| Dataset type | Last updated (UTC) | Domains | CSV |
|---|---|---|---|
| Current compromised domains | October 27, 2026 | 334,334 | Download |
|
All-time compromised domains Historical list of domain names ever seen as compromised. |
October 27, 2026 | 1,191,760 | Download |
Both lists are free and published under the Creative Commons Attribution 4.0 (CC BY 4.0) license: use, share and redistribute them freely, including commercially, as long as you credit NetAPI and link to this page.
The feed is built from public abuse sources, and a source can keep a domain after the problem is gone. If your domain is listed by mistake, send a removal request: we confirm it by email, compare it with the original sources and remove the domain with its subdomains when the listing no longer holds, usually within two business days.
Domain names flagged by our sources as compromised within the last 24 hours — sites observed in malicious activity during that window.
A historical archive of domain names that have ever appeared in our compromised feed. A domain on this list does not mean the site is still compromised today; most entries reflect past incidents only.
Plain text: one domain name per line. Downloads are free and do not require an API token.
Yes. Besides these global feeds, you can pull current compromised domain names for a
single TLD — for example .com or .net — from each zone page (download
link and chart on the zone). Browse zones here, or use the
compromised-zone API.
We collect, normalize, and deduplicate domain indicators daily from these public feeds (domain names only; the IP addresses they contain go to the compromised IP list):
Looking for compromised IP addresses or TLD abuse statistics instead?
New compromised domains per day and the size of the current list over time.
Domains seen in our sources for the first time on that day.
Domains flagged within the last 24 hours. Y-axis is scaled to the data range (not from zero).
Top-level domains and registrars with the most domains in the current list (as of October 27, 2026).
| # | Zone | Domains | Share |
|---|---|---|---|
| 1 | .com | 73,493 | 25.9% |
| 2 | .fr | 43,334 | 15.3% |
| 3 | .shop | 17,066 | 6.0% |
| 4 | .io | 12,103 | 4.3% |
| 5 | .app | 9,518 | 3.4% |
| 6 | .top | 8,703 | 3.1% |
| 7 | .sbs | 8,501 | 3.0% |
| 8 | .net | 8,291 | 2.9% |
| 9 | .cyou | 6,808 | 2.4% |
| 10 | .info | 6,758 | 2.4% |
Share of the current compromised domain list. Abuse rate per zone: TLD abuse report.
| # | Registrar | Domains | Share |
|---|---|---|---|
| 1 | Dynadot | 23,379 | 20.9% |
| 2 | Namecheap | 18,581 | 16.6% |
| 3 | Netim | 5,065 | 4.5% |
| 4 | GoDaddy | 4,622 | 4.1% |
| 5 | Gname | 4,519 | 4.0% |
| 6 | Openprovider | 4,333 | 3.9% |
| 7 | NameSilo | 3,992 | 3.6% |
| 8 | NiceNIC | 3,816 | 3.4% |
| 9 | PublicDomainRegistry | 2,978 | 2.7% |
| 10 | West.cn (西部数码) | 2,634 | 2.4% |
Share among domains with a known registrar (39% of the list). Abuse rate per registrar: registrar abuse report.