Domain Hacks: Creative TLD Tricks (And Where They Break)

What a Domain Hack Actually Is

A domain hack is a domain name that spells a word or phrase when you read straight across the dot, folding a country-code top-level domain (ccTLD) into the end of the word instead of treating it as a separate suffix. "Hack" here means clever trick, the same sense as in "programming hack" — not a security exploit.

The technique's founding example is del.icio.us. The social-bookmarking site icio.us registered its domain on May 3, 2002, using the .us ccTLD, just days after the United States opened .us to ordinary second-level registration on April 24, 2002 — before that, .us only allowed deep, bureaucratic addresses like "name.locality.state.us." Delicious then layered "del" on as a subdomain, so the full string read del.icio.us — read slowly it looks like nonsense, read at speed it says "delicious" (ICANNWiki, Wikipedia). Yahoo bought the company in 2006; the product itself shut down in 2017. As of this writing, del.icio.us still resolves in a browser, but its TLS certificate has expired — a fittingly half-abandoned state for the hack that started the trend.

The Hall of Fame (and What Happened to Each)

Domain hacks took off in the URL-shortener era, when brevity was the entire product. Here's what each of the most-cited examples actually spells, which country's ccTLD it borrows, and its verified status today.

Verified directly by fetching each domain, July 2026. History and origin details: ICANNWiki, Wikipedia, Matt Mullenweg, Google Developers Blog.

Two things stand out. First, most of these were built for a URL-shortener use case where the whole domain is the product — which is why goo.gl's death and itun.es's disappearance didn't take a company down with them; the shortener was disposable, the brand behind it wasn't. Second, ma.tt is the purest form of the trick: no shortener function at all, just a name spelled correctly using a country most people have never registered anything in. Matt Mullenweg found it by scanning a spreadsheet of ccTLDs looking for one that would spell his own name, and paid roughly $500/year for the first two years via international wire transfer, since Trinidad and Tobago's registry didn't take credit cards at the time (Matt Mullenweg, ma.tt).

When the Hack Breaks: vb.ly and the Sharia Law Clause

The clearest cautionary tale in domain-hack history is vb.ly. Journalist Violet Blue and Ben Metcalfe registered the two-letter .ly domain in 2009 for a link-shortening tool. In September 2010, Libya's registry, NIC.ly, deleted vb.ly without warning, telling the owners that its content — reportedly including a photo of Blue with bare arms and the phrase "sex-positive" — violated Libyan Islamic Sharia law and was therefore "offensive, obscene and illegal" (The Register, CircleID).

The seizure triggered a policy change that's still in effect: as of June 2010, any .ly domain of four characters or fewer became restricted to registrants with an actual presence in Libya. Existing short .ly domains could keep renewing, but new registrations of that length were closed to the rest of the world (TheDomains.com). Bitly's own three-letter SLD ("bit") would qualify as a restricted short name under that rule today, but bit.ly predates the 2010 policy change and, as an existing registrant, was grandfathered in.

The lesson generalizes past Libya: a ccTLD is a piece of internet infrastructure that a national government or its delegated registry controls, and that government's content rules — whatever they are — apply to you even if you've never set foot in the country.

Which TLDs Actually Make Good Hacks

Not every ccTLD is created equal for this purpose. Some read as real English fragments, some are cheap and unrestricted, and some carry genuine geopolitical or policy risk. Here's the honest rundown of the ten most commonly used for hacks:

Pricing and restriction details aggregated from TLD-List, TLD-List (.ly), Namecheap, and registrar listings for each TLD, July 2026; .ai figure specifically from reporting on Anguilla's registry pricing change (see below); .er confirmed unregistrable across multiple registrar factsheets.

A quick read on the two extensions with real continuity questions, both covered in more depth elsewhere on this site: .io vs .com walks through .io's Chagos-treaty risk in full, and the pricing/2-year-term tradeoffs of .ai are part of the broader startup-extension picture on this site as well.

The .io Wildcard: A Domain Hack Built on a Disputed Territory

.io is the single most-used ccTLD for tech-branded domain hacks and startup names generally, because "io" reads naturally as computing's own "input/output." But .io is assigned to the British Indian Ocean Territory (BIOT), and in October 2024 the UK and Mauritius reached a political agreement to transfer sovereignty of the underlying Chagos Archipelago to Mauritius, formalized in a treaty signed May 22, 2025 (ICANN).

ICANN's ccTLD assignments are tied to a live ISO 3166-1 country code. If "IO" is ever formally retired from that standard, ICANN's own retirement policy would kick in, which allows a multi-year phase-out window rather than an overnight shutdown. With more than 1.6 million .io domains registered against Mauritius's own .mu registry holding only around 24,731, a fast kill looks commercially and politically unlikely — but "unlikely" isn't "guaranteed," and as of mid-2025 no formal retirement decision had been made either way (Domain Incite, The Register).

Do Domain Hacks Hurt SEO?

Not automatically, and this is where a lot of casual advice gets it wrong. Google's own Search Central documentation explicitly distinguishes two categories: true ccTLDs, which Google reads as a strong signal that a page targets that specific country, and a defined list of ccTLDs that Google treats as generic (gTLD-like) instead, "as we've found that users and website owners frequently see these more generic than country-targeted." That list includes .io, .ai, .co, .me, and .tv — along with .ad, .as, .bz, .cc, .cd, .dj, .fm, .la, .ms, .nu, .sc, .sr, .su, .tk, and .ws (Google Search Central).

So a hack built on .io, .ai, .co, .me, or .tv doesn't get silently geotargeted to a random country in Google's index. But .ly, .it, .tt, .am, .kr, .es, .fi, .be, .af, .gl, and .sh are not on that generic list — meaning Google's default behavior can read a hack built on one of those as a country-targeted site, which is the wrong signal for a global product. Google's documented fix is straightforward: explicitly set a country target (or none) rather than leaving it to the extension to imply one, using hreflang, a subdirectory/subdomain structure, or Search Console's international targeting settings. For more pitfalls when a name crosses borders, see international domain name mistakes.

How to Hunt for a Domain Hack

1. Start from the word, not the TLD. Write out the exact word or phrase you want, then look at where a natural break falls two or three letters from the end — that's your candidate ccTLD.
2. Use a generator, not manual guessing. Tools like domainhacks.info (which checks against roughly 1,466 TLDs) and Dot-o-mator take a word or word-pair and surface every valid split automatically, which is far faster than scanning an ISO country list by hand (domainhacks.info, Dot-o-mator).
3. Verify availability live, not from a cached list. Generator tools are good at generating candidates and bad at confirming they're actually free right now. Check any shortlist directly — Domain Search King's multi-TLD availability check confirms status live via RDAP rather than a stale index.
4. Check the registry's actual rules before falling in love with a name. Some ccTLDs require local presence for short names (.ly), some require a minimum multi-year term (.ai), and a few aren't registrable through any public channel at all (.er). Five minutes on the registry's own policy page beats finding out after you've already told people your new name.
5. Run a trademark check. A clever split doesn't override someone else's mark. Under the UDRP, a complainant with a registered trademark can reclaim a domain if it's confusingly similar and registered in bad faith — plenty of ccTLD registries mirror UDRP or run a close local equivalent (WIPO UDRP Guide).

The general principles for picking any name still apply on top of the ccTLD-specific checks — see the full domain naming guide for the naming fundamentals a clever split doesn't replace.

Frequently Asked Questions