Most abused domain name extensions

Spamhaus has named .com the most abused top-level domain name extension in Botnets in Q3-2019. But it is not that simple as some additional stats show.

The amount of newly detected botnet command & control servers (C&Cs) reached an all-time high in July this year with more than 1,500 botnet C&Cs detected by Spamhaus Malware Labs. This is far in excess of the monthly average, set in the first half of this year, of 1,000 botnet C&Cs.

Yesterday Namecheap was named most abused domain registrar in Botnets.

These are the stats from Spamhaus: (below you can see some additional stats)

Most abused top-level domains, Q3 2019

This quarter saw the number of country code top-level domains (ccTLDS) increase in the Top 20 list. Almost half of the TLDs were within the ccTDL name space: ‘.ru’, ‘.pw’, ‘.eu’, ‘.ga’, ‘.tk’, ‘.su’, ‘.ml’, ‘.cf’ and ‘.me.’

The leader of the chart remained the same, as in Q2; the generic top-level domain (gTLD) ‘.com.’ Meanwhile the number of fraudulent domain names registered within ccTLD ‘.ru’ almost halved from 731 domains in Q2 to 392 domains in Q3.

An interesting change to note is that in quarter three two more gTLDs joined ‘.com’ in Q3 in the top 3: ‘.net’ and ‘.info’.

(What domains do these statistics include? Remember that we only count domain names that have been registered fraudulently for the sole purpose of hosting a botnet C&C. These statistics do not include botnet C&Cs hosted on compromised websites or domain names.)

Some additional stats

Of course the absolute number of abused domain names is very important but I thought it would be interesting to see what percentage of each TLD is abused.

So I found how many domains are registered in each TLD (except for .su), combined the Spamhaus numbers and compiled the percentage of abused domains in Botnets in each TLD.

This gives a completely different ranking where .name is the most abused TLD followed closely by .pw. .Com is now ranked 16th because it is the number one TLD in terms of domain name registrations by far.

	TLD	%
1.	name	0,0680%
2.	pw	0,0530%
3.	live	0,0148%
4.	top	0,0120%
5.	info	0,0098%
6.	xyz	0,0084%
7.	icu	0,0056%
8.	ru	0,0053%
9.	me	0,0048%
10.	ga	0,0046%
11.	club	0,0043%
12.	eu	0,0042%
13.	net	0,0039%
14.	site	0,0033%
15.	ml	0,0031%
16.	com	0,0030%
17.	org	0,0022%
18.	cf	0,0021%
19.	tk	0,0008%
20.	su	–