Most phishing comes from .com (expected due to its size). The report says about .us:
".US is the ccTLD of the United States and had a very large number of its domains used for phishing -- almost 30,000 domains, more than 20,000 of which were registered maliciously by phishers."
Also, it seems doubtful that krebsonsecurity would be appealing to some authority without a good cause.
Ever since the false accusations accident, I've stopped trusting Krebs when he's making statements like these.
.US has a high percentage of phishing domains, but in terms of raw numbers .com, .cn, and .pw are still much bigger than .us. I do wonder about these statistics, though; I don't know where domaintools.com gets their statistics from, but that's the only source for these "total domains registered" number. TLDs like .rest and .live also have much higher phishing percentages.
The assertion that .us is unusually phishy is backed by numbers that don't seem to have a clear, verifiable source. I don't know who Interisle are, but I don't think they run any TLDs, so I wonder where they got their data from. They say they've collected their data from through https://www.cybercrimeinfocenter.org/ but that's hardly an authoritative source of domain statistics.
I used to lookup to him as a huge name in the infosec field until I found out he can be kind of a dick. I still love reading his work, but the vibe changed.