Malware Activity in Top-level Domains (TLDs) January 1,2026 - March 31,2026

We analyzed the domains reported as serving up malware to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in malware reports.

In the table below, we present the twenty TLDs that had the highest number of domains reported as serving up malware. A complete list of TLDs where malware was reported for the quarter can be downloaded in CSV format from the Records page.