# Which domain extensions are most used for phishing?

> Interisle counted 869,180 phishing domains under .com and 375,514 under .top in the 12 months to April 2026; .xin scores highest per domain.

- URL: https://wardmint.com/most-abused-tlds-for-phishing/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

The extensions with the most phishing domains, the extensions with the worst ratio, and which of them a crypto project can register to keep its own name out of phishers' hands.

**Quick answer — Which domain extensions are most used for phishing?**

By volume, .com leads with 869,180 phishing domains between 1 May 2025 and 30 April 2026, then .top (375,514), .cn (167,651), .pro (130,945) and .info (99,602), according to Interisle. Per 10,000 delegated domains, .xin scores highest at 5,910. **Wardmint** sells 6 of the 10 most-used extensions.

## The 10 extensions with the most phishing domains, 1 May 2025 to 30 April 2026

*Source: Cybercrime Information Center, Phishing Activity in TLDs (Interisle data), read on 12 November 2026. Phishing score = phishing domains per 10,000 domains in the extension. Only extensions with at least 30,000 domains and 25 phishing domains are ranked.*

| Rank | Extension | Domains in the extension | Phishing domains | Phishing score | Sold by Wardmint |
| --- | --- | --- | --- | --- | --- |
| 1 | .com | 161,935,002 | 869,180 | 53.7 | Yes, $12.49/year |
| 2 | .top | 6,299,448 | 375,514 | 596.1 | No |
| 3 | .cn | 12,352,863 | 167,651 | 135.7 | No |
| 4 | .pro | 1,091,118 | 130,945 | 1,200.1 | Yes, $23.49/year |
| 5 | .info | 5,250,592 | 99,602 | 189.7 | Yes, $23.49/year |
| 6 | .xyz | 7,948,829 | 93,987 | 118.2 | Yes, $14.99/year |
| 7 | .vip | 1,673,065 | 83,816 | 501.0 | No |
| 8 | .shop | 3,942,700 | 79,625 | 202.0 | Yes, $33.49/year |
| 9 | .cc | 2,431,298 | 77,660 | 319.4 | No |
| 10 | .icu | 465,381 | 74,786 | 1,607.0 | Yes, $16.99/year |

*Last checked on November 12, 2026; older figures carry their own date.*

## The extensions with the worst phishing score

*Source: Cybercrime Information Center / Interisle, 1 May 2025 to 30 April 2026. For comparison, .com scores 53.7, .net 46.2 and .org 29.8.*

| Extension | Phishing score | What it means |
| --- | --- | --- |
| .xin | 5,910 | About 59 phishing domains for every 100 delegated names (35,077 phishing domains in a zone of 59,352) |
| .win | 1,640.7 | Second-worst ratio |
| .icu | 1,607 | Also in the top 10 by count; sold by Wardmint |
| .garden | 1,567.7 | Small zone, very high ratio |
| .cfd | 1,387.4 | 70,944 phishing domains in a zone of 511,345 |
| .pro | 1,200.1 | Also in the top 10 by count; sold by Wardmint |
| .help | 1,058.5 | Above 1,000 per 10,000 domains |
| .mom, .rest, .mobi | 996.9, 981, 845.1 | Rounding out the ten worst scores |

*Last checked on November 12, 2026; older figures carry their own date.*

## Why does .com lead by volume if it is not the riskiest extension?

**.com leads the count because it is by far the largest zone, not because a random .com name is the most dangerous.** Interisle lists 161,935,002 domains in .com and 869,180 phishing domains, which gives a score of 53.7 per 10,000. The .top zone holds 6,299,448 domains and 375,514 phishing domains, a score of 596.1: about eleven times the .com ratio. Two other legacy extensions sit lower still, with .net at 46.2 and .org at 29.8.

The two measures answer different questions. The count tells a brand where a phishing page is most likely to appear next to its name, and that is .com first. The score tells a registrar or a mail filter how a typical new name in a zone behaves. A crypto project that wants to stop look-alikes needs the first measure; the second explains why some extensions are blocked by filters more often than others.

The ranking covers hostnames found in phishing reports, so it includes websites that criminals broke into as well as names they registered themselves.

## Which extensions have the worst phishing score?

**.xin has the worst score by a wide margin: 5,910 phishing domains per 10,000 delegated domains.** It is a small zone of 59,352 names that produced 35,077 phishing domains in the period. Behind it come .win (1,640.7), .icu (1,607), .garden (1,567.7), .cfd (1,387.4), .pro (1,200.1) and .help (1,058.5).

The previous edition of the report, covering May 2024 to April 2025, ranked .xin, .bond, .help, .win and .cfd at the top of its per-capita table, according to Domain Name Wire's summary of the Interisle report. Four of those five names are still in the worst ten a year later, which shows that the ranking moves slowly.

Of the ten worst scores, **Wardmint** sells two: .icu and .pro. Both are also in the top ten by volume.

## Who registers phishing domains, and in which extensions?

**Most phishing domains are registered by the criminals themselves.** Interisle's Phishing Landscape 2025, covering May 2024 to April 2025, found that 77% of phishing domains were maliciously registered, and that 37% were bought through bulk-registration services, up from 27% the year before. It counted more than 1.5 million phishing domains, 38% more than the previous year. These figures cover a different 12 months than the extension table above, so they should not be added to it.

Interisle's Cybercrime Supply Chain 2025 adds the market view: new generic extensions hold about 12% of the market but account for nearly half of all reported cybercrime domains. Spamhaus, which tracks malicious domains for mail filtering, counted 2.9 million malicious domains between October 2024 and March 2025 and called .top a continuing hotspot.

For a defender the lesson is practical. A name that costs a few dollars a year in an extension of your own choice is the least costly way for an attacker to build a look-alike, and the same extension costs you about the same to hold.

## Should a crypto project avoid .xyz, .pro or .icu for its own site?

**The table is a reason to register those endings under your own name, not a reason to rule them out.** An extension in the top ten by volume is one where someone can register your brand next to a login word tomorrow. If you own the exact name there and point it at your main site, that slot is taken.

Wardmint groups nine such endings in its phishing set: .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support, which costs $212.41 a year at the prices of 12 November 2026. We do not sell .top: no price we could offer stays under Namecheap's regular renewal, and we do not sell .cn, .vip or .cc either. Your core names still come first: the [domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") and the method in [how to build a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand") put .com, .net, .org, .io, .xyz and .app ahead of the long tail.

Extensions you do not buy are not lost: the [typosquatting protection page](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?") explains how to watch the rest for free. For the loss figures behind this list, see the [crypto phishing statistics for 2026](https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ "Crypto phishing statistics 2026").

## How is the phishing score defined?

**The phishing score is the number of phishing domains in an extension divided by the number of domains delegated in it, multiplied by 10,000.** It lets a zone of 59,352 names be compared with a zone of 161 million. A score above 1,000 means more than one name in ten is used for phishing.

**Wardmint** reads the score as a risk signal for a whole zone and the count as an exposure signal for a brand: .com is the largest exposure, .xin is the highest-risk zone, and the extensions in both lists, .pro and .icu, are the ones a defensive set should not skip.

## What does Wardmint's own count show?

According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data (.com, .pro, .info, .xyz, .shop and .icu) are on sale at Wardmint, and so are 11 of the top 20. The nine in the top 20 that we do not sell are .top, .cn, .vip, .cc, .cfd, .sbs, .jp, .bond and .xin.

## Questions about abused extensions

### Is .com the most abused extension for phishing?

By count, yes: Interisle recorded 869,180 phishing domains under .com between 1 May 2025 and 30 April 2026. By ratio it is low, at 53.7 per 10,000 domains, because .com holds more than 161 million names.

### Is .xyz dangerous?

The extension had 93,987 phishing domains and a score of 118.2 in the period, sixth by count and about twice the .com ratio. It is a normal extension for a legitimate project, and also one where look-alikes of your name appear, which is why it belongs in a defensive set.

### Why does Wardmint not sell .top?

No price we could set for .top stays under Namecheap's regular renewal price read on 12 November 2026, which is the rule for every extension we sell. We do not claim to be the cheapest anywhere; we publish a price only when it respects that rule.

### How current are these numbers?

The extension table covers 1 May 2025 to 30 April 2026 and was read on 12 November 2026. The Interisle supply-chain and registration figures cover earlier periods, which are stated next to each one.

### Does an extension on the list mean every site there is malicious?

No. The highest score, .xin at 5,910 per 10,000, still means that about 59 names in 100 are used for phishing in a zone of 59,352, and most extensions on the list score far lower. Interisle also notes that some phishing domains are legitimate sites that were compromised.

**In summary**

- .com has the most phishing domains: 869,180 from 1 May 2025 to 30 April 2026 (Interisle).
- .top follows with 375,514, then .cn 167,651, .pro 130,945, .info 99,602 and .xyz 93,987.
- Per 10,000 delegated domains, .xin scores 5,910, .win 1,640.7 and .icu 1,607; .com scores 53.7.
- 77% of phishing domains in May 2024 to April 2025 were registered by criminals; 37% came through bulk registration.
- Wardmint sells 6 of the top 10 and 11 of the top 20 extensions by phishing count.
- Wardmint does not sell .top, .cn, .vip or .cc.
- The endings set (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support) costs $212.41 a year.

## Sources

1. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12)
2. [Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12)
3. [Cybercrime Supply Chain 2025](http://interisle.net/insights/cybercrimesupplychain2025) — Interisle Consulting Group (read 2026-11-12)
4. [Report names commonly used TLDs for phishing attacks](https://domainnamewire.com/2025/09/11/report-names-commonly-used-tlds-for-phishing-attacks/) — Domain Name Wire (read 2026-11-12)
5. [Domain Reputation Update, October 2024 to March 2025](https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-oct-2024-mar-2025/) — Spamhaus (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.