Phishing Activity in Top-level Domains (TLDs)
May 1, 2024 - July 31, 2024

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to July 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 154,941,634 157,053 10.1
2 top 2,771,014 40,989 147.9
3 xyz 3,592,150 30,932 86.1
4 bond 391,069 21,684 554.5
5 lol 509,501 19,928 391.1
6 info 3,532,518 18,120 51.3
7 ru 5,605,588 17,366 31.0
8 shop 3,051,605 14,405 47.2
9 online 3,087,869 13,889 45.0
10 net 12,678,064 12,172 9.6
11 sbs 718,979 9,835 136.8
12 org 10,905,500 9,150 8.4
13 site 1,507,028 8,053 53.4
14 icu 451,355 6,902 152.9
15 cn 8,666,364 6,528 7.5
16 cc 1,328,954 6,186 46.6
17 cfd 699,317 5,781 82.7
18 today 367,417 4,921 133.9
19 live 541,014 4,366 80.7
20 buzz 297,934 3,801 127.6

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to July 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 bond 391,069 21,684 554.5
2 lol 509,501 19,928 391.1
3 finance 33,731 990 293.5
4 support 36,692 1,067 290.8
5 fyi 65,991 1,498 227.0
6 mom 43,924 734 167.1
7 icu 451,355 6,902 152.9
8 top 2,771,014 40,989 147.9
9 sbs 718,979 9,835 136.8
10 pics 61,041 826 135.3
11 today 367,417 4,921 133.9
12 buzz 297,934 3,801 127.6
13 zone 51,242 629 122.8
14 world 244,884 2,785 113.7
15 cyou 237,192 2,381 100.4
16 xyz 3,592,150 30,932 86.1
17 homes 70,896 602 84.9
18 cfd 699,317 5,781 82.7
19 live 541,014 4,366 80.7
20 life 407,492 2,784 68.3

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to July 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 154,941,634 95,179 6.1
2 top 2,771,014 29,947 108.1
3 xyz 3,592,150 26,313 73.3
4 bond 391,069 21,564 551.4
5 lol 509,501 19,495 382.6
6 ru 5,605,588 15,629 27.9
7 info 3,532,518 14,217 40.3
8 online 3,087,869 9,851 31.9
9 sbs 718,979 9,428 131.1
10 shop 3,051,605 8,638 28.3
11 net 12,678,064 7,780 6.1
12 icu 451,355 6,349 140.7
13 org 10,905,500 5,734 5.3
14 site 1,507,028 5,678 37.7
15 cfd 699,317 5,414 77.4
16 cc 1,328,954 4,906 36.9
17 today 367,417 4,465 121.5
18 live 541,014 3,649 67.5
19 buzz 297,934 3,333 111.9
20 click 487,857 2,695 55.2

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains