Phishing Activity in Top-level Domains (TLDs) November 1, 2025 - January 31, 2026

We analyzed the phishing domains to see how they were distributed across the top-level domains. For our analysis, we extract the Top-level Domain (e.g., com, xyz, uk) from the hostnames we found in phishing reports. We then rank TLD operators based on the number of reported phishing domains and a metric, phishing score.

In the tables below, we rank TLDs that had the highest number of reported phishing domains for the period. A complete list of TLDs where phishing was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of TLDs by Phishing Domains (November to January 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains ▼ Phishing Domain Score
1 com 159,486,840 294,919 18.5
2 top 5,762,807 57,316 99.5
3 cn 11,967,607 52,597 44.0
4 info 5,099,517 39,232 76.9
5 xyz 8,080,029 30,561 37.8
6 cc 2,295,618 29,151 127.0
7 icu 497,697 27,662 555.8
8 sbs 1,250,749 23,471 187.7
9 cfd 469,313 22,870 487.3
10 vip 1,565,053 22,015 140.7
11 online 3,195,347 20,540 64.3
12 net 12,150,532 18,563 15.3
13 shop 3,750,193 16,137 43.0
14 pro 1,017,587 15,070 148.1
15 click 678,049 13,639 201.2
16 org 11,593,451 12,515 10.8
17 cyou 409,691 9,491 231.7
18 site 1,705,452 8,307 48.7
19 live 547,723 7,954 145.2
20 bond 1,129,485 7,456 66.0

To allow comparison of large and small Top-level Domains, we rank TLDs based on a metric, phishing domain score, which is calculated by dividing the number of domain names reported for phishing in a TLD by the number of domains delegated from that TLD.

TLD Phishing Score = (number of phishing domains/domains delegated from TLD) * 10,000

This score can highlight where high-volume phishers place multiple phish on one domain.

Table 2 presents the twenty TLDs that had the highest phishing domain score.

Ranking of TLDs by Phishing Domain Score (November to January 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Phishing Domains Phishing Domain Score ▼
1 xin 63,021 4,904 778.2
2 icu 497,697 27,662 555.8
3 cfd 469,313 22,870 487.3
4 rest 69,782 3,386 485.2
5 help 134,494 6,180 459.5
6 qpon 56,970 2,259 396.5
7 gdn 50,854 1,329 261.3
8 cyou 409,691 9,491 231.7
9 wiki 78,806 1,775 225.2
10 homes 77,543 1,719 221.7
11 lat 118,965 2,589 217.6
12 ink 102,601 2,127 207.3
13 click 678,049 13,639 201.2
14 digital 251,520 5,040 200.4
15 sbs 1,250,749 23,471 187.7
16 finance 32,938 602 182.8
17 bid 43,296 735 169.8
18 pro 1,017,587 15,070 148.1
19 live 547,723 7,954 145.2
20 vip 1,565,053 22,015 140.7

The final table ranks TLDs by malicious domain registrations.

Ranking of TLDs by Malicious Phishing Domains (November to January 2026)

TLDs with a minimum of 30,000 domains and 25 phishing domains

Rank TLD Domains in TLD Malicious Phishing
Domain Registrations ▼		 Malicious Phishing
Domain Score
1 com 159,486,840 158,988 9.97
2 top 5,762,807 36,264 62.93
3 cc 2,295,618 25,949 113.04
4 icu 497,697 24,858 499.46
5 xyz 8,080,029 24,769 30.65
6 info 5,099,517 22,624 44.36
7 cn 11,967,607 22,196 18.55
8 sbs 1,250,749 20,954 167.53
9 cfd 469,313 20,226 430.97
10 vip 1,565,053 18,867 120.55
11 online 3,195,347 16,592 51.93
12 pro 1,017,587 12,437 122.22
13 click 678,049 11,699 172.54
14 net 12,150,532 10,812 8.90
15 cyou 409,691 8,479 206.96
16 shop 3,750,193 8,457 22.55
17 bond 1,129,485 7,216 63.89
18 org 11,593,451 6,545 5.65
19 live 547,723 5,870 107.17
20 site 1,705,452 5,776 33.87

Quarterly Update:
Key Statistics		 Quarterly Update:
Top Level Domains		 Quarterly Update:
Registrars		 Quarterly Update:
Hosting Networks
Quarter over Quarter:
Top Level Domains