Malware Activity in Domain Registrars
April 1, 2021 - June 30, 2021

Malware attackers compose hostnames and URLs from domain names that they register purposely for malware attacks or from domain names that they have exploited in some way (e.g., by hijacking a domain registration account or by compromising a host such as a web site). They embed these into URLs in the emails, texts, or social media posts that lure victims to malware download sites.

To determine where gTLD domain names were purchased and managed, and where reported malware domains are concentrated in gTLD registrars’ domain portfolios, we identify the domain name Registrar - the business entity that processed the domain name registration – of domain names reported for malware activity from domain name registration data obtained via the Whois or RDAP services.

For the period, we identified 67 domain registrars with 30,000 domains under management and at least 25 reported malware domains.

- 27 registrars had more than 100 reported malware domains.

- 7 registrars had more than 500 reported malware domains.

- 4 registrars had more than 1000 reported malware domains.

Measurements of reported malware domains can identify registrars where analyses of business practices, account security, or pricing might prove useful. We currently collect domain registration data for generic Top-level Domains only; thus, the tables on this page present gTLD domains under management for each registrar.

In the table below, we show the twenty domain name Registrars with the highest number of reported phishing domains under management.