How to generate custom statistics
from CIC TLD data

Contributed by Dave Piscitello, Interisle Consulting Group

The Cybercrime Information Center publishes quarterly reports that rank Top-level Domains by the number of phishing domains reported and by phishing score (see Phishing Terminology). The page, Phishing Activity in Top-level Domains (TLDs) August 1, 2021 - October 31, 2021, is one such report.

The Center also hosts the table data for these reports at https://www.cybercrimeinfocenter.org/records in CSV format. From the table data, you can apply sorts or filters to look at or rank specific sets of TLDs, e.g., ccTLDs, gTLDs, or (sets of) new TLDs. You can also sort or filter to rank TLDs using other measurements that the CIC produces, such as phishing attacks, or malicious domain registrations.

Image by Ryan Tracey

In this post, we demonstrate how you can use Excel and the data that the Center publishes to generate custom statistics.

Download a CIC TLD data file

Go to the Cybercrime Information Center’s Records Repository at https://www.cybercrimeinfocenter.org/records.

From the Phishing Records Repositories, select TLD Phishing Table Data from Phishing Activity August 2021 – October 2021 to download Phishing-TLDstatsAug2021-Oct2021.csv.

Run Excel

Open the file Phishing-TLDstatsAug2021-Oct2021.csv. If you don’t see the file, check that you are looking for All Files (*.*).

Select Column G, Phishing Domains from the worksheet. From the Data pulldown, select Filter.

(Note: you can also click on Filter without selecting anything. This causes the whole 1 row to have filters.)

Choose Sort Largest to Smallest from the ▽ pulldown (If not the default, choose Expand the Selection).

 (Note: You can also sort without enabling the filter. Select cell G2, click right mouse, and select Sort Largest to Smallest.)

Remove the filter from Column G. You now have the total count of phishing domains, largest to smallest, for all TLDs in the file.

Now choose column A, TLD. Choose Text Filters -> Equals from the ▽ pulldown.

Type ?? into the Custom Autofilter and hit OK. This will select all the TLDs in the column with 2 characters. Since only ccTLDs are allowed two characters, the displayed rows will be ccTLDs.

Column A now shows ccTLDs sorted by Phishing Domains.

The 10 ccTLDs with the highest counts of phishing domains are: cn, tk, ml, ga, cf, gq, ru, co, br, and us.

Side note: Five of these ccTLDs are “commercialized” ccTLDs run by Freenom (.TK, .ML, .GA, .CF, .GQ) which offers free domain name registrations.

Closing remarks

The TLD data file contains several measurements. To see them all, type Ctrl-A, then double-click left mouse on any any one of the column partition lines to widen all the columns. You can sort or filter on any of these. For example,

  • if you want to look only at gTLDs, you can use the same value ?? but choose Text Filters -> Does Not Equal, or

  • if you want to look only at a set of ccTLDs, you can use the Search form in Filters. Try this: uncheck Select All, scroll through the list of ccTLDs and check “us” then OK.

This may be an interesting exercise. Use the Search form in Filters. Uncheck Select All, scroll through the list of ccTLDs, check (tk, ml, ga, cf, gq) and hit OK. You now have the set of Freenom domains reported for phishing.

Add “cz” (Czech Republic). Note that CZ has very few reported phishing domains.

Why are the phishing domain reports for cz so low and so high for the Freenom ccTLDs?

Open a browser and search for the price of a domain registration in the CZ ccTLD.

CZ domain registration fees are generally between $20 and $30 USD, absent promotional pricing.

Freenom domains are free.

Draw your own conclusions about where a phisher would go to register domains.

If you have a novel use for Cybercrime Information Center Data and are interested in sharing with
our community, contact us at

criminaldomainabuse@interisle.net