Phishing Activity in Top-level Domains (TLDs) August 1, 2025 - October 31, 2025

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (August to October 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 157,708,307 297,244 18.9
2 top 5,413,859 161,534 298.4
3 pro 991,206 50,493 509.4
4 cn 11,955,160 45,684 38.2
5 mobi 421,582 32,644 774.3
6 vip 1,426,900 30,988 217.2
7 xyz 6,777,472 27,067 39.9
8 icu 489,407 26,830 548.2
9 info 4,446,544 25,490 57.3
10 cc 2,204,936 24,269 110.1
11 cfd 438,921 24,128 549.7
12 net 12,230,456 23,524 19.2
13 shop 3,705,201 21,052 56.8
14 bond 312,941 17,280 552.2
15 xin 54,699 17,029 3,113.2
16 live 572,879 15,532 271.1
17 online 3,068,502 15,463 50.4
18 sbs 918,263 14,612 159.1
19 org 11,419,848 11,729 10.3
20 site 1,688,148 11,536 68.3

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (August to October 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 xin 54,699 17,029 3,113.2
2 qpon 40,386 3,917 969.9
3 mobi 421,582 32,644 774.3
4 bond 312,941 17,280 552.2
5 cfd 438,921 24,128 549.7
6 icu 489,407 26,830 548.2
7 pro 991,206 50,493 509.4
8 help 107,879 4,727 438.2
9 win 93,999 3,350 356.4
10 top 5,413,859 161,534 298.4
11 cyou 318,091 8,705 273.7
12 live 572,879 15,532 271.1
13 finance 32,617 834 255.7
14 fit 50,726 1,237 243.9
15 lat 128,728 3,135 243.5
16 pics 73,190 1,683 230.0
17 ink 99,542 2,214 222.4
18 vip 1,426,900 30,988 217.2
19 best 35,580 745 209.4
20 rest 57,258 1,065 186.0

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (August to October 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 157,708,307 170,286 10.80
2 top 5,413,859 99,254 183.33
3 pro 991,206 38,382 387.23
4 mobi 421,582 29,321 695.50
5 vip 1,426,900 27,577 193.27
6 icu 489,407 23,239 474.84
7 cc 2,204,936 21,172 96.02
8 cfd 438,921 20,718 472.02
9 info 4,446,544 17,668 39.73
10 bond 312,941 17,006 543.43
11 xyz 6,777,472 16,080 23.73
12 xin 54,699 15,958 2917.42
13 net 12,230,456 14,858 12.15
14 live 572,879 12,725 222.12
15 shop 3,705,201 12,219 32.98
16 sbs 918,263 10,874 118.42
17 cn 11,955,160 9,869 8.26
18 click 657,597 8,774 133.43
19 online 3,068,502 8,751 28.52
20 cyou 318,091 7,843 246.56

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains