Phishing Activity in Top-level Domains (TLDs)
February 1, 2023 - April 30, 2023

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (February to April 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 159,531,443 74,900 4.7
2 cn 7,363,700 12,863 17.5
3 top 1,945,721 11,429 58.7
4 info 3,737,554 9,383 25.1
5 xyz 3,610,448 7,602 21.1
6 live 649,941 7,079 108.9
7 us 1,912,099 6,199 32.4
8 online 2,279,920 5,799 25.4
9 net 12,965,167 4,616 3.6
10 shop 1,556,450 4,301 27.6
11 ru 4,890,218 4,101 8.4
12 org 10,730,117 3,698 3.5
13 site 1,208,140 2,709 22.4
14 click 383,173 2,554 66.7
15 cyou 314,942 2,497 79.3
16 me 1,171,576 1,695 14.5
17 tk 4,729,434 1,643 3.5
18 co 3,365,294 1,606 4.8
19 fr 3,982,141 1,434 3.6
20 id 638,981 1,432 22.4

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (February to April 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 support 32,705 441 134.8
2 monster 64,685 776 120.0
3 live 649,941 7,079 108.9
4 cyou 314,942 2,497 79.3
5 bond 40,289 319 79.2
6 click 383,173 2,554 66.7
7 best 46,144 307 66.5
8 top 1,945,721 11,429 58.7
9 cfd 198,634 1,144 57.6
10 beauty 39,614 213 53.8
11 rest 39,700 203 51.1
12 mom 34,966 165 47.2
13 fyi 57,879 269 46.5
14 cloud 281,813 1,261 44.8
15 icu 312,533 1,238 39.6
16 network 70,785 268 37.9
17 life 322,212 1,202 37.3
18 link 203,671 706 34.7
19 tokyo 119,451 396 33.2
20 ink 60,966 201 33.0

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (February to April 2023)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 159,531,443 52,318 3.3
2 top 1,945,721 11,028 56.7
3 info 3,737,554 8,295 22.2
4 live 649,941 6,507 100.1
5 xyz 3,610,448 6,352 17.6
6 online 2,279,920 4,746 20.8
7 shop 1,556,450 4,300 27.6
8 us 1,912,099 3,733 19.5
9 net 12,965,167 2,864 2.2
10 ru 4,890,218 2,751 5.6
11 cyou 314,942 2,327 73.9
12 click 383,173 2,317 60.5
13 org 10,730,117 2,312 2.2
14 site 1,208,140 2,185 18.1
15 cn 7,363,700 1,571 2.1
16 icu 312,533 1,168 37.4
17 life 322,212 1,081 33.6
18 cfd 198,634 1,067 53.7
19 cloud 281,813 1,021 36.2
20 me 1,171,576 998 8.5

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains