Phishing Activity in Top-level Domains (TLDs) February 1, 2026 - April 30, 2026

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (February to April 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 161,935,002 188,756 11.7
2 top 6,299,448 124,452 197.6
3 cn 12,352,863 39,798 32.2
4 shop 3,942,700 20,888 53.0
5 cfd 511,345 20,767 406.1
6 xyz 7,948,829 20,738 26.1
7 info 5,250,592 18,853 35.9
8 vip 1,673,065 18,248 109.1
9 cc 2,431,298 17,936 73.8
10 sbs 1,370,480 17,207 125.6
11 bond 1,146,414 16,393 143.0
12 icu 465,381 14,196 305.0
13 pro 1,091,118 13,514 123.9
14 net 12,205,093 13,119 10.8
15 click 723,583 10,391 143.6
16 garden 65,955 10,332 1,566.5
17 org 11,817,837 9,930 8.4
18 life 415,226 9,625 231.8
19 cyou 452,272 9,188 203.2
20 online 3,318,823 8,790 26.5

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (February to April 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 garden 65,955 10,332 1,566.5
2 mom 57,458 4,174 726.4
3 xin 59,352 3,871 652.2
4 rest 79,245 3,307 417.3
5 cfd 511,345 20,767 406.1
6 help 176,801 5,918 334.7
7 ink 111,084 3,658 329.3
8 icu 465,381 14,196 305.0
9 cam 45,862 1,394 304.0
10 life 415,226 9,625 231.8
11 lat 137,498 2,842 206.7
12 cyou 452,272 9,188 203.2
13 top 6,299,448 124,452 197.6
14 fit 68,244 1,338 196.1
15 fyi 65,414 1,226 187.4
16 homes 83,487 1,445 173.1
17 pics 91,204 1,504 164.9
18 one 236,475 3,404 144.0
19 click 723,583 10,391 143.6
20 bond 1,146,414 16,393 143.0

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (February to April 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 161,935,002 127,434 7.87
2 top 6,299,448 118,705 188.44
3 cn 12,352,863 27,136 21.97
4 cfd 511,345 19,167 374.83
5 shop 3,942,700 18,453 46.80
6 xyz 7,948,829 17,256 21.71
7 vip 1,673,065 16,688 99.75
8 bond 1,146,414 16,160 140.96
9 info 5,250,592 15,857 30.20
10 cc 2,431,298 15,583 64.09
11 sbs 1,370,480 15,551 113.47
12 icu 465,381 12,464 267.82
13 pro 1,091,118 12,117 111.05
14 garden 65,955 10,318 1564.40
15 life 415,226 9,351 225.20
16 click 723,583 9,003 124.42
17 net 12,205,093 8,821 7.23
18 cyou 452,272 8,523 188.45
19 online 3,318,823 6,667 20.09
20 org 11,817,837 6,575 5.56

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains