Phishing Activity in Top-level Domains (TLDs)
August 1, 2024 - October 31, 2024

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (August to October 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 154,345,503 145,124 9.4
2 top 2,768,949 48,854 176.4
3 bond 525,702 19,321 367.5
4 cn 9,754,503 16,016 16.4
5 shop 3,434,196 15,423 44.9
6 xyz 3,696,507 15,166 41.0
7 info 3,540,746 12,215 34.5
8 net 12,476,797 9,855 7.9
9 online 3,027,709 8,208 27.1
10 ru 5,736,720 7,633 13.3
11 org 10,992,984 6,606 6.0
12 cc 1,485,706 5,392 36.3
13 site 1,511,993 4,654 30.8
14 cfd 348,514 3,883 111.4
15 live 537,964 3,589 66.7
16 today 463,934 3,447 74.3
17 sbs 809,926 3,349 41.4
18 vip 1,113,890 3,334 29.9
19 icu 394,301 3,171 80.4
20 click 422,743 2,583 61.1

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (August to October 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 bond 525,702 19,321 367.5
2 finance 33,473 706 210.9
3 top 2,768,949 48,854 176.4
4 support 36,906 650 176.1
5 fyi 75,648 1,149 151.9
6 mom 47,285 638 134.9
7 zone 62,526 767 122.7
8 cfd 348,514 3,883 111.4
9 best 67,570 740 109.5
10 world 269,321 2,270 84.3
11 pics 63,663 520 81.7
12 icu 394,301 3,171 80.4
13 ink 71,378 571 80.0
14 today 463,934 3,447 74.3
15 buzz 327,230 2,410 73.7
16 run 30,249 211 69.8
17 rest 64,859 449 69.2
18 live 537,964 3,589 66.7
19 click 422,743 2,583 61.1
20 network 76,479 466 60.9

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (August to October 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 154,345,503 91,132 5.9
2 top 2,768,949 39,250 141.8
3 bond 525,702 19,280 366.8
4 xyz 3,696,507 13,644 36.9
5 shop 3,434,196 9,867 28.7
6 info 3,540,746 9,578 27.1
7 ru 5,736,720 6,116 10.7
8 online 3,027,709 6,069 20.0
9 net 12,476,797 5,829 4.7
10 cn 9,754,503 5,763 5.9
11 cc 1,485,706 4,255 28.6
12 org 10,992,984 3,753 3.4
13 cfd 348,514 3,694 106.0
14 site 1,511,993 3,527 23.3
15 today 463,934 3,229 69.6
16 sbs 809,926 3,108 38.4
17 live 537,964 2,918 54.2
18 icu 394,301 2,900 73.6
19 vip 1,113,890 2,501 22.5
20 buzz 327,230 2,239 68.4

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains