Phishing Activity in Top-level Domains (TLDs)
November 1, 2022 - January 31, 2023

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (November to January 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 158,909,625 109,807 6.9
2 cn 7,205,158 67,143 93.2
3 ml 6,838,254 43,249 63.3
4 top 1,850,675 24,117 130.3
5 us 1,881,103 16,135 85.8
6 info 3,722,404 15,916 42.8
7 tk 5,268,878 15,254 29.0
8 ga 8,895,425 11,198 12.6
9 cf 6,335,690 9,184 14.5
10 cyou 592,033 9,029 152.5
11 xyz 3,777,627 7,455 19.7
12 gq 5,198,542 6,407 12.3
13 buzz 360,588 6,139 170.3
14 shop 1,379,972 6,103 44.2
15 online 2,099,301 6,102 29.1
16 net 13,043,037 6,048 4.6
17 org 10,707,159 4,846 4.5
18 ru 4,868,885 4,254 8.7
19 live 632,881 4,126 65.2
20 site 1,129,853 3,140 27.8

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (November to January 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 buzz 360,588 6,139 170.3
2 cyou 592,033 9,029 152.5
3 support 32,257 463 143.5
4 link 200,873 2,655 132.2
5 top 1,850,675 24,117 130.3
6 cn 7,205,158 67,143 93.2
7 us 1,881,103 16,135 85.8
8 pw 318,419 2,170 68.2
9 su 100,718 660 65.5
10 live 632,881 4,126 65.2
11 ml 6,838,254 43,249 63.3
12 click 319,793 1,972 61.7
13 bond 37,181 226 60.8
14 cfd 102,112 587 57.5
15 fyi 50,815 245 48.2
16 shop 1,379,972 6,103 44.2
17 info 3,722,404 15,916 42.8
18 life 292,027 1,077 36.9
19 quest 65,654 219 33.4
20 finance 43,528 135 31.0

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (November to January 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 158,909,625 66,721 4.2
2 ml 6,838,254 43,249 63.3
3 cn 7,205,158 36,680 50.9
4 top 1,850,675 23,566 127.3
5 tk 5,268,878 15,254 29.0
6 info 3,722,404 13,797 37.1
7 ga 8,895,425 11,198 12.6
8 us 1,881,103 11,020 58.6
9 cf 6,335,690 9,184 14.5
10 cyou 592,033 8,898 150.3
11 gq 5,198,542 6,407 12.3
12 buzz 360,588 5,913 164.0
13 shop 1,379,972 5,895 42.7
14 xyz 3,777,627 5,550 14.7
15 online 2,099,301 4,799 22.9
16 net 13,043,037 3,451 2.7
17 org 10,707,159 2,817 2.6
18 live 632,881 2,705 42.7
19 site 1,129,853 2,480 22.0
20 ru 4,868,885 2,320 4.8

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains