The fix, in one snippet
.top .xyz .icu .rest .cfd .sbs .clickIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The TLD is matched against a list maintained from public abuse statistics, principally Spamhaus's most-abused TLD rankings and the APWG phishing trend reports. It includes registries with very cheap or promotional pricing (.top, .xyz, .icu, .cfd, .sbs, .bond, .buzz, .click), the former free Freenom domains (.tk, .ml, .ga, .cf, .gq), and .zip and .mov, which collide with file extensions so that text like invoice.zip becomes a clickable link. Severity is low: this is a prior, not evidence. Limits: legitimate businesses use these TLDs; the rankings change and the list is refreshed; .com hosts more phishing than any of them in absolute numbers because it is the largest.
Why it matters
Free and near-free registration attracts disposable domains, so these TLDs have a high ratio of abusive to legitimate names and many mail filters already score them. The .zip and .mov TLDs, released by Google in 2023, add a specific trick: a filename in an email body auto-links to a website an attacker registered. The TLD alone should never decide the verdict; combined with a young domain, a lookalike name or a login form it is meaningful.
How to fix it
Weigh this finding with the others rather than acting on it alone. Treat any .zip or .mov link as a website, not a file. When a message from an established company links to one of these TLDs, go to the company's known site instead. Organisations can block TLDs they never do business with at the mail gateway, and should register their own brand under conventional TLDs so customers never learn to expect the unusual ones. Guide: how to spot phishing.
Where this fits
Top-level domain heavily abused for phishing is check 12 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Excessive subdomain depth (low), where the host has an unusually deep chain of subdomains, a pattern used to push the real domain out of sight and to mint an unlimited supply of unique hostnames. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Top-level domain heavily abused for phishing closes one route in. The next one down is URL shortener hides the destination, where the link goes through a URL-shortening service, so the real destination is hidden until you click.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Top-level domain heavily abused for phishing (low severity)
Scanner check id: url-suspicious-tldThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
