Every month, SpamHaus releases a list of the most abused TLDs. It then calculates an index, based on the percentage of abusive domains in a given TLD, ccTLD or gTLD.
In other words, it’s not the absolute number of “bad domains” but the ratio that determines how bad a TLD is.
How does SpamHaus calculate that?
The abusive behavior of domain TLDs is measured as the ratio of abusive domains that exist in a given TLD, to its total number of active domains.
That ratio doesn’t reflect the total number of bad domains in a given TLD, but the percentage of its bad actors to the full number of domains encountered. This allows for proper scaling for smaller or larger TLDs.
For March 2019, SpamHaus crowned dot .Loan the #1 most abused TLD; it’s followed by dot .Work and dot .Click.
Here’s the full Top Ten list for March 2019:
For more information about the list and the methodology, visit SpamHaus.org.