Phishing Activity in Domain Registrars, May 1, 2023 - July 31, 2023
Phishers compose hostnames and URLs from domain names that they register purposely for phishing (malicious domain registrations), or from domain names that they have exploited in some way (e.g., by hijacking a domain registration account or by compromising a host such as a web site). They embed these URLs in the emails, texts, or social media posts that lure victims to phishing web sites.
To determine where gTLD domain names were purchased and managed, and where reported phishing domains are concentrated in gTLD registrars’ domain portfolios, we identify the domain name Registrar - the business entity that processed the domain name registration – of domain names reported for phishing activity from domain name registration data obtained via the Whois or RDAP services. Measurements of reported phishing domains can identify registrars where close analyses of business practices, account security, or pricing might prove useful.
We currently collect domain registration data for generic Top-level Domains only; thus, the tables on this page present gTLD domains under management for each registrar.
In the table below, we show the domain name Registrars with the highest number of reported phishing domains under management. A complete list of gTLD registrars where phishing was reported for the quarter can be downloaded in CSV format from the Records page.
Ranking of Domain Registrars by Phishing Domains (May to July 2023)
Registrars with a minimum of 30,000 domains and 25 phishing domains
Rank | Registrar | Registrar IANA_ID | gTLD Domains under Management |
Phishing Domains ▼ | Phishing Domain Score |
1 | PDR Ltd. d/b/a PublicDomainRegistry.com | 303 | 4,205,319 | 18,525 | 44.05 |
2 | NameSilo, LLC | 1479 | 3,521,035 | 12,035 | 34.18 |
3 | GoDaddy.com, LLC | 146 | 64,115,816 | 11,308 | 1.76 |
4 | NameCheap, Inc. | 1068 | 13,051,112 | 9,336 | 7.15 |
5 | eNom, LLC | 48 | 4,008,803 | 5,639 | 14.07 |
6 | GMO Internet Group, Inc. d/b/a Onamae.com | 49 | 3,794,400 | 4,984 | 13.14 |
7 | Google LLC | 895 | 9,020,378 | 4,334 | 4.80 |
8 | NICENIC INTERNATIONAL GROUP CO., LIMITED | 3765 | 49,925 | 4,299 | 861.09 |
9 | Gname.com Pte. Ltd. | 1923 | 3,066,248 | 3,788 | 12.35 |
10 | Sav.com, LLC | 609 | 1,226,401 | 3,687 | 30.06 |
11 | HOSTINGER operations, UAB | 1636 | 1,071,089 | 3,332 | 31.11 |
12 | Tucows Domains Inc. | 69 | 9,390,685 | 2,312 | 2.46 |
13 | Dynadot Inc | 472 | 2,652,055 | 2,276 | 8.58 |
14 | PSI-USA, Inc. dba Domain Robot | 151 | 1,044,452 | 2,052 | 19.65 |
15 | Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) | 1599 | 1,747,446 | 1,734 | 9.92 |
16 | Web Commerce Communications Limited dba WebNic.cc | 460 | 706,026 | 1,706 | 24.16 |
17 | OwnRegistrar, Inc. | 1250 | 716,182 | 1,580 | 22.06 |
18 | Chengdu West Dimension Digital Technology Co., Ltd. | 1556 | 991,322 | 1,578 | 15.92 |
19 | Hosting Concepts B.V. d/b/a Registrar.eu | 1647 | 1,080,725 | 1,560 | 14.43 |
20 | Registrar of Domain Names REG.RU LLC | 1606 | 509,909 | 1,493 | 29.28 |
To allow comparison of large and small gTLD registrars, we rank registrars based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a registrar by the number of domains delegated from that registrar.
gTLD registrar Phishing Score = (number of phishing domains/domains delegated from gTLD registrar) * 10,000
This score can highlight where high-volume phishers place multiple phish on one domain.
Table 2 presents the twenty gTLD registrars that had the highest phishing domain score.
Ranking of Domain Registrars by Phishing Domain Score (May to July 2023)
Registrars with a minimum of 30,000 domains and 25 phishing domains
Rank | Registrar | Registrar IANA_ID | gTLD Domains under Management |
Phishing Domains | Phishing Domain Score ▼ |
1 | NICENIC INTERNATIONAL GROUP CO., LIMITED | 3765 | 49,925 | 4,299 | 861.09 |
2 | TLD Registrar Solutions Ltd. | 1564 | 51,038 | 244 | 47.81 |
3 | PDR Ltd. d/b/a PublicDomainRegistry.com | 303 | 4,205,319 | 18,525 | 44.05 |
4 | NameSilo, LLC | 1479 | 3,521,035 | 12,035 | 34.18 |
5 | Beget LLC | 3806 | 48,577 | 157 | 32.32 |
6 | HOSTINGER operations, UAB | 1636 | 1,071,089 | 3,332 | 31.11 |
7 | Sav.com, LLC | 609 | 1,226,401 | 3,687 | 30.06 |
8 | Registrar of Domain Names REG.RU LLC | 1606 | 509,909 | 1,493 | 29.28 |
9 | ALIBABA.COM SINGAPORE E-COMMERCE PRIVATE LIMITED | 3775 | 542,106 | 1,493 | 27.54 |
10 | NETIM SARL | 1519 | 68,745 | 168 | 24.44 |
11 | Internet Domain Service BS Corp | 2487 | 400,546 | 971 | 24.24 |
12 | Web Commerce Communications Limited dba WebNic.cc | 460 | 706,026 | 1,706 | 24.16 |
13 | OwnRegistrar, Inc. | 1250 | 716,182 | 1,580 | 22.06 |
14 | Cosmotown, Inc. | 1509 | 221,762 | 466 | 21.01 |
15 | PSI-USA, Inc. dba Domain Robot | 151 | 1,044,452 | 2,052 | 19.65 |
16 | Atak Domain Bilgi Teknolojileri A.Ş. | 1601 | 258,645 | 480 | 18.56 |
17 | CV. Jogjacamp | 1478 | 140,136 | 227 | 16.20 |
18 | Chengdu West Dimension Digital Technology Co., Ltd. | 1556 | 991,322 | 1,578 | 15.92 |
19 | Hosting Concepts B.V. d/b/a Registrar.eu | 1647 | 1,080,725 | 1,560 | 14.43 |
20 | Hello Internet Corp. | 1924 | 68,825 | 99 | 14.38 |
The final table ranks gTLD registrars by malicious domain registrations.
Ranking of Domain Registrars by Malicious Phishing Domains (May to July 2023)
Registrars with a minimum of 30,000 domains and 25 phishing domains
Rank | Registrar | Registrar IANA_ID | gTLD Domains under Management |
Malicious Phishing Domain Registrations ▼ |
Malicious Phishing Domain Score |
1 | NameSilo, LLC | 1479 | 3,521,035 | 8,743 | 24.83 |
2 | PDR Ltd. d/b/a PublicDomainRegistry.com | 303 | 4,205,319 | 8,557 | 20.35 |
3 | NameCheap, Inc. | 1068 | 13,051,112 | 5,279 | 4.04 |
4 | GoDaddy.com, LLC | 146 | 64,115,816 | 4,996 | 0.78 |
5 | eNom, LLC | 48 | 4,008,803 | 3,842 | 9.58 |
6 | NICENIC INTERNATIONAL GROUP CO., LIMITED | 3765 | 49,925 | 3,276 | 656.18 |
7 | GMO Internet Group, Inc. d/b/a Onamae.com | 49 | 3,794,400 | 3,043 | 8.02 |
8 | Google LLC | 895 | 9,020,378 | 2,894 | 3.21 |
9 | Sav.com, LLC | 609 | 1,226,401 | 2,866 | 23.37 |
10 | Gname.com Pte. Ltd. | 1923 | 3,066,248 | 2,776 | 9.05 |
11 | HOSTINGER operations, UAB | 1636 | 1,071,089 | 2,038 | 19.03 |
12 | PSI-USA, Inc. dba Domain Robot | 151 | 1,044,452 | 1,942 | 18.59 |
13 | Dynadot Inc | 472 | 2,652,055 | 1,367 | 5.15 |
14 | Chengdu West Dimension Digital Technology Co., Ltd. | 1556 | 991,322 | 1,300 | 13.11 |
15 | Tucows Domains Inc. | 69 | 9,390,685 | 1,217 | 1.30 |
16 | Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) | 1599 | 1,747,446 | 1,066 | 6.10 |
17 | ALIBABA.COM SINGAPORE E-COMMERCE PRIVATE LIMITED | 3775 | 542,106 | 1,052 | 19.41 |
18 | Hosting Concepts B.V. d/b/a Registrar.eu | 1647 | 1,080,725 | 1,025 | 9.48 |
19 | Registrar of Domain Names REG.RU LLC | 1606 | 509,909 | 988 | 19.38 |
20 | OwnRegistrar, Inc. | 1250 | 716,182 | 860 | 12.01 |
Quarterly Update: Key Statistics |
Quarterly Update: Top Level Domains |
Quarterly Update: Registrars |
Quarterly Update: Hosting Networks |
Quarter over Quarter: Registrars |