See here the most abused top-level domains at Botnets, Q3 2021.
No changes at the top of the chart
In Q3, .com and .xyz continued to stay at the top of our ranking. The situation deteriorated for these two TLDs, particularly .com, which experienced a 90% increase. We hope that VeriSign, the owner of this TLD, will take all necessary steps to improve this situation and increase their TLD’s reputation.
Three new TLDs
Two new gTLDs and one ccTLD joined our Top 20: .club, .co and .monster. All have seen a significant increase in the number of new botnet C&C domains registered through their service.
You can read the complete Spamhaus report here.
Spamhaus is unable to differentiate between spoofing spam and real spam, so it’s data and blacklist is unreliable. It also has a problem with snowshoeing.
I received multiple warnings regarding spam from my .info domains because of Spamhaus’ wreckless reporting. The spam was spoofed or snowshoed.
I had spf records set to “v=spf1 -all” and no emails were ever sent from those domains.