Phishing Activity in Top-level Domains (TLDs) February 1, 2025 - April 30, 2025

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (February to April 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 154,712,032 142,147 9.2
2 top 3,525,239 70,382 199.7
3 xin 39,522 39,817 10,074.6
4 xyz 4,219,839 28,852 68.4
5 bond 454,090 23,669 521.2
6 vip 1,272,004 19,412 152.6
7 info 3,871,727 15,299 39.5
8 online 2,950,523 13,088 44.4
9 ru 5,777,653 12,805 22.2
10 pro 863,933 11,829 136.9
11 cfd 324,157 11,298 348.5
12 net 12,352,692 11,100 9.0
13 sbs 786,261 10,168 129.3
14 cn 11,606,857 9,549 8.2
15 cc 1,865,743 9,438 50.6
16 shop 3,321,636 9,381 28.2
17 site 1,516,396 8,623 56.9
18 org 11,185,745 8,388 7.5
19 icu 422,101 7,956 188.5
20 world 312,180 7,010 224.6

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (February to April 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 win 82,992 6,414 772.9
2 help 43,991 2,335 530.8
3 bond 454,090 23,669 521.2
4 cfd 324,157 11,298 348.5
5 finance 32,064 790 246.4
6 world 312,180 7,010 224.6
7 top 3,525,239 70,382 199.7
8 icu 422,101 7,956 188.5
9 support 37,431 675 180.3
10 vip 1,272,004 19,412 152.6
11 cyou 209,499 3,176 151.6
12 pro 863,933 11,829 136.9
13 sbs 786,261 10,168 129.3
14 monster 46,750 545 116.6
15 mom 49,315 572 116.0
16 click 562,399 5,985 106.4
17 quest 44,359 430 96.9
18 buzz 288,216 2,603 90.3
19 ink 87,499 738 84.3
20 fyi 85,395 689 80.7

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (February to April 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 154,712,032 80,165 5.2
2 top 3,525,239 59,779 169.6
3 xin 39,522 39,776 10,064.3
4 bond 454,090 23,315 513.4
5 xyz 4,219,839 18,921 44.8
6 vip 1,272,004 17,373 136.6
7 pro 863,933 10,343 119.7
8 info 3,871,727 10,099 26.1
9 cfd 324,157 9,710 299.6
10 ru 5,777,653 8,830 15.3
11 sbs 786,261 7,706 98.0
12 cc 1,865,743 7,637 40.9
13 online 2,950,523 7,352 24.9
14 world 312,180 6,525 209.0
15 net 12,352,692 6,506 5.3
16 win 82,992 6,376 768.3
17 icu 422,101 6,217 147.3
18 shop 3,321,636 6,059 18.2
19 site 1,516,396 5,207 34.3
20 click 562,399 4,714 83.8

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains