Introduction to the GSE League Tables

What are the League Tables?

The Global Signal Exchange League Tables are dynamic tables which rank entities involved in the DNS ecosystem (such as TLDs, Registrars, ASNs) based on their relative levels of reported signals.

The main purpose of the League Tables is to inform the wider community of threats using the relative signal rates. The League Tables aim to be unbiased and data driven, please refer to specific methodologies for details on how results have been calculated.

What data are the League Tables Based on?

The League Tables are based on signals that have been reported to the GSE by a variety of feed providers. Although some of the data feeds on the GSE provide us with predictive reports, the League Tables only consider reports that are ‘non predictive’.

Signals enable suspicious content to be shared in order to provide a broader picture of the threat landscape.

For information about 'signals', please see our FAQ page on 'What is a Signal'?

The GSE Top-Level Domain League Tables

The GSE TLD League Tables focus specifically on TLD registries (like .com, .org, or country-code top level domains such as .uk).

The GSE TLD Tables show how many reported GSE threat signals are associated with each TLD compared to its size, estimated by number of domains under management, witch allows for an objective comparison.

The TLD League Tables are organised into two tiers: the Tier One League for TLDs with more than 500K domains under management, and the General League, which includes all TLDs regardless of size. TLD League Tables are also available by region and different rating types explained in the Methodology section.

The GSE Registrar League Tables

The GSE Registrar League Tables focus specifically on the domain registrars—the companies that sell and manage domain name registrations for users.

The GSE Registrar Tables show the rate of reported threat signals associated with each registrar compared to its overall size. This allows for an objective comparison that reveals which registrars have lower or higher levels of signal reports relative to the number of domains they manage.

The Registrar League Tables are organised into two tiers: the Tier One League Table for registrars with an average of more than 50,000 domains under management, and the General League, which includes all registrars regardless of size. Registrar League Tables are also available by region different rating types explained in the Methodology section.

The GSE Autonomous System Number League Tables

The GSE ASN League Tables focus specifically on ASNs. Regional Internet Registries (RIRs) distribute groups of IP addresses to organisations in their geographic area. ASNs are the unique numbers used to identify these organisations. They are responsible for controlling and routing their allocated IP addresses on the internet.

The GSE ASN League Tables show how many reported GSE threat signals are associated with each ASN compared to its size, allowing for an objective comparison that reveals which ASNs have lower or higher levels of signal reports relative to the number of IP addresses they control.

The ASN League Tables are organised into two tiers: the Tier One League for ASNs that control more than 500K IP addresses, and the General League, which includes all ASNs regardless of size. ASN League Tables are also available by region.

Algorithm Updates

The GSE continuously revises all league table algorithms in order to (1) Implement the latest technology (2) Respond to events in real time (3) More accurately reflect the scam and fraud landscape as it evolves.