Country-code domain hacks: .sh, .to, .gg, .so, and their quirks

A domain hack spells a name across the dot — youtu.be reads as “youtube” — and if the technique itself is new to you, domain hacks explained covers how to find and vet one. This article is the companion catalog: the country-code extensions founders actually reach for, and the registration rules, quirks, and honest risks behind each two-letter code. The first thing to internalize is that “open to anyone” is not universal. Every ccTLD belongs to a real territory whose registry sets its own policy: Libya reserves every .ly name shorter than four characters for registrants with a local presence, and Saint Helena restricts second-level names like .com.sh to residents even though plain .sh is wide open.

What are the four workhorse hack extensions?

.sh — Saint Helena. The ccTLD of this UK Overseas Territory is fully open: first-come, first-served, no residency or business requirement. The only restriction sits one level down — second-level registrations such as .com.sh are reserved for Saint Helena residents — which is irrelevant for hacks, since you register directly under .sh. The draw is linguistic: it finishes words ending in -sh, and for developer tools it happens to read as the shell-script file extension.

.to — Tonga. Open to any interested party, with registrations typically running a minimum of about two years. The extension reads as the preposition “to,” which makes verb-first hacks work. It also carries reputation baggage worth understanding rather than fearing: .to became a byword for piracy sites (isohunt.to among them) largely because the original Tonic registry platform, running since 1997, had no technical way to suspend a domain. That era is over — as of 2026 Tucows runs the technical backend, takedowns are possible, and the pirate-haven reputation is fading history rather than current fact. A related myth needs busting too: .to domains absolutely do require renewal, and a lapsed domain becomes available to others roughly a month after expiry.

.gg — Guernsey. The Channel Islands Crown Dependency runs an open registry: no eligibility restrictions, first-come-first-served, minimum one-year term. Its niche is cultural rather than linguistic — “gg” is gaming slang for “good game,” which has made it the default badge for gaming and esports projects.

.so — Somalia. Open worldwide, no residency requirement, with terms of one to ten years. It ends plenty of English words and reads as the word “so.” One light caveat: the registry’s administration has changed hands a few times — SONIC took over in 2015, then Somalia’s National Communications Authority in 2018 — a sign of some administrative churn, not a reason for alarm.

Which extensions sit on the worth-knowing tier?

.io — British Indian Ocean Territory. Open worldwide with no restrictions, and the long-standing developer favorite. It comes with one genuinely unresolved geopolitical footnote: the UK and Mauritius signed a treaty in May 2025 to transfer sovereignty over the Chagos Archipelago — the territory .io is tied to — but the treaty remains unratified, and the UK’s implementing bill died when Parliament prorogued in April 2026 and has not been reintroduced. As of July 2026 the plan is stalled with no confirmed timeline. No ICANN or registry decision about .io has been made or announced, and even if the underlying country code were ever retired, IANA’s own process would take at least five years, realistically five to ten. Day-to-day registration and use are unaffected; treat this as an evolving situation to watch, not a reason to avoid the extension.

.me — Montenegro. Fully open to everyone since 2008 and marketed hard for personal branding — the extension is a pronoun, so name.me constructions read as tiny sentences.

.co — Colombia. Open globally since July 2010, positioned as shorthand for “company” when the .com is taken. Its registry operator changes more often than people assume: as of 2026 it is run by a consortium led by Team Internet Group, which took over from GoDaddy in 2025.

.tv — Tuvalu. Open to anyone apart from a short reserved list (com.tv, net.tv, and similar). It reads as “television,” which makes it barely a hack at all for anything video-shaped. The registry contract moved from Verisign to GoDaddy in 2021, and domain income reportedly funds a meaningful slice of Tuvalu’s government budget — a reminder that these extensions are national assets, not neutral infrastructure.

.ly — Libya. This one gets an honest risk flag, not just colorful history. It is technically open worldwide — except that names shorter than four characters require a Libyan local presence — and it ends every English adverb, which is why link shorteners loved it. But the Libyan registry has actually seized live domains over content: in 2010 it took down vb.ly — and, around the same period, gaddaf.ly — for content it deemed to violate Libyan law. That reflects a registry willing to enforce local content standards, and it could happen again. If your product or content could plausibly offend that standard, pick a different dot.

One SEO aside: as of 2026, Google treats .io, .me, .co, and .tv as “generic” ccTLDs with no automatic geotargeting, while .sh, .to, .gg, .so, and .ly are not on that list — do exotic TLDs hurt SEO? explains what that means in practice. And if you would rather build a hack on European codes, European country-code domains for founders catalogs those the same way.

How do you pick one and move on?

The pattern across all nine extensions: the wordplay is the easy part, the registry policy is the diligence. Check openness, minimum terms, renewal reality, and — for .ly especially — content risk before you commit. The domain.yoga generator handles the fun half: describe your product and it proposes names, hacks included, with live availability on each candidate, so every option on your shortlist is real and registrable today.