Most abused TLDs
The top-level domains attackers lean on most, measured on new malicious domains in the Q-Feeds threat intelligence database. Figures through , refreshed every month.
- 85,564New malicious domains in the last 30 days
- +5.2%Change against the previous 30 days
- 50TLDs in the ranking
- .onionHighest abuse share
Key findings
In the 30 days to , Q-Feeds recorded 85,564 new malicious domains, +5.2% compared with the 30 days before.
.com had the most new malicious domains. That mostly reflects its size, since it is also where most legitimate sites live. Relative to its popular domains, .onion has the highest abuse share in this snapshot.
Cheap registrations, slow abuse handling and bulk registration keep drawing attackers to the same handful of newer gTLDs. The full ranking below shows both views side by side.
Malicious domains by TLD
| Rank | TLD | New malicious domains, 30 days | Share of total | Change vs previous 30 days | 90 days | Abuse share, 90 days |
|---|---|---|---|---|---|---|
| 1 | .com | 19,086 | 22.3% | −33.0% | 70,002 | 5.4% |
| 2 | .monster | 9,887 | 11.6% | +775.0% | 11,062 | 97.7% |
| 3 | .cfd | 8,549 | 10.0% | +1,711.2% | 9,434 | 86.6% |
| 4 | .xyz | 6,393 | 7.5% | +81.4% | 13,117 | 51.9% |
| 5 | .lol | 3,527 | 4.1% | +462.5% | 4,886 | 78.7% |
| 6 | .top | 2,235 | 2.6% | +14.0% | 7,901 | 50.7% |
| 7 | .cc | 1,773 | 2.1% | +146.6% | 3,068 | 20.9% |
| 8 | .info | 1,729 | 2.0% | −55.2% | 13,269 | 56.3% |
| 9 | .shop | 1,679 | 2.0% | −25.1% | 5,849 | 42.4% |
| 10 | .fr | 1,556 | 1.8% | +63.1% | 2,657 | 10.3% |
| 11 | .lt | 1,542 | 1.8% | +1,693.0% | 1,643 | 36.8% |
| 12 | .online | 1,513 | 1.8% | +43.0% | 3,811 | 30.1% |
| 13 | .de | 1,426 | 1.7% | +100.3% | 2,407 | 4.8% |
| 14 | .net | 1,425 | 1.7% | −51.0% | 5,923 | 2.8% |
| 15 | .site | 1,335 | 1.6% | −43.2% | 5,217 | 39.3% |
| 16 | .org | 1,265 | 1.5% | −27.1% | 4,287 | 5.1% |
| 17 | .blog | 1,129 | 1.3% | +1,154.4% | 1,279 | 46.4% |
| 18 | .it | 1,113 | 1.3% | +254.5% | 1,527 | 5.8% |
| 19 | .ru | 860 | 1.0% | −1.9% | 2,366 | 4.3% |
| 20 | .click | 856 | 1.0% | −86.7% | 10,026 | 81.0% |
| 21 | .sbs | 781 | 0.9% | +58.1% | 1,748 | 58.6% |
| 22 | .be | 616 | 0.7% | +555.3% | 740 | 9.1% |
| 23 | .cn | 611 | 0.7% | +25.7% | 1,726 | 5.3% |
| 24 | .ch | 602 | 0.7% | +45.1% | 1,173 | 14.3% |
| 25 | .space | 541 | 0.6% | +214.5% | 1,048 | 32.0% |
| 26 | .digital | 533 | 0.6% | −89.6% | 9,363 | 91.3% |
| 27 | .icu | 475 | 0.6% | −10.7% | 2,122 | 67.8% |
| 28 | .store | 448 | 0.5% | +85.9% | 906 | 20.3% |
| 29 | .pro | 431 | 0.5% | −46.2% | 2,543 | 34.5% |
| 30 | .lv | 423 | 0.5% | +1,221.9% | 461 | 19.8% |
| 31 | .cat | 421 | 0.5% | +2,005.0% | 446 | 32.1% |
| 32 | .live | 413 | 0.5% | −62.0% | 2,635 | 35.4% |
| 33 | .cyou | 386 | 0.5% | +138.3% | 1,023 | 51.6% |
| 34 | .app | 366 | 0.4% | −23.8% | 1,025 | 9.0% |
| 35 | .vip | 350 | 0.4% | +65.1% | 905 | 15.3% |
| 36 | .website | 344 | 0.4% | −47.6% | 1,557 | 67.4% |
| 37 | .co | 322 | 0.4% | −19.5% | 1,023 | 5.4% |
| 38 | .club | 299 | 0.4% | +5.3% | 901 | 21.9% |
| 39 | .nl | 277 | 0.3% | +23.7% | 597 | 3.3% |
| 40 | .in | 276 | 0.3% | +23.2% | 721 | 2.0% |
| 41 | .lat | 268 | 0.3% | −21.6% | 830 | 50.3% |
| 42 | .me | 240 | 0.3% | +6.7% | 650 | 6.3% |
| 43 | .buzz | 232 | 0.3% | −45.0% | 986 | 56.2% |
| 44 | .es | 221 | 0.3% | +52.4% | 438 | 3.2% |
| 45 | .io | 214 | 0.3% | −56.3% | 1,029 | 3.4% |
| 46 | .ink | 208 | 0.2% | +82.5% | 618 | 44.1% |
| 47 | .asia | 188 | 0.2% | +25.3% | 930 | 33.1% |
| 48 | .help | 179 | 0.2% | +59.8% | 426 | 60.3% |
| 49 | .bond | 173 | 0.2% | +127.6% | 396 | 55.7% |
| 50 | .casa | 162 | 0.2% | −13.8% | 367 | 69.4% |
Share is the TLD's part of all new malicious domains in the last 30 days. Abuse share compares malicious domains with popular, legitimate domains under the same TLD over 90 days. TLDs with fewer than 10 malicious domains in 90 days are left out.
TLD block list
These 25 TLDs have the highest abuse share among those with at least 100 malicious domains in the last 90 days. The plain-text file holds one TLD per line and changes with every monthly snapshot.
Blocking a whole TLD also blocks the legitimate sites on it. Start by logging or flagging lookups, check what your users actually visit, then decide.
New malicious domains per month
How we measure this
- Source. The Q-Feeds threat intelligence database, which aggregates and scores indicators from more than 2,500 sources.
- What counts. Domain indicators with a malicious or suspicious verdict. False positives and any domain on one of our warninglists are excluded.
- Time windows. A domain counts in the window in which we first saw it: the last 30 days, the 30 days before that, and the last 90 days, all ending on the snapshot date.
- Abuse share. Malicious domains divided by malicious plus popular domains under the TLD, where popular means listed in public top-site rankings. It shows how dirty a TLD is relative to its legitimate use. It is not a share of every registered domain, because we do not hold registry zone data.
- Updates. A new snapshot is computed in the first days of every month and published here automatically.
Block malicious domains, not just TLDs
Frequently asked questions about abused TLDs
What are the most abused TLDs?
By volume, the largest TLDs such as .com always lead, because that is where most domains are. By abuse share, cheap newer gTLDs dominate. The table above shows both, and the block list ranks TLDs by abuse share.
Why is .com near the top of the ranking?
Because it is by far the largest TLD. A high count for .com says more about its size than about its registry. The abuse share column corrects for that by comparing malicious domains with popular, legitimate ones.
Should I block entire TLDs?
It can work for TLDs your organisation never visits, but it also blocks every legitimate site on them. Log or flag first, review the hits, then block. A domain threat feed blocks known malicious domains on any TLD without that collateral damage.
How often is this page updated?
Every month. A new snapshot is computed in the first days of the month, and this page and the text file update automatically.
Can I use this data?
Yes. The figures and the block list are published under CC BY 4.0. Reuse them freely, also commercially, with a link to this page as attribution.
Where does the data come from?
From the Q-Feeds threat intelligence database, which collects, deduplicates and scores indicators from more than 2,500 open, commercial and in-house sources.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free