Phishing Site Top-level Domains

The most common top-level domain (TLD) used in phishing Web sites between Jul. 1 and Dec. 31 of 2007 was ".com," accounting for 44% of the total. This is not surprising for a number of reasons. Phishers not only benefit from its familiarity, but since it is the most common TLD overall, it is natural that it is also the most commonly used TLD for phishing Web sites. The ".com" domain is also unrestricted and is available to anyone who wishes to register a ".com" domain name, making it easy for phishers to register these domains.

Source: Symantec Internet Security Threat Report, Vol. XIII