Aggregated list of compromised websites

Daily updated database of suspicious, malicious, and phishing domains

Dataset type	Last updated (UTC)	Domains
Current compromised domains	September 11, 2026	332,554	Download
All-time compromised domains Historical list of domain names ever seen as compromised.	September 11, 2026	1,148,629	Download

Both lists are free and published under the Creative Commons Attribution 4.0 (CC BY 4.0) license: use, share and redistribute them freely, including commercially, as long as you credit NetAPI and link to this page.

More about file formats and API usage? See our FAQ or the compromised lists API →

What is the "Current compromised domains" list?

Domain names flagged by our sources as compromised within the last 24 hours — sites observed in malicious activity during that window.

What is the "All-time compromised domains" list?

A historical archive of domain names that have ever appeared in our compromised feed. A domain on this list does not mean the site is still compromised today; most entries reflect past incidents only.

What format are the files in?

Plain text: one domain name per line. Downloads are free and do not require an API token.

Can I download compromised domains by zone?

Yes. Besides these global feeds, you can pull current compromised domain names for a single TLD — for example .com or .net — from each zone page (download link and chart on the zone). Browse zones here, or use the compromised-zone API.

Where does the data come from?

We collect, normalize, and deduplicate indicators daily from:

urlhaus.abuse.ch
hole.cert.pl
stamparm/blackbook
romainmarcoux/malicious-domains
iplists.firehol.org (iblocklist_abuse_zeus.netset)
iplists.firehol.org (firehol_level1.netset)
blocklist.de

Looking for compromised IP addresses or TLD abuse statistics instead?

Feed activity

New compromised domains per day and the size of the current list over time.

New domains per day (last 14 days)

Domains seen in our sources for the first time on that day.

Current list size (last 28 days)

Domains flagged within the last 24 hours. Y-axis is scaled to the data range (not from zero).

Where compromised domains come from

Top-level domains and registrars with the most domains in the current list (as of September 11, 2026).

Top 10 TLDs

#	Zone	Domains	Share
1	.com	81,728	28.1%
2	.fr	41,444	14.2%
3	.shop	15,518	5.3%
4	.io	10,948	3.8%
5	.top	8,767	3.0%
6	.sbs	8,248	2.8%
7	.app	8,142	2.8%
8	.info	7,295	2.5%
9	.cyou	7,244	2.5%
10	.net	7,048	2.4%

Share of the current compromised domain list. Abuse rate per zone: TLD abuse report.

Top 10 registrars

#	Registrar	Domains	Share
1	Dynadot Inc	20,028	18.5%
2	NameCheap, Inc.	19,701	18.2%
3	GoDaddy.com, LLC	5,185	4.8%
4	NICENIC INTERNATIONAL GROUP CO., LIMITED	3,958	3.7%
5	NameSilo, LLC	3,807	3.5%
6	Gname.com Pte. Ltd.	3,639	3.4%
7	Chengdu West Dimension Digital Technology Co., Ltd.	3,607	3.3%
8	Global Domain Group LLC	3,204	3.0%
9	Hosting Concepts B.V. d/b/a Registrar.eu	3,161	2.9%
10	NETIM SAS	3,020	2.8%

Share among domains with a known registrar (37% of the list). Abuse rate per registrar: registrar abuse report.