Phishing Activity in Top-level Domains (TLDs)
May 1, 2023 - April 30, 2024

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to April 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 156,670,775 379,669 24.2
2 top 2,768,147 117,014 422.7
3 xyz 3,371,694 67,348 199.8
4 cn 8,172,577 55,627 68.1
5 info 3,589,133 31,734 88.4
6 shop 2,753,794 31,179 113.2
7 net 12,796,792 30,369 23.7
8 online 3,022,683 26,799 88.7
9 org 10,846,688 24,270 22.4
10 sbs 605,035 21,962 363.0
11 ru 5,510,517 20,186 36.6
12 lol 347,972 20,096 577.5
13 site 1,549,651 16,893 109.0
14 cfd 960,007 13,960 145.4
15 club 586,166 13,260 226.2
16 bond 271,107 12,800 472.1
17 live 558,414 11,922 213.5
18 cc 1,200,025 11,583 96.5
19 life 402,382 9,602 238.6
20 click 509,882 8,222 161.3

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to April 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 lol 347,972 20,096 577.5
2 bond 271,107 12,800 472.1
3 support 36,274 1,577 434.8
4 top 2,768,147 117,014 422.7
5 sbs 605,035 21,962 363.0
6 quest 43,216 1,377 318.6
7 best 64,022 1,934 302.1
8 finance 34,293 891 259.8
9 tk 79,478 2,057 258.8
10 pics 62,187 1,595 256.5
11 life 402,382 9,602 238.6
12 club 586,166 13,260 226.2
13 fyi 60,427 1,359 224.9
14 win 92,678 2,055 221.7
15 live 558,414 11,922 213.5
16 xyz 3,371,694 67,348 199.8
17 buzz 271,549 4,769 175.6
18 autos 42,608 696 163.4
19 click 509,882 8,222 161.3
20 ink 79,156 1,224 154.6

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to April 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 156,670,775 275,134 17.6
2 top 2,768,147 115,247 416.3
3 xyz 3,371,694 62,439 185.2
4 shop 2,753,794 31,129 113.0
5 info 3,589,133 28,076 78.2
6 cn 8,172,577 26,354 32.3
7 online 3,022,683 22,727 75.2
8 net 12,796,792 22,048 17.2
9 sbs 605,035 21,683 358.4
10 lol 347,972 19,933 572.8
11 org 10,846,688 18,712 17.3
12 ru 5,510,517 16,054 29.1
13 site 1,549,651 14,495 93.5
14 cfd 960,007 13,428 139.9
15 club 586,166 12,749 217.5
16 bond 271,107 12,716 469.0
17 live 558,414 10,248 183.5
18 cc 1,200,025 9,878 82.3
19 life 402,382 9,048 224.9
20 click 509,882 7,548 148.0

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains