Phishing Landscape 2026 – Comparing Phishing Activity Across TLD Market Segments

Colin Strutt

In previous years, Interisle published comprehensive annual reports on phishing. This year, we’re taking a different approach and showing just the significant results of our analysis as a series of posts.

You can refer to previous full reports (such as Phishing Landscape 2025) for more details about our methodology and definitions of terms.

In the previous post, we looked at the growth of phishing each quarter since our first Phishing Landscape report.

In this post we group Top-level Domains (TLDs) by “market segments” - the legacy gTLDs (e.g., .COM, .NET, .ORG), the TLDs operated by countries, sovereign states or designated territories (ccTLDs), and TLDs introduced since 2012 (new gTLDs) - and examine how the proportion of registered domains compares to the proportion of domains reported for phishing for each segment.

We observed a marked difference in phishing activity versus registrations in our May 2025 - April 2026 data. The ccTLD segment has best ratio of registered domains versus domains reported for phishing, and as we’ve observed in each study period since 2021, the new gTLD segment has the worst.

In the next post, we will look at how this breakdown by type of TLD has changed over the past six years.