As of October 4, 2026 (UTC)
This report ranks domain zones (TLDs) by the share of compromised domains relative to the total number of active domains in each zone.
We aggregate daily signals from public threat-intelligence sources and match them to NetAPI zone data.
The full list of compromised domains can be downloaded here.
Use it to compare abuse levels across popular TLDs, spot outliers, and prioritize monitoring or policy decisions.
The table below shows the top 100 zones for the selected sort order.
| TLD | Active Domains | Compromised | Abuse Rate |
|---|---|---|---|
| .yt | 1,518 | 276 | 18.182% |
| .gq | 1,982 | 102 | 5.146% |
| .vu | 2,355 | 109 | 4.628% |
| .ga | 4,332 | 189 | 4.363% |
| .wf | 1,077 | 43 | 3.993% |
| .ml | 5,533 | 185 | 3.344% |
| .ug | 5,180 | 162 | 3.127% |
| .tf | 1,680 | 50 | 2.976% |
| .cf | 6,596 | 164 | 2.486% |
| .re | 19,004 | 301 | 1.584% |
| .tk | 18,864 | 214 | 1.134% |
| .je | 3,025 | 30 | 0.992% |
| .fr | 4,752,136 | 42,771 | 0.900% |
| .cyou | 842,746 | 7,183 | 0.852% |
| .host | 30,210 | 256 | 0.847% |
| .io | 1,467,654 | 11,580 | 0.789% |
| .nf | 2,843 | 22 | 0.774% |
| .mom | 126,074 | 964 | 0.765% |
| .lat | 339,938 | 2,470 | 0.727% |
| .gd | 7,664 | 53 | 0.692% |
| .xin | 158,414 | 1,055 | 0.666% |
| .pw | 28,873 | 172 | 0.596% |
| .sh | 22,092 | 116 | 0.525% |
| .live | 966,107 | 5,068 | 0.525% |
| .pm | 23,050 | 120 | 0.521% |
| .casa | 102,169 | 506 | 0.495% |
| .cc | 771,104 | 3,766 | 0.488% |
| .download | 8,831 | 42 | 0.476% |
| .app | 1,918,802 | 8,674 | 0.452% |
| .fit | 92,323 | 405 | 0.439% |
| .cl | 309,757 | 1,340 | 0.433% |
| .hair | 84,901 | 365 | 0.430% |
| .cfd | 1,102,357 | 4,678 | 0.424% |
| .sbs | 1,905,358 | 7,524 | 0.395% |
| .click | 1,356,367 | 5,223 | 0.385% |
| .cd | 2,124 | 8 | 0.377% |
| .digital | 547,132 | 2,037 | 0.372% |
| .shop | 4,323,435 | 15,989 | 0.370% |
| .guru | 76,665 | 273 | 0.356% |
| .luxe | 12,668 | 45 | 0.355% |
| .limo | 2,556 | 9 | 0.352% |
| .qpon | 114,865 | 402 | 0.350% |
| .dev | 852,529 | 2,683 | 0.315% |
| .monster | 70,263 | 219 | 0.312% |
| .yoga | 28,085 | 86 | 0.306% |
| .help | 300,816 | 907 | 0.302% |
| .mg | 2,796 | 8 | 0.286% |
| .rest | 161,368 | 441 | 0.273% |
| .gy | 5,324 | 14 | 0.263% |
| .motorcycles | 49,260 | 126 | 0.256% |
| .baby | 79,821 | 188 | 0.236% |
| .site | 2,619,419 | 5,975 | 0.228% |
| .ink | 148,424 | 338 | 0.228% |
| .lol | 1,349,814 | 2,933 | 0.217% |
| .ao | 4,229 | 9 | 0.213% |
| .tz | 10,680 | 22 | 0.206% |
| .sd | 1,024 | 2 | 0.195% |
| .zw | 9,405 | 18 | 0.191% |
| .vg | 3,136 | 6 | 0.191% |
| .pics | 160,927 | 299 | 0.186% |
| .gl | 2,730 | 5 | 0.183% |
| .pro | 1,705,831 | 3,122 | 0.183% |
| .autos | 363,901 | 664 | 0.182% |
| .sn | 4,497 | 8 | 0.178% |
| .ng | 52,570 | 93 | 0.177% |
| .bingo | 4,570 | 8 | 0.175% |
| .lc | 1,718 | 3 | 0.175% |
| .is | 54,282 | 94 | 0.173% |
| .club | 559,614 | 965 | 0.172% |
| .et | 2,321 | 4 | 0.172% |
| .tc | 10,615 | 18 | 0.170% |
| .foo | 5,525 | 9 | 0.163% |
| .icu | 1,030,519 | 1,667 | 0.162% |
| .bw | 3,143 | 5 | 0.159% |
| .jo | 2,568 | 4 | 0.156% |
| .eg | 4,515 | 7 | 0.155% |
| .rw | 3,256 | 5 | 0.154% |
| .skin | 259,254 | 396 | 0.153% |
| .best | 101,619 | 146 | 0.144% |
| .town | 37,868 | 54 | 0.143% |
| .website | 327,989 | 466 | 0.142% |
| .sc | 2,833 | 4 | 0.141% |
| .courses | 28,350 | 40 | 0.141% |
| .ke | 33,441 | 46 | 0.138% |
| .top | 6,312,774 | 8,670 | 0.137% |
| .st | 14,676 | 20 | 0.136% |
| .support | 50,257 | 68 | 0.135% |
| .accountant | 1,494 | 2 | 0.134% |
| .football | 7,488 | 10 | 0.134% |
| .ht | 2,259 | 3 | 0.133% |
| .promo | 8,308 | 11 | 0.132% |
| .cv | 12,945 | 17 | 0.131% |
| .ps | 4,615 | 6 | 0.130% |
| .wiki | 150,989 | 195 | 0.129% |
| .business | 51,189 | 63 | 0.123% |
| .navy | 1,662 | 2 | 0.120% |
| .pk | 63,376 | 76 | 0.120% |
| .su | 111,492 | 130 | 0.117% |
| .us | 606,739 | 705 | 0.116% |
| .creditcard | 1,744 | 2 | 0.115% |
This report is based on NetAPI datasets and daily signals collected from public threat-intelligence sources.
A domain may appear in this report if it has been observed in phishing, malware distribution, spam, botnet activity, or other potentially abusive behavior.
The presence of a domain in this report does not necessarily indicate malicious intent by the domain owner, registrar, registry, or hosting provider. Some domains may be compromised without the owner's knowledge.
Abuse rates are calculated by comparing the number of currently listed compromised domains against the number of active domains within each TLD. Zones with 1,000 or fewer active domains are excluded from the ranking.
Smaller TLDs with low registration costs or limited moderation policies may show disproportionately high abuse rates compared to large legacy zones.
Statistics are updated daily and may change as new data becomes available.