Phishing Activity in Top-level Domains (TLDs) May 1, 2025 - July 31, 2025

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to July 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 155,946,391 262,822 16.9
2 top 4,547,013 114,227 251.2
3 pro 912,377 78,391 859.2
4 cn 11,976,858 53,178 44.4
5 jp 1,758,899 45,579 259.1
6 info 4,070,700 36,209 89.0
7 vip 1,350,818 34,981 259.0
8 shop 3,267,442 34,010 104.1
9 xyz 4,840,672 30,919 63.9
10 icu 450,286 30,407 675.3
11 live 565,548 25,894 457.9
12 cc 2,015,676 22,756 112.9
13 xin 49,355 21,824 4,421.8
14 sbs 839,981 19,264 229.3
15 cfd 388,222 18,560 478.1
16 win 81,997 16,889 2,059.7
17 net 12,302,900 16,314 13.3
18 online 3,014,264 11,499 38.2
19 world 320,374 9,917 309.5
20 bond 150,272 9,646 641.9

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to July 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 xin 49,355 21,824 4,421.8
2 win 81,997 16,889 2,059.7
3 pro 912,377 78,391 859.2
4 icu 450,286 30,407 675.3
5 help 79,275 5,267 664.4
6 bond 150,272 9,646 641.9
7 run 46,478 2,509 539.8
8 cfd 388,222 18,560 478.1
9 live 565,548 25,894 457.9
10 best 44,143 1,883 426.6
11 world 320,374 9,917 309.5
12 wang 61,372 1,660 270.5
13 cyou 271,929 7,112 261.5
14 jp 1,758,899 45,579 259.1
15 vip 1,350,818 34,981 259.0
16 top 4,547,013 114,227 251.2
17 pics 57,968 1,412 243.6
18 qpon 31,719 770 242.8
19 sbs 839,981 19,264 229.3
20 support 38,040 857 225.3

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to July 2025)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 155,946,391 148,522 9.52
2 top 4,547,013 84,956 186.84
3 pro 912,377 63,476 695.72
4 vip 1,350,818 32,585 241.22
5 icu 450,286 28,322 628.98
6 xyz 4,840,672 24,670 50.96
7 live 565,548 24,053 425.30
8 info 4,070,700 22,897 56.25
9 xin 49,355 20,596 4173.03
10 cc 2,015,676 19,609 97.28
11 sbs 839,981 17,695 210.66
12 cfd 388,222 16,845 433.90
13 win 81,997 16,733 2040.68
14 shop 3,267,442 15,184 46.47
15 cn 11,976,858 13,795 11.52
16 net 12,302,900 10,561 8.58
17 bond 150,272 9,484 631.12
18 club 577,539 8,985 155.57
19 world 320,374 8,537 266.47
20 online 3,014,264 7,990 26.51

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains