Two thirds of the .online domains in this corpus score in the bottom band. For
.ph it is roughly one in a thousand. Same web, same scoring, same week —
a difference of nearly three orders of magnitude, and most of it comes down to price.
The spread
Group every assessed domain by its ending, keep the endings with at least a thousand of them, and the share scoring in the bottom band runs from under one percent to over three quarters. That is not a subtle effect. The current table is on the statistics page and it moves slowly.
.com sits in the middle, which is what you would expect from the ending everyone
uses for everything. The extremes are where the story is.
Why the cheap endings are worse
Three mechanisms, and they compound.
Price sets the ceiling on disposability. A scam needs a domain it can abandon. At a euro or two, abandoning it costs nothing; at thirty, the arithmetic changes. Registries that launch with aggressive promotional pricing get exactly the customers that pricing selects for.
Nobody is checking. Some registries require a local presence, a tax number or a registered company. Others require a working card. The first group is not being virtuous — it is being administratively awkward, and awkwardness is a filter.
Reputation is self-reinforcing. Once an ending is known for abuse, legitimate businesses avoid it, which raises the abusive share, which deepens the reputation. Filters start scoring it down wholesale, and the only registrants left are the ones who do not care about deliverability.
What this does not mean
It does not mean a domain on a risky ending is a scam. Two thirds is a majority, not a certainty, and the remaining third are ordinary sites whose owners liked the name. Judging an individual by the base rate of its ending is exactly the error this site tries to avoid — which is why the ending is one input among many rather than a verdict.
It does mean that if you are choosing an ending for your own project, you are choosing a neighbourhood as well as a name. The saving is real and so is the cost.
The registry-level view
The uncomfortable conclusion is that abuse concentration is a policy outcome, not an accident. Registries that verify registrants have dramatically lower abuse rates. This is not a hard problem technically — it is a decision about whether growth is worth what it attracts.
The numbers are public, they are consistent year to year, and they are visible to anyone who looks. Publishing them is about the only pressure available from outside.