Phishing Landscape 2025:
Top-level Domains (TLDs) May 1, 2024 - April 30, 2025

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to April 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 154,712,032 455,297 29.4
2 top 3,525,239 187,749 532.6
3 bond 454,090 79,875 1,759.0
4 xyz 4,219,839 73,509 174.2
5 shop 3,321,636 50,052 150.7
6 info 3,871,727 44,540 115.0
7 xin 39,522 42,724 10,810.2
8 cn 11,606,857 40,763 35.1
9 online 2,950,523 33,414 113.3
10 net 12,352,692 31,743 25.7
11 ru 5,777,653 31,312 54.2
12 vip 1,272,004 30,216 237.6
13 cc 1,865,743 24,550 131.6
14 cfd 324,157 24,241 747.8
15 lol 516,184 24,187 468.6
16 org 11,185,745 24,111 21.6
17 sbs 786,261 23,293 296.3
18 site 1,516,396 20,595 135.8
19 icu 422,101 19,392 459.4
20 pro 863,933 17,078 197.7

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to April 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 xin 39,522 42,724 10,810.2
2 bond 454,090 79,875 1,759.0
3 help 43,991 4,741 1,077.7
4 win 82,992 6,607 796.1
5 cfd 324,157 24,241 747.8
6 finance 32,064 1,930 601.9
7 support 37,431 2,086 557.3
8 top 3,525,239 187,749 532.6
9 world 312,180 15,408 493.6
10 fyi 85,395 4,082 478.0
11 lol 516,184 24,187 468.6
12 icu 422,101 19,392 459.4
13 cyou 209,499 7,262 346.6
14 mom 49,315 1,709 346.6
15 zone 77,426 2,559 330.5
16 monster 46,750 1,476 315.7
17 pics 58,241 1,770 303.9
18 sbs 786,261 23,293 296.3
19 best 52,667 1,560 296.2
20 buzz 288,216 7,788 270.2

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to April 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 154,712,032 306,233 19.79
2 top 3,525,239 161,655 458.56
3 bond 454,090 79,690 1754.94
4 xyz 4,219,839 64,711 153.35
5 xin 39,522 42,681 10799.30
6 info 3,871,727 37,237 96.18
7 vip 1,272,004 27,585 216.86
8 shop 3,321,636 26,892 80.96
9 ru 5,777,653 25,682 44.45
10 online 2,950,523 25,650 86.93
11 cfd 324,157 23,219 716.29
12 lol 516,184 23,122 447.94
13 cc 1,865,743 22,252 119.27
14 net 12,352,692 22,178 17.95
15 sbs 786,261 21,990 279.68
16 icu 422,101 18,210 431.41
17 site 1,516,396 16,185 106.73
18 org 11,185,745 16,167 14.45
19 pro 863,933 15,159 175.46
20 world 312,180 14,486 464.03

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains