Cybercriminals exploit country code top-level domains (ccTLDs) to host phishing attacks, distribute malware, and commit fraud. These ccTLDs, assigned to specific countries, often attract malicious activity due to weak oversight