As of October 5, 2026 (UTC)
This report ranks domain registrars by the share of compromised domains relative to the registered domains attributed to each registrar (based on NetAPI WHOIS data).
Daily signals from public threat-intelligence sources are attributed to registrars via RDAP/WHOIS and compared with each registrar's registered domain count.
Download current or historical lists from our compromised domain lists.
Compare abuse levels across registrars, spot outliers, and prioritize monitoring or policy decisions.
The table below shows the top 100 registrars for the selected sort order (registrars with at least 1,000 registered domains).
See also: TLD Abuse Rate Report
This report is based on NetAPI datasets and daily signals collected from public threat-intelligence sources.
A domain may appear if it has been observed in phishing, malware distribution, spam, botnet activity, or other potentially abusive behavior within the last 24 hours (same window as our current compromised domain lists).
The presence of a domain in this report does not necessarily indicate malicious intent by the domain owner, registrar, registry, or hosting provider. Many domains are compromised without the owner's knowledge.
The overall abuse rate uses all currently listed compromised domains and all active domains across NetAPI zones. Per-registrar rows use that registrar's registered domain count (from WHOIS/RDAP data).
The table lists registrars with at least 1,000 registered domains. We count only domain names we can match to a registrar (not subdomains or hosts we cannot attribute).
Statistics are updated daily and may change as new data becomes available.