Fresh note examines which top level domains are popular with cyber criminals

Interisle note analyzes which top level domains are used for spam, spreading malware, and phishing.

Interisle has released its annual Cybercrime Supply Chain 2024 note, which discusses which top level domain names are used for malware, phishing, and spam.

The firm reviewed 16.3 million attacks from Sept 2023 to Aug 2024. 8.6 million unique domains were used in attacks, compared to 4.8 million in the previous year.

Interisle notes some similarities in registration patterns used in attacks.

First, they are frequently registered in bulk. The note states that 2.6 million domains identified from the attacks were registered in bulk, more than double the previous year’s number. In one example, 17,000 malicious domains were registered in under 8 hours at one registrar.

Second, cheaper domains are at higher risk of being used by bad actors.

From a raw numbers perspective, .com has the most malicious domains, followed by .top, .xyz, .shop, and .cc, as stated by Interisle. But that tells only part of the story since many namespaces are larger than others.

To compensate for this, Interisle also calculates a Cybercrime Domain Score for each top level domain. Looking at the percentage of domains used for cybercrimes (some of which might have been compromised or hacked), the worst top level domains are .rest, .ooo, .tk, .cam, and .top, as stated by the note.

Earlier this year, Interisle noted a fresh trend in malicious domains: bad actors registering subdomains of popular free services to conduct attacks. 1.2 million subdomains were used in the attacks Inserisle analyzed.