diff --git a/components/toolbar/toolbar.tsx b/components/toolbar/toolbar.tsx
index 24bb3f9..123a9d9 100644
--- a/components/toolbar/toolbar.tsx
+++ b/components/toolbar/toolbar.tsx
@@ -14,6 +14,15 @@ async function getCurrentTab() {
 import './../../styles/global.scss';
 import './toolbar.scss';
 
+function isDomainHighlySuspicious(domain: string): boolean {
+    return (
+        domain.includes('facebook') ||
+        domain.includes('twitter') ||
+        domain.includes('linkedin') ||
+        false
+    );
+}
+
 const Toolbar = () => {
     const [origin, setOrigin] = React.useState<string | null>(null);
     const [eventCounts] = useEmitter(getMemory());
@@ -53,6 +62,13 @@ const Toolbar = () => {
         if (!origin) return;
         const exposedOriginDomains = Object.values(getMemory().getClustersForOrigin(origin))
             .filter((cluster) => cluster.exposesOrigin())
+            .sort((cluster1, cluster2) =>
+                isDomainHighlySuspicious(cluster1.id)
+                    ? -1
+                    : isDomainHighlySuspicious(cluster2.id)
+                    ? 1
+                    : 0
+            )
             .map((cluster) => cluster.id);
         setExposedOriginDomainCopy('');
 
@@ -86,6 +102,13 @@ const Toolbar = () => {
         if (!origin) return;
         const cookieDomains = Object.values(getMemory().getClustersForOrigin(origin))
             .filter((cluster) => cluster.hasCookies())
+            .sort((cluster1, cluster2) =>
+                isDomainHighlySuspicious(cluster1.id)
+                    ? -1
+                    : isDomainHighlySuspicious(cluster2.id)
+                    ? 1
+                    : 0
+            )
             .map((cluster) => cluster.id);
         setCookieDomainCopy('');