The DomainTools Report, Spring 2023

This DomainTools report summarizes large-scale analysis of active domains (as of March 2023) to identify where phishing, malware, and spam are most concentrated across features like TLD, IP/Nameserver ASN, geolocation, registrar, and SSL CA, using passive DNS and industry blocklists to compute signal strengths. Key takeaways include persistently risky TLD “neighborhoods,” a significant uptick in phishing on .cyou, and generally weak or neutral associations between most SSL certificate issuers and malware—challenging common assumptions. The report refines methodology (excluding dormant domains) and aims to provide recurring snapshots to track trends in malicious infrastructure.