Phishing Activity in Top-level Domains (TLDs)
November 1, 2023 - January 31, 2024

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (November to January 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 157,582,509 104,790 6.7
2 top 2,673,054 44,012 164.7
3 xyz 3,293,538 24,593 74.7
4 cn 7,901,525 16,168 20.5
5 sbs 496,837 11,224 225.9
6 shop 2,256,942 8,591 38.1
7 ru 5,346,940 8,566 16.0
8 online 2,933,156 8,121 27.7
9 info 3,617,475 7,519 20.8
10 net 12,863,558 6,867 5.3
11 site 1,522,415 6,461 42.4
12 cfd 1,012,423 5,558 54.9
13 org 10,774,251 4,595 4.3
14 cc 1,124,432 2,566 22.8
15 bond 248,411 2,141 86.2
16 life 378,570 2,132 56.3
17 pro 496,581 2,095 42.2
18 br 4,558,843 2,019 4.4
19 pl 2,467,328 1,827 7.4
20 store 1,398,608 1,814 13.0

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (November to January 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 sbs 496,837 11,224 225.9
2 top 2,673,054 44,012 164.7
3 quest 40,077 506 126.3
4 support 34,859 370 106.1
5 bond 248,411 2,141 86.2
6 finance 33,870 275 81.2
7 pics 62,696 508 81.0
8 best 67,223 516 76.8
9 xyz 3,293,538 24,593 74.7
10 guru 54,084 389 71.9
11 su 103,298 683 66.1
12 life 378,570 2,132 56.3
13 cfd 1,012,423 5,558 54.9
14 do 32,778 180 54.9
15 digital 125,933 683 54.2
16 buzz 314,391 1,657 52.7
17 monster 72,329 367 50.7
18 site 1,522,415 6,461 42.4
19 pro 496,581 2,095 42.2
20 space 386,063 1,624 42.1

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (November to January 2024)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 157,582,509 71,279 4.5
2 top 2,673,054 43,388 162.3
3 xyz 3,293,538 22,750 69.1
4 sbs 496,837 11,070 222.8
5 cn 7,901,525 8,857 11.2
6 shop 2,256,942 8,588 38.1
7 ru 5,346,940 6,914 12.9
8 online 2,933,156 6,744 23.0
9 info 3,617,475 6,444 17.8
10 site 1,522,415 5,550 36.5
11 cfd 1,012,423 5,300 52.4
12 net 12,863,558 4,096 3.2
13 org 10,774,251 3,003 2.8
14 bond 248,411 2,117 85.2
15 cc 1,124,432 1,922 17.1
16 pro 496,581 1,812 36.5
17 life 378,570 1,800 47.6
18 buzz 314,391 1,542 49.1
19 pl 2,467,328 1,500 6.1
20 click 555,046 1,458 26.3

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains