# Suspicious TLDs - used by url_suspect plugin
# Format: one TLD per line (with or without leading dot)
# Users can override this file in local.d/maps.d/ or use map_add_from_ucl syntax
# to combine with additional TLDs

# Known free/abused TLDs often used in phishing and spam
.tk
.ml
.ga
.cf
.gq
