Phishing Activity in Domain Registrars
May 1, 2029 - July 31, 2020

Phishers compose hostnames and URLs from domain names that they register purposely for phishing or from domain names that they have exploited in some way (e.g., by hijacking a domain registration account or by compromising a host such as a web site). They embed these URLs in the emails, texts, or social media posts that lure victims to phishing web sites.

To determine where gTLD domain names were purchased and managed, and where reported phishing domains are concentrated in registrars’ domain portfolios, we identify the domain name Registrar - the business entity that processed the domain name registration – of domain names reported for phishing activity from domain name registration data obtained via the Whois or RDAP services.

For the August to October 2020 period, we identified 99 domain registrars with 30,000 domains under management and at least 25 reported phishing domains.

Measurements of reported phishing domains can identify registrars where analyses of business practices, account security, or pricing might prove useful.

Table 1 shows the twenty domain name Registrars with the highest number of reported phishing domains under management.