Phishing Activity in Top-level Domains (TLDs)
May 1, 2023 - July 31, 2023

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to July 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 159,018,085 69,560 4.4
2 top 2,243,675 11,031 49.2
3 cn 7,511,395 9,956 13.3
4 info 3,747,038 7,995 21.3
5 live 632,401 5,904 93.4
6 xyz 3,239,639 5,546 17.1
7 net 12,823,843 4,613 3.6
8 online 2,419,155 3,350 13.9
9 org 10,747,830 3,082 2.9
10 ru 4,940,178 2,516 5.1
11 shop 1,691,583 2,241 13.3
12 us 2,018,702 2,238 11.1
13 site 1,338,872 2,080 15.5
14 click 503,300 1,852 36.8
15 cfd 589,403 1,607 27.3
16 tk 4,401,411 1,602 3.6
17 me 1,158,617 1,581 13.7
18 cc 1,034,968 1,401 13.5
19 id 657,762 1,265 19.2
20 co 3,471,655 1,244 3.6

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to July 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 best 51,938 595 114.6
2 live 632,401 5,904 93.4
3 support 33,068 301 91.0
4 icu 168,694 959 56.9
5 fyi 58,007 327 56.4
6 top 2,243,675 11,031 49.2
7 ink 72,958 319 43.7
8 pics 50,101 212 42.3
9 click 503,300 1,852 36.8
10 zone 41,460 138 33.3
11 life 351,535 1,069 30.4
12 cloud 301,571 835 27.7
13 cfd 589,403 1,607 27.3
14 cyou 291,940 773 26.5
15 autos 32,948 78 23.7
16 bond 109,839 253 23.0
17 asia 258,618 588 22.7
18 beauty 39,107 84 21.5
19 info 3,747,038 7,995 21.3
20 monster 78,559 160 20.4

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to July 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 159,018,085 36,152 2.3
2 top 2,243,675 10,507 46.8
3 info 3,747,038 6,340 16.9
4 live 632,401 4,949 78.3
5 xyz 3,239,639 3,934 12.1
6 net 12,823,843 2,320 1.8
7 shop 1,691,583 2,194 13.0
8 online 2,419,155 2,009 8.3
9 click 503,300 1,600 31.8
10 ru 4,940,178 1,507 3.1
11 cfd 589,403 1,486 25.2
12 org 10,747,830 1,300 1.2
13 site 1,338,872 1,273 9.5
14 us 2,018,702 1,130 5.6
15 life 351,535 938 26.7
16 cc 1,034,968 882 8.5
17 pl 2,435,289 867 3.6
18 icu 168,694 812 48.1
19 cn 7,511,395 756 1.0
20 id 657,762 690 10.5

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains