO 3166-1—no zone.
The shutdown mechanism is written down, and it works. Formally, there is one trigger: the code disappears from the ISO 3166-1 list. IANA then sends the manager a retirement notice, and under the policy adopted by ICANN in 2022, five years normally pass before removal from the root zone—ten at most, if the manager requests an extension.
The precedents are documented in detail. .yu survived for twenty years after Yugoslavia’s breakup, until in 2010 it was handed to a Serbian registrar as a temporary caretaker. .an was struck out on October 31, 2014, after the dissolution of the Netherlands Antilles—though google.com.an and visa.com.an had managed to exist under the code. .tp for East Timor coexisted with .tl for another thirteen years: in 2008, there were twice as many domains under the old code as under the new one, and it was finally removed in February 2015.
The strangest entry on that list is .um, the code for the United States Minor Outlying Islands. The zone was killed for an everyday reason: the operator got tired of maintaining it. An institute at USC wrote to ICANN that the zone was empty and it no longer wanted to be responsible for it.
A separate story is .su, the domain of a country that has not existed for thirty-five years. The code “SU” still appears in ISO with the designation “exceptionally reserved,” and that saves the zone: in March 2025, news raced around that ICANN had notified RosNIIROS of the domain’s retirement by 2030, agencies amplified it, and the registry issued a denial—no formal action had begun, and the code remained on the list. I could find neither a procedural basis for that date nor official confirmation; the sources on this subject contain a contradiction, and I am leaving it as it is. For our purposes, something else matters more: the zone has 111.6 thousand sites, and it survives solely thanks to the status of two letters in a standard, not thanks to a country.
The latest story looks like the previous ones, only with a different outcome. In 2024, the .ai zone brought Anguilla EC$105.5 million (Eastern Caribbean dollars, roughly $39 million)—almost a quarter of all government revenue, while in 2025, according to industry estimates, revenue approached $85 million. In the first six months of 2026, EC$196.8 million was collected, more than eighty-five percent of all of last year. In January 2026, the number of domains passed one million, growing by around two thousand a day. The owner of you.ai—HubSpot cofounder Dharmesh Shah—reportedly paid $700 thousand for the address; in February 2026, bot.ai went for $1.2 million.
Unlike Tuvalu, Anguilla entered the arrangement from the start as a partner, not as a recipient of a fixed check: in October 2024, it signed a five-year contract with Identity Digital and takes around 90% of the revenue, leaving the registry roughly a tenth. In March 2026, the wholesale price rose from $70 to $80 a year; since the minimum registration term is two years, the bill went from $140 to $160, up fourteen percent. Domain Name Wire calculated that with a million names, this brings around $9 million in additional annual receipts—and reviews immediately appeared calling the new price $90.
The sources diverge here, and I will not pretend the numbers line up. BBC, citing a budget document, wrote of 23% of all government revenue in 2024. An industry review, citing IMF data and local press, says “roughly half” in 2025. Anguilla’s own budget puts it more carefully—“almost forty percent of non-tax revenue.” The bases of comparison differ, and exactly how much the domain feeds the island depends on which share you count.
But this story has a detail worth spelling out: in 2025, the zone’s server infrastructure was moved off the island into Identity Digital’s global network—so hurricanes and power outages would not bring down the registry. The money stayed in the Caribbean; the technical layer left. According to the premier’s budget address, it paid for a new airport, cameras across the island, and hospital programs.
Everything above is a historical anecdote until you get to .io. This code belongs to the British Indian Ocean Territory, meaning the Chagos Archipelago, where the population was expelled and the main island, Diego Garcia, was occupied by a military base. In May 2025, Britain and Mauritius signed a treaty transferring sovereignty, and the question arose immediately: if a territory by that name no longer exists, does “IO” leave ISO, taking with it a zone of more than a million names?
ICANN answered exactly as its own policy prescribes: nothing changes while the code remains in the standard, and if it goes—the general five years kick in. Then politics intervened in politics: in early 2026, the treaty was frozen after the United States withdrew its consent, ratification stalled, and Britain remained at the helm. So today there is no timer over .io—only a reprieve.
The difference from .tk and .cc is where the addresses live. .io hosts infrastructure, not casino advertising: docker.io, the default namespace for every Docker installation, registry.k8s.io, from which virtually all Kubernetes clusters pull images, crates.io with Rust packages, and github.io with millions of pages. A brand can move—painfully, but it can; the default address of a container registry, hardwired into configs around the world, moves only through a synchronized change across the entire industry. The Kubernetes project has already opened a ticket to assess the consequences, and that is perhaps the most honest monument to how deeply the code of a small disputed territory can grow into infrastructure.
A reminder that the stakes are not theoretical sits right alongside it: in June 2023, Gabon took control of .ga from its former operator, and seven million names vanished in four days of migration. In 2021, on the day Brexit ended, EURid shut down more than 80 thousand domains belonging to Britons—they simply no longer met the rules. In 2024, an agency under Taliban control closed domains in .af, including the queer.af service, two months before their paid term expired. In 2010, Libya seized vb.ly for violating morality laws and warned all holders of short names in its zone at the same time.
The conclusion to this story is dull: the registry never sold islands a place on the internet. It sold everyone else the confidence that two letters are just an address, not someone’s foreign policy. Tuvalu puts the rent into a fund meant to pay for the relocation of a country that may no longer exist—while Anguilla uses the same money to build an airport and hang cameras. The difference between those two ways of using a chance asset seems to be the only thing the islands in this arrangement really control.