Phishing Activity in Top-level Domains (TLDs)
February 1, 2024 - April 30, 2024

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (February to April 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 156,670,775 178,651 11.4
2 top 2,768,147 62,452 225.6
3 xyz 3,371,694 41,015 121.7
4 lol 347,972 19,383 557.0
5 net 12,796,792 17,487 13.7
6 shop 2,753,794 17,021 61.8
7 cn 8,172,577 16,214 19.8
8 org 10,846,688 15,643 14.4
9 info 3,589,133 12,974 36.2
10 online 3,022,683 12,074 39.9
11 club 586,166 11,248 191.9
12 sbs 605,035 9,686 160.1
13 bond 271,107 9,466 349.2
14 ru 5,510,517 7,593 13.8
15 cc 1,200,025 7,285 60.7
16 site 1,549,651 6,427 41.5
17 life 402,382 5,886 146.3
18 vip 908,044 4,334 47.7
19 co 3,258,138 3,818 11.7
20 live 558,414 3,620 64.8

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (February to April 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 lol 347,972 19,383 557.0
2 bond 271,107 9,466 349.2
3 support 36,274 822 226.6
4 top 2,768,147 62,452 225.6
5 win 92,678 1,928 208.0
6 club 586,166 11,248 191.9
7 quest 43,216 812 187.9
8 finance 34,293 592 172.6
9 sbs 605,035 9,686 160.1
10 life 402,382 5,886 146.3
11 fyi 60,427 842 139.3
12 media 84,151 1,157 137.5
13 xyz 3,371,694 41,015 121.7
14 pics 62,187 711 114.3
15 today 296,927 3,301 111.2
16 mom 44,298 473 106.8
17 autos 42,608 432 101.4
18 zone 46,269 460 99.4
19 beauty 31,610 286 90.5
20 buzz 271,549 2,245 82.7

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (February to April 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 156,670,775 132,555 8.5
2 top 2,768,147 61,792 223.2
3 xyz 3,371,694 38,492 114.2
4 lol 347,972 19,313 555.0
5 shop 2,753,794 17,021 61.8
6 net 12,796,792 13,146 10.3
7 org 10,846,688 12,804 11.8
8 info 3,589,133 11,131 31.0
9 club 586,166 11,052 188.6
10 online 3,022,683 10,344 34.2
11 sbs 605,035 9,559 158.0
12 bond 271,107 9,447 348.5
13 cn 8,172,577 7,722 9.5
14 cc 1,200,025 6,424 53.5
15 ru 5,510,517 6,188 11.2
16 life 402,382 5,474 136.0
17 site 1,549,651 5,221 33.7
18 vip 908,044 4,060 44.7
19 today 296,927 3,094 104.2
20 live 558,414 3,062 54.8

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains