Phishing Activity in Top-level Domains (TLDs) November 1, 2024 - January 31, 2025

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (November to January 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 154,061,864 162,108 10.5
2 top 3,008,550 89,461 297.4
3 bond 691,789 38,338 554.2
4 xyz 3,770,025 24,104 63.9
5 shop 3,466,870 23,793 68.6
6 lol 605,800 21,635 357.1
7 info 3,709,276 17,970 48.5
8 ru 5,648,983 14,713 26.1
9 cn 10,841,643 12,603 11.6
10 cc 1,717,999 12,586 73.3
11 online 2,992,006 12,505 41.8
12 net 12,408,227 11,511 9.3
13 sbs 763,386 10,771 141.1
14 cfd 196,052 9,387 478.8
15 vip 1,192,681 8,959 75.1
16 org 11,073,098 8,420 7.6
17 site 1,492,353 7,780 52.1
18 icu 384,374 6,480 168.6
19 live 550,276 6,288 114.3
20 today 551,143 6,016 109.2

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (November to January 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 bond 691,789 38,338 554.2
2 help 34,867 1,756 503.6
3 cfd 196,052 9,387 478.8
4 lol 605,800 21,635 357.1
5 finance 32,671 1,024 313.4
6 top 3,008,550 89,461 297.4
7 support 37,198 837 225.0
8 world 295,661 5,413 183.1
9 icu 384,374 6,480 168.6
10 fyi 80,757 1,273 157.6
11 monster 49,972 722 144.5
12 sbs 763,386 10,771 141.1
13 zone 71,176 977 137.3
14 ink 79,806 1,029 128.9
15 mom 47,259 547 115.8
16 live 550,276 6,288 114.3
17 click 485,026 5,366 110.6
18 cyou 267,538 2,937 109.8
19 today 551,143 6,016 109.2
20 best 60,867 609 100.1

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (November to January 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 154,061,864 96,911 6.3
2 top 3,008,550 78,183 259.9
3 bond 691,789 38,102 550.8
4 lol 605,800 20,792 343.2
5 xyz 3,770,025 19,710 52.3
6 info 3,709,276 12,504 33.7
7 ru 5,648,983 11,579 20.5
8 cc 1,717,999 11,011 64.1
9 sbs 763,386 9,866 129.2
10 shop 3,466,870 8,744 25.2
11 cfd 196,052 8,586 438.0
12 vip 1,192,681 7,833 65.7
13 online 2,992,006 7,397 24.7
14 net 12,408,227 6,568 5.3
15 cn 10,841,643 6,352 5.9
16 today 551,143 5,579 101.2
17 icu 384,374 5,526 143.8
18 live 550,276 5,104 92.8
19 site 1,492,353 5,088 34.1
20 org 11,073,098 5,007 4.5

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains