Phishing Activity in Domain Registrars, February 1, 2025 - April 30, 2025

Phishers compose hostnames and URLs from domain names that they register purposely for phishing (malicious domain registrations), or from domain names that they have exploited in some way (e.g., by hijacking a domain registration account or by compromising a host such as a web site). They embed these URLs in the emails, texts, or social media posts that lure victims to phishing web sites.

To determine where gTLD domain names were purchased and managed, and where reported phishing domains are concentrated in gTLD registrars’ domain portfolios, we identify the domain name Registrar - the business entity that processed the domain name registration – of domain names reported for phishing activity from domain name registration data obtained via the Whois or RDAP services. Measurements of reported phishing domains can identify registrars where close analyses of business practices, account security, or pricing might prove useful.

We currently collect domain registration data for generic Top-level Domains only; thus, the tables on this page present gTLD domains under management for each registrar.

In the table below, we show the domain name Registrars with the highest number of reported phishing domains under management. A complete list of gTLD registrars where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of Domain Registrars by Phishing Domains (February to April 2025)

Registrars with a minimum of 30,000 domains and 25 phishing domains

Rank Registrar Registrar IANA_ID gTLD Domains
under Management		 Phishing Domains ▼ Phishing Domain Score
1 Dominet (HK) Limited 3775 766,208 61,580 803.7
2 NICENIC INTERNATIONAL GROUP CO., LIMITED 3765 140,839 59,330 4,212.6
3 NameSilo, LLC 1479 4,480,728 37,052 82.7
4 NameCheap, Inc. 1068 18,700,876 31,592 16.9
5 Web Commerce Communications Limited dba WebNic.cc 460 848,546 26,166 308.4
6 Gname.com Pte. Ltd. 1923 4,942,944 18,750 37.9
7 GoDaddy.com, LLC 146 64,662,769 15,304 2.4
8 PDR Ltd. d/b/a PublicDomainRegistry.com 303 4,016,658 14,726 36.7
9 Dynadot Inc 472 5,073,303 12,208 24.1
10 Key-Systems, LLC 1345 1,216,355 12,107 99.5
11 GMO Internet Group, Inc. d/b/a Onamae.com 49 5,507,355 8,650 15.7
12 HOSTINGER operations, UAB 1636 4,181,675 7,586 18.1
13 Tucows Domains Inc. 69 10,098,432 7,115 7.1
14 Hosting Concepts B.V. d/b/a Registrar.eu 1647 1,230,578 5,142 41.8
15 OwnRegistrar, Inc. 1250 326,502 5,128 157.1
16 eNom, LLC 48 3,568,062 4,495 12.6
17 Registrar of Domain Names REG.RU LLC 1606 794,131 4,430 55.8
18 Sav.com, LLC 609 1,023,778 4,344 42.4
19 Spaceship, Inc. 3862 2,036,713 2,354 11.6
20 Atak Domain Bilgi Teknolojileri A.Ş. 1601 273,010 2,284 83.7

To allow comparison of large and small gTLD registrars, we rank registrars based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a registrar by the number of domains delegated from that registrar.

gTLD registrar Phishing Score = (number of phishing domains/domains delegated from gTLD registrar) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty gTLD registrars that had the highest phishing domain score.

Ranking of Domain Registrars by Phishing Domain Score (February to April 2025)

Registrars with a minimum of 30,000 domains and 25 phishing domains

Rank Registrar Registrar IANA_ID gTLD Domains
under Management		 Phishing Domains Phishing Domain Score ▼
1 NICENIC INTERNATIONAL GROUP CO., LIMITED 3765 140,839 59,330 4,212.6
2 Dominet (HK) Limited 3775 766,208 61,580 803.7
3 Aceville Pte. Ltd. 3858 43,703 1,364 312.1
4 Web Commerce Communications Limited dba WebNic.cc 460 848,546 26,166 308.4
5 Global Domain Group LLC 3956 65,966 1,182 179.2
6 Hello Internet Corp. 1924 37,246 653 175.3
7 OwnRegistrar, Inc. 1250 326,502 5,128 157.1
8 Tecnocrática Centro de Datos, S.L. 1600 113,991 1,439 126.2
9 Key-Systems, LLC 1345 1,216,355 12,107 99.5
10 Danesco Trading Ltd. 1418 65,432 635 97.1
11 Atak Domain Bilgi Teknolojileri A.Ş. 1601 273,010 2,284 83.7
12 NameSilo, LLC 1479 4,480,728 37,052 82.7
13 Hefei Juming Network Technology Co., Ltd 3758 277,555 1,854 66.8
14 Internet Domain Service BS Corp 2487 341,739 1,953 57.2
15 Registrar of Domain Names REG.RU LLC 1606 794,131 4,430 55.8
16 CNOBIN INFORMATION TECHNOLOGY LIMITED 3254 54,167 257 47.5
17 Sav.com, LLC 609 1,023,778 4,344 42.4
18 Hosting Concepts B.V. d/b/a Registrar.eu 1647 1,230,578 5,142 41.8
19 Eranet International Limited 1868 265,145 1,050 39.6
20 Cosmotown, Inc. 1509 374,309 1,477 39.5

The final table ranks gTLD registrars by malicious domain registrations.

Ranking of Domain Registrars by Malicious Phishing Domains (February to April 2025)

Registrars with a minimum of 30,000 domains and 25 phishing domains

Rank Registrar Registrar IANA_ID gTLD Domains
under Management		 Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 Dominet (HK) Limited 3775 766,208 60,119 784.6
2 NICENIC INTERNATIONAL GROUP CO., LIMITED 3765 140,839 38,030 2,700.3
3 NameSilo, LLC 1479 4,480,728 25,579 57.1
4 NameCheap, Inc. 1068 18,700,876 21,842 11.7
5 Gname.com Pte. Ltd. 1923 4,942,944 15,121 30.6
6 Web Commerce Communications Limited dba WebNic.cc 460 848,546 14,731 173.6
7 Key-Systems, LLC 1345 1,216,355 11,942 98.2
8 Dynadot Inc 472 5,073,303 9,925 19.6
9 GoDaddy.com, LLC 146 64,662,769 8,646 1.3
10 PDR Ltd. d/b/a PublicDomainRegistry.com 303 4,016,658 8,486 21.1
11 GMO Internet Group, Inc. d/b/a Onamae.com 49 5,507,355 5,497 10.0
12 HOSTINGER operations, UAB 1636 4,181,675 4,090 9.8
13 Registrar of Domain Names REG.RU LLC 1606 794,131 3,238 40.8
14 eNom, LLC 48 3,568,062 3,083 8.6
15 Tucows Domains Inc. 69 10,098,432 2,747 2.7
16 Sav.com, LLC 609 1,023,778 2,647 25.9
17 Hosting Concepts B.V. d/b/a Registrar.eu 1647 1,230,578 2,618 21.3
18 OwnRegistrar, Inc. 1250 326,502 2,476 75.8
19 Hefei Juming Network Technology Co., Ltd 3758 277,555 1,808 65.1
20 Spaceship, Inc. 3862 2,036,713 1,731 8.5

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Registrars