From .com to .beauty: The evolving threat landscape of unwanted email

Cloudflare’s analysis of email telemetry shows that while com and net dominate malicious and spam volume, newer gTLDs (such as uno, sbs, beauty, shop, bar, makeup, cyou) carry disproportionately high rates of unwanted and malicious/phishing emails; notable patterns include gov spoofing detectable by SPF/DKIM/DMARC failures, declining abuse of Freenom ccTLDs after legal actions, and new high‑risk entrants in Jan 2024 (ws, id, cc). Malicious activity spiked around late‑year holidays and seasonal events, and prevalent threat categories included links, extortion, identity deception, credential harvesting, and brand impersonation—underscoring the need for vigilant email security and domain/TLD-aware defenses.