Phishing Activity in Top-level Domains (TLDs)
August 1, 2023 - October 31, 2023

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (August to October 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 158,377,415 62,668 4.0
2 cn 7,697,677 16,117 20.9
3 top 2,529,980 16,107 63.7
4 info 3,705,343 5,285 14.3
5 online 2,763,112 4,775 17.3
6 cfd 931,723 4,644 49.8
7 xyz 3,267,127 4,415 13.5
8 net 12,912,807 4,371 3.4
9 shop 1,901,331 4,322 22.7
10 ru 5,061,485 2,989 5.9
11 site 1,375,163 2,923 21.3
12 click 556,390 2,606 46.8
13 org 10,778,893 2,411 2.2
14 us 1,958,811 1,950 10.0
15 pl 2,453,558 1,844 7.5
16 id 681,201 1,627 23.9
17 icu 355,153 1,354 38.1
18 bond 204,246 1,334 65.3
19 cc 1,086,779 1,237 11.4
20 live 594,260 1,225 20.6

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (August to October 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 best 62,219 809 130.0
2 support 33,648 234 69.5
3 bond 204,246 1,334 65.3
4 top 2,529,980 16,107 63.7
5 cam 31,934 202 63.3
6 cfd 931,723 4,644 49.8
7 sbs 229,849 1,078 46.9
8 click 556,390 2,606 46.8
9 su 102,612 467 45.5
10 ink 79,634 360 45.2
11 homes 61,777 256 41.4
12 icu 355,153 1,354 38.1
13 pics 56,033 168 30.0
14 space 383,905 1,119 29.2
15 life 363,500 1,020 28.1
16 autos 38,353 106 27.6
17 cloud 319,230 878 27.5
18 id 681,201 1,627 23.9
19 shop 1,901,331 4,322 22.7
20 fit 37,586 84 22.4

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (August to October 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 158,377,415 38,685 2.4
2 top 2,529,980 15,465 61.1
3 cn 7,697,677 9,049 11.8
4 cfd 931,723 4,509 48.4
5 info 3,705,343 4,448 12.0
6 shop 1,901,331 4,322 22.7
7 online 2,763,112 3,848 13.9
8 xyz 3,267,127 3,376 10.3
9 site 1,375,163 2,510 18.3
10 click 556,390 2,462 44.3
11 net 12,912,807 2,445 1.9
12 ru 5,061,485 1,824 3.6
13 pl 2,453,558 1,624 6.6
14 bond 204,246 1,298 63.6
15 us 1,958,811 1,254 6.4
16 org 10,778,893 1,246 1.2
17 icu 355,153 1,227 34.6
18 space 383,905 1,043 27.2
19 sbs 229,849 999 43.5
20 live 594,260 976 16.4

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains