Phishing Activity in Top-level Domains (TLDs) May 1, 2026 - July 31, 2026

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (May to July 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 165,031,707 283,895 17.2
2 cn 11,814,573 147,217 124.6
3 top 6,250,770 59,586 95.3
4 icu 557,261 46,542 835.2
5 cfd 544,185 44,284 813.8
6 shop 4,354,384 37,092 85.2
7 xyz 8,923,117 33,201 37.2
8 vip 1,873,696 31,181 166.4
9 sbs 1,101,235 30,825 279.9
10 pro 1,167,005 28,661 245.6
11 cc 2,644,726 26,793 101.3
12 info 5,256,765 25,329 48.2
13 bond 1,163,102 21,054 181.0
14 net 12,324,169 18,894 15.3
15 online 3,443,791 18,486 53.7
16 live 596,758 16,592 278.0
17 click 816,317 15,553 190.5
18 garden 197,058 15,255 774.1
19 cyou 485,161 14,630 301.6
20 site 1,802,305 13,220 73.4

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (May to July 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 icu 557,261 46,542 835.2
2 cfd 544,185 44,284 813.8
3 garden 197,058 15,255 774.1
4 help 200,395 11,452 571.5
5 cam 61,842 2,975 481.1
6 mom 75,011 3,543 472.3
7 boats 30,601 1,402 458.2
8 vu 41,707 1,601 383.9
9 xin 58,724 2,123 361.5
10 cyou 485,161 14,630 301.6
11 lat 184,630 5,369 290.8
12 sbs 1,101,235 30,825 279.9
13 live 596,758 16,592 278.0
14 autos 202,577 5,314 262.3
15 ink 129,269 3,321 256.9
16 pro 1,167,005 28,661 245.6
17 homes 99,030 2,363 238.6
18 hair 57,740 1,349 233.6
19 finance 33,633 755 224.5
20 win 146,628 3,270 223.0

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (May to July 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 165,031,707 198,404 12.02
2 cn 11,814,573 118,765 100.52
3 top 6,250,770 57,802 92.47
4 icu 557,261 41,624 746.94
5 cfd 544,185 39,130 719.06
6 shop 4,354,384 34,276 78.72
7 vip 1,873,696 28,181 150.40
8 xyz 8,923,117 27,765 31.12
9 pro 1,167,005 27,647 236.91
10 sbs 1,101,235 27,161 246.64
11 cc 2,644,726 23,338 88.24
12 info 5,256,765 22,474 42.75
13 bond 1,163,102 20,406 175.44
14 live 596,758 15,566 260.84
15 garden 197,058 15,251 773.93
16 online 3,443,791 15,234 44.24
17 net 12,324,169 13,597 11.03
18 click 816,317 13,244 162.24
19 cyou 485,161 13,231 272.71
20 site 1,802,305 10,260 56.93

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains