A study published by enterprise security company Blue Coat this week highlighted the dangers of the explosion in domains, saying some of them could trick users to download malware or lead to other undesirable outcomes. The research shows the Top-Level Domains (TLDs), or "neighborhoods," most associated with suspicious websites. Among the key findings in the report are that more than 95 percent of websites in 10 different TLDs are rated as suspicious, with that percentage increasing to 100 percent for the top two highest ranking TLDs, .zip and .review.

Blue Coat counted a domain as "shady" if it was rated in its database with a category such as Spam, Malware, Scam, Botnet and Phishing.

Much has changed since the early days of the Internet when the Web had only six common top level domains (TLDs). Back then, what most consumers and businesses encountered were a small number of standard TLDs, such as .com, .net, .edu and .gov, as well as some "country code" domains like .fr (France), and .jp (Japan). However, since 2013, the number of new TLDs has skyrocketed. There has been an explosion of new neighborhoods on the Web, many of which may be considered for web security purposes as neither safe nor friendly. By June 2015, the count of validly issued TLDs stood at over one thousand. As the number of TLDs has increased, so have the opportunities for attackers. These TLDs, with high numbers of shady sites dubbed "Shady TLDs" can provide fertile ground for malicious activity including spam, phishing, and distribution of Potentially Unwanted Software (PUS).

Most Common Malicious Activity                          Less Common Malicious Activity

Spam                                                                          Malware

Scam                                                                          Botnet

Suspicious                                                                   Phishing

Potentially Unwanted Software (PUS)

The report also reveals examples of nefarious activity taking place on shady websites of some of the top ranked Shady TLDs, including the fourth most seemingly dangerous neighborhood, .kim. Blue Coat researchers recently discovered websites serving up pages which mimic popular video and image sites and prompt unprotected visitors to unwittingly download malware.

As organizations and consumers look to safeguard themselves against these shady TLDs, they can draw key lessons from the report to inform and strengthen their security posture, including:

Businesses should consider blocking traffic that leads to the riskiest TLDs. For example, Blue Coat has previously recommended that businesses consider blocking traffic to .work, .gq, .science, .kim and .country.

Users should use caution to click on any links that contain these TLDs if they encounter them in search results, e-mail, or social network environments.

If unsure of the source, hover the mouse over a link to help verify that it leads to the address displayed in the text of the link.

"Press and Hold" links on a mobile device (not just click) to verify it leads where it says it does.