We Analyzed 15,298 Domains. 38% Carry a High or Critical Risk Rating.
More than a third of the websites ScamInfo.ai has scanned this year are rated high or critical risk. Not "suspicious." Not "worth a second look." High or critical, our platform's top two risk bands, reserved for domains showing multiple confirmed red flags across ownership, infrastructure, and content.
We pulled every domain report generated on our platform between March 13 and July 1, 2026, a total of 15,298 domains, and broke down what separates the dangerous ones from the safe ones. Some of it confirmed what we expected. Some of it didn't.
The headline numbers
Across all 15,298 domains analyzed:
Risk level | Domains | Share |
|---|---|---|
Critical | 4,560 | 29.8% |
High | 1,270 | 8.3% |
Medium | 2,547 | 16.6% |
Low | 6,565 | 42.9% |
Trusted | 356 | 2.3% |
Add critical and high together and you get 38.1% of every domain we checked. Fewer than 1 in 40 domains earned our "trusted" rating.
This isn't a random sample of the internet. It's a mix of domains submitted by users, flagged by our crawlers, and pulled from active scam-pattern monitoring, so it skews toward domains people already had a reason to question. But that's exactly the population worth measuring: these are the sites people are searching, clicking, and wondering about right now.
Finding 1: Your domain extension is a real risk signal
Not all endings are equal. Here's the critical-risk rate by TLD, limited to extensions with at least 30 domains in our dataset:
TLD | Domains analyzed | Critical-risk rate |
|---|---|---|
.shop | 108 | 80.6% |
.top | 37 | 67.6% |
.store | 34 | 61.8% |
.online | 382 | 60.5% |
.site | 44 | 59.1% |
.vip | 43 | 55.8% |
.live | 43 | 53.5% |
.club | 55 | 50.9% |
.xyz | 78 | 50.0% |
.com | 10,283 | 27.2% |
A .shop domain in our dataset was 3 times more likely to be rated critical than a .com domain. Even restricting the comparison to domains that are still live and online today, a .shop site was still 7 times more likely to carry a critical rating than a live .com site.
This isn't a coincidence of naming. These newer, cheaper TLDs are easier to register in bulk, easier to abandon, and carry none of the reputational weight a .com has built up over decades. When we looked at what kind of sites cluster on .vip, .cc, .live, and .club, gambling and adult content operators showed up disproportionately, categories that already skew higher risk on their own (more on that below).
What this means for you: the extension alone isn't proof of anything, but it's a legitimate input into your own judgment. A .shop or .online address checking out at face value deserves more scrutiny than the risk score alone might suggest, especially for anything involving payment.
Finding 2: Trading platforms carry more risk than gambling sites
We expected gambling and betting sites to top the category risk list. They didn't.
Among live, categorized domains, here's how average risk score breaks down for the categories with meaningful sample sizes:
Category | Domains analyzed (live) | Avg. risk score | Critical-risk rate |
|---|---|---|---|
Trading platforms | 87 | 37.4 | 12.6% |
Gambling & betting | 610 | 36.2 | 7.0% |
Cryptocurrency (general) | 44 | 31.2 | 13.6% |
Insurance | 40 | 31.1 | 5.0% |
Cryptocurrency exchanges | 28 | 20.3 | 3.6% |
Adult content | 1,571 | 19.3 | 1.0% |
E-commerce | 1,707 | 16.9 | 0.3% |
Two things stand out. First, trading platforms, the sites promising managed forex or stock trading returns, average a higher risk score than gambling sites, despite gambling's more established reputation as a risky category. Second, general "cryptocurrency" sites (presale pages, informal investment pitches, wallet-adjacent tools) carry nearly 4x the critical-risk rate of dedicated cryptocurrency exchanges. The exchanges, for all their own controversy, are the safer half of the crypto web by this measure.
Adult content is worth a specific callout because it runs against the stereotype: a 1.0% critical rate and one of the lowest average risk scores of any category we measured, lower than e-commerce in several bands. The category people are most likely to assume is dangerous is, in this dataset, one of the least likely to be.
What this means for you: category assumptions can mislead. A site promising trading returns deserves at least as much scrutiny as an online casino, arguably more, since it doesn't carry the same built-in wariness.
What we did
We pulled every domain risk report generated by ScamInfo.ai's platform between March 13, 2026 and July 1, 2026 (15,298 domains total) and analyzed risk score, risk level, live status, category classification, and domain extension across the full set. Risk scores are produced by our automated pipeline, which combines SSL certificate analysis, WHOIS and registrar data, content analysis, and threat intelligence signals into a single 0-100 score.
One methodology note worth being upfront about: domains that are offline at the time of scoring skew heavily toward critical ratings in our data (over 90%), largely because our scoring model treats an unreachable site as a missing-data case and weights that toward higher risk by design, not because we independently confirmed that going offline causes or predicts scam behavior. We're flagging this so the finding above stands on its own without leaning on that number.
A small number of category-level breakdowns exclude domains with fewer than 25-30 samples to avoid drawing conclusions from thin data; those thresholds are noted next to each table.
This dataset reflects domains people had reason to check, not a random crawl of the web, so the 38% figure should be read as "38% of domains worth checking are high-risk," not "38% of the entire internet." We think that's actually the more useful number, since it describes the population people are actually encountering when something feels off.
Check any domain yourself
If a site is giving you pause, run it through our Domain Validator before you enter payment details or personal information. You'll get a full risk breakdown, not just a single score, in under a minute.
We'll be publishing this analysis quarterly as our ongoing Web Risk Index, so we can start tracking whether these patterns hold, worsen, or improve over time.