Under Security > Block Top-Level Domains (TLDs), when you click Add a TLD, the list starts with Spamhaus Most Abused TLDs. But the list is out of date.

https://www.spamhaus.org/reputation-statistics/gtlds/domains/

https://www.spamhaus.org/reputation-statistics/cctlds/domains/
