Most Abused TLDs
By Mustafa Bilgic · Updated 18 August 2026
Certain top-level domains consistently appear at the top of abuse rankings published by organizations like Spamhaus. The pattern is not random—there is a strong correlation between very low promotional pricing and high abuse rates. When a domain costs almost nothing to register, the barrier for spammers, phishers, and malware distributors effectively disappears.
Abuse data referenced in this guide comes from published Spamhaus reports and similar organizations. Specific percentages are not quoted because they change with each reporting cycle—check the original sources for current figures.
The Cheap Registration-Abuse Correlation
The relationship between low-cost domain registration and abuse is well-documented. Extensions that have offered very cheap or historically free registration—such as the former Freenom TLDs (.tk, .ml, .ga, .cf, .gq)—have consistently topped Spamhaus's published abuse rankings. The logic is straightforward: abusers need domains in bulk, and cost is their primary constraint. A spam or phishing campaign might burn through hundreds of domains in a single week, so the cheaper each domain, the more profitable the operation becomes.
Promo-tier gTLDs with extremely low first-year pricing show a similar pattern, though typically less extreme than the Freenom extensions were at their peak. When a new gTLD launches with aggressive promotional pricing to attract initial registrations, it often attracts abusers alongside legitimate users. Some registries have responded by implementing verification steps or minimum pricing floors, recognizing that rock-bottom prices attract the wrong kind of registration volume.
How Abuse Data Is Tracked
Spamhaus, the most widely cited source for TLD abuse data, monitors domains reported for spam, phishing, botnet command-and-control activity, and malware distribution. Their published rankings show which TLDs have the highest proportion of abusive domains relative to total registrations. This proportional measure is what matters—a TLD with millions of registrations will naturally have more abuse in absolute numbers, but the rate per registration reveals whether a systemic problem exists.
Other organizations, including the Anti-Phishing Working Group and academic security researchers, publish similar analyses using different methodologies. The findings generally align: TLDs with minimal registration costs and weak verification consistently have higher abuse rates. No single data source captures the complete picture, but when multiple independent sources identify the same extensions repeatedly, the pattern is reliable. This page references these findings by attribution rather than quoting specific percentages, as the numbers shift with each reporting period.
Impact on Legitimate Domain Owners
If you register a domain on a heavily abused TLD, you inherit its collective reputation whether your individual site deserves it or not. Email deliverability is the most immediate casualty. Email providers use TLD reputation as one of many filtering signals, and domains on high-abuse extensions are more likely to land in spam folders, face stricter DMARC enforcement, or be blocked outright by aggressive corporate filters.
Browser security warnings are another concern. When a TLD has a high proportion of malicious sites, security tools and browser extensions may flag domains on that extension more aggressively. User trust is harder to quantify but equally real—visitors who have encountered phishing on a particular extension may hesitate to click links using it. These reputation effects are collective and persistent. Even if your individual site is perfectly legitimate and well-built, you are swimming against a current created by thousands of abusive registrations sharing your extension.
Choosing a TLD With a Clean Reputation
Before registering a domain, check the TLD's reputation using publicly available data. Spamhaus publishes its most-abused TLD rankings, which are freely accessible and updated regularly. If the extension you are considering appears prominently on that list, weigh whether the cost savings justify the potential deliverability and trust problems. For any domain where email reliability matters—which includes virtually every business—the answer is almost always to choose a cleaner extension.
Established TLDs with moderate pricing—.com, .net, .org, and well-managed newer gTLDs—generally maintain clean reputations because their registration costs create a natural economic barrier against bulk abuse. Some newer extensions have also invested in proactive abuse mitigation through registration verification and rapid takedown procedures. A TLD's reputation is not permanently fixed; registries that address their abuse problem can improve over time. But rehabilitation takes years of sustained effort, and your domain's reputation cannot afford to wait that long.
Frequently asked questions
Does using an abused TLD mean Google will penalize my site?
Google has stated that TLD choice does not directly affect search rankings. However, the indirect effects—lower click-through rates, email deliverability issues, and user distrust—can hurt your site's performance in ways that eventually influence engagement-based ranking signals.
Are all cheap TLDs heavily abused?
No. The correlation is specifically between extremely low promotional pricing and abuse, not between affordable pricing generally and abuse. Many budget-tier TLDs maintain acceptable abuse rates through responsible registry management and reasonable minimum pricing.
Where can I check if my TLD has an abuse problem?
Spamhaus publishes regularly updated TLD reputation data on its website. The Anti-Phishing Working Group also releases periodic reports. If your chosen TLD appears consistently near the top of these published lists, consider registering on a different extension.
Can an abused TLD recover its reputation?
Recovery is possible but slow. A registry that implements stricter registration policies, invests in abuse takedown, and raises pricing floors can gradually reduce abuse rates. However, reputational recovery among users and email filtering systems takes considerably longer than the technical cleanup.