Spam Activity in Domain Registrars, December 1,2025 - February 28,2026

Spammers compose hostnames for email emitters (e.g., spambots) and URLs from domain names that they register purposely for spam (malicious domain registrations), or from domain names that they have exploited in some way (e.g., by hijacking a domain registration account or by compromising a host such as a web site). They embed these URLs in the emails, texts, or social media posts that lure victims to scam, phishing, or malware web sites.

To determine where gTLD domain names were purchased and managed, and where reported spam domains are concentrated in gTLD registrars’ domain portfolios, we identify the domain name Registrar - the business entity that processed the domain name registration – of domain names reported for spam activity from domain name registration data obtained via the Whois or RDAP services. Measurements of reported spam domains can identify registrars where close analyses of business practices, account security, or pricing might prove useful.

We currently collect domain registration data for generic Top-level Domains only; thus, the tables on this page present gTLD domains under management for each registrar.

In the table below, we show the domain name Registrars with the highest number of reported spam domains under management. A complete list of gTLD registrars where spam was reported for the quarter can be downloaded in CSV format from the Records page.