Phishing Activity in Top-level Domains (TLDs) May 1, 2025 - April 30, 2026

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to April 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 161,935,002 869,180 53.7
2 top 6,299,448 375,514 596.1
3 cn 12,352,863 167,651 135.7
4 pro 1,091,118 130,945 1,200.1
5 info 5,250,592 99,602 189.7
6 xyz 7,948,829 93,987 118.2
7 vip 1,673,065 83,816 501.0
8 shop 3,942,700 79,625 202.0
9 cc 2,431,298 77,660 319.4
10 icu 465,381 74,786 1,607.0
11 cfd 511,345 70,944 1,387.4
12 sbs 1,370,480 63,518 463.5
13 net 12,205,093 56,360 46.2
14 online 3,318,823 47,376 142.8
15 jp 1,804,563 46,845 259.6
16 bond 1,146,414 41,594 362.8
17 live 561,277 41,523 739.8
18 click 723,583 35,653 492.7
19 org 11,817,837 35,176 29.8
20 xin 59,352 35,077 5,910.0

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to April 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 xin 59,352 35,077 5,910.0
2 win 113,527 18,626 1,640.7
3 icu 465,381 74,786 1,607.0
4 garden 65,955 10,340 1,567.7
5 cfd 511,345 70,944 1,387.4
6 pro 1,091,118 130,945 1,200.1
7 help 176,801 18,715 1,058.5
8 mom 57,458 5,728 996.9
9 rest 79,245 7,774 981.0
10 mobi 395,488 33,424 845.1
11 qpon 72,471 5,941 819.8
12 live 561,277 41,523 739.8
13 ink 111,084 7,980 718.4
14 best 36,275 2,563 706.6
15 lat 137,498 9,137 664.5
16 cyou 452,272 29,923 661.6
17 top 6,299,448 375,514 596.1
18 wang 42,308 2,288 540.8
19 life 415,226 21,836 525.9
20 homes 83,487 4,365 522.8

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to April 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 161,935,002 577,821 35.68
2 top 6,299,448 297,486 472.24
3 pro 1,091,118 110,609 1013.72
4 vip 1,673,065 79,694 476.34
5 xyz 7,948,829 79,436 99.93
6 cc 2,431,298 72,266 297.23
7 info 5,250,592 71,488 136.15
8 icu 465,381 71,070 1527.14
9 cfd 511,345 67,461 1319.29
10 cn 12,352,863 65,939 53.38
11 sbs 1,370,480 59,737 435.88
12 shop 3,942,700 48,459 122.91
13 bond 1,146,414 41,184 359.24
14 net 12,205,093 39,123 32.05
15 online 3,318,823 38,185 115.06
16 live 561,277 37,525 668.56
17 xin 59,352 33,541 5651.20
18 click 723,583 32,150 444.32
19 mobi 395,488 30,234 764.47
20 cyou 452,272 28,685 634.24

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains