Phishing Activity in Top-level Domains (TLDs)
August 1, 2022 - October 31, 2022

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (August to October 2022)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 159,520,160 82,903 5.2
2 live 632,676 28,063 443.6
3 cn 7,577,302 20,697 27.3
4 ml 6,486,099 19,217 29.6
5 tk 5,773,787 14,158 24.5
6 top 1,832,304 13,326 72.7
7 xyz 4,113,321 8,741 21.3
8 info 3,666,146 7,048 19.2
9 ga 8,632,256 6,456 7.5
10 cf 6,149,421 5,862 9.5
11 shop 1,184,827 5,715 48.2
12 us 1,903,740 5,654 29.7
13 online 1,964,896 5,272 26.8
14 net 13,075,439 5,170 4.0
15 gq 5,027,257 4,330 8.6
16 org 10,655,323 3,933 3.7
17 icu 1,002,641 3,461 34.5
18 site 1,061,799 2,933 27.6
19 pw 316,337 2,680 84.7
20 rest 46,066 2,667 579.0

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (August to October 2022)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 rest 46,066 2,667 579.0
2 live 632,676 28,063 443.6
3 support 31,937 459 143.7
4 link 190,940 2,354 123.3
5 tokyo 181,538 1,982 109.2
6 pw 316,337 2,680 84.7
7 top 1,832,304 13,326 72.7
8 finance 47,542 313 65.8
9 shop 1,184,827 5,715 48.2
10 click 233,205 1,101 47.2
11 wtf 32,793 147 44.8
12 fun 332,320 1,357 40.8
13 bond 31,571 124 39.3
14 network 70,989 279 39.3
15 fyi 48,813 187 38.3
16 icu 1,002,641 3,461 34.5
17 cloud 237,871 708 29.8
18 us 1,903,740 5,654 29.7
19 ml 6,486,099 19,217 29.6
20 tech 405,496 1,142 28.2

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (August to October 2022)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 159,520,160 49,702 3.1
2 live 632,676 25,927 409.8
3 ml 6,486,099 19,217 29.6
4 tk 5,773,787 14,158 24.5
5 top 1,832,304 12,388 67.6
6 ga 8,632,256 6,456 7.5
7 xyz 4,113,321 6,362 15.5
8 cf 6,149,421 5,862 9.5
9 info 3,666,146 5,774 15.8
10 shop 1,184,827 4,701 39.7
11 gq 5,027,257 4,330 8.6
12 online 1,964,896 4,233 21.5
13 cn 7,577,302 4,196 5.5
14 us 1,903,740 3,788 19.9
15 icu 1,002,641 3,202 31.9
16 rest 46,066 2,638 572.7
17 net 13,075,439 2,632 2.0
18 site 1,061,799 2,413 22.7
19 link 190,940 1,985 104.0
20 tokyo 181,538 1,942 107.0

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains