League Tables Methodology

All League Tables map Global Signal Exchange (GSE) reported threat signals to various entities within the Internet infrastructure, such as Top-Level Domains (TLDs), Registrars and Autonomous System Numbers (ASNs).

League Table metrics and totals are now re-calculated daily to give more accurate and real-time insights.

GSE Data Overview

GSE Signals are distinct pieces of data—including domains, IP addresses,

URLs, email addresses, Banking identifiers, phone numbers, among others—that have been observed and reported by a variety of stakeholders.

We currently track signals connected to a number of activities. Signal reports of all activity types are considered in League Table analysis.

The GSE combines observations and also algorithmic and predictive reports from a range of data partners. Predictive reports are based on AI and pattern recognition and are, at present, excluded from the League Table analysis.

Methodology for the TLD League Tables

The TLD League Table evaluates TLD registries based on their associated GSE signals.

First, we calculate the size of each TLD. DomainTools provides totals for the number of domains under each TLD. Because the number of domains under each TLD can fluctuate, we take an average of the number of domains under each TLD over the last 365 days and use this to reflect the size of a TLD. Please note, DomainTools does not give totals for second-level domains, such as co.uk. Instead second-level domains are aggregated and counted under their first-level TLD (for example, all co.uk registrations are counted under .uk).

Excluding predictive signals, we then analyse domain name, hostname and URL signals on the GSE. To ensure that data is relevant to the time period, we only consider those signals that were reported in the last 365 days. Given that DomainTools aggregates second-level domains under their first-level TLD, we also only consider the first-level TLDs of reported DNS signals. After deduplicating signals, the total number of uniquely reported domains associated with each TLD is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

We also review ‘dismantle’ feedback reports on the GSE. A domain is considered dismantled if it has been put on client hold or server hold. We count the number of unique domains that have been dismantled in the last 365 days.

From these metrics, we calculate 3 different ratings for each TLD:

1. Report Rate = (number of unique reported domains / average number of domains under management) * 100
2. Dismantle Rate = (unique dismantled domains / number of unique reported domains) * 100
3. Weighted Report Rate = ((number of unique reported domains - unique dismantled domains) / average number of domains under management) * 100

These rate types can be toggled between in the settings panel on the left hand side of the League Table. TLDs with the lowest report rates are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. When looking at dismantle rates, those with the highest dismantle rates are ranked at the top, highlighting TLDs who take the most action on domains under their management. TLDs move up or down the table as registration numbers change or new signals and dismantle feedback reports are received on the GSE.

TLDs are also sorted into countries and geographical regions. Using the data provided in RDAP lookups, we map each TLD to the country in which their sponsoring organisation is located. The ‘Region’ radio buttons in the settings panel can be used to re-rank TLDs within a specific region.

Additionally, the default ‘Tier One’ table only displays and ranks larger TLDs with at least half a million domains under management. The ‘All TLDs’ Table can be selected in order to show how all TLDs compare to each other, regardless of size.

Methodology for the Registrar League Tables

The Registrar League Tables evaluate accredited domain registrars based on the signal activity associated with the domains they manage.

The number of domains registered with each accredited registrar is calculated by aggregating registrar totals across ICANN Monthly Registry Reports. ICANN does not provide counts for ccTLDs so registrar sizes are calculated using totals from gTLD Reports only. Additionally, the ICANN Monthly Registry Reports are withheld until the end of 3 months, so we use the most recent totals to estimate the average number of domains registered per registrar over a period of 365 days.

Excluding predictive signals, we then analyse domain name, hostname and URL signals that were reported in the last 365 days. WHOIS and RDAP look-ups are carried out on each signal, in order to bring back a registrar ID. After deduplicating signals, the total number of uniquely reported domains associated with each registrar ID is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

We also review ‘dismantle’ feedback reports on the GSE. A domain is considered dismantled if it has been put on client hold or server hold. We count the number of unique domains that have been dismantled in the last 365 days.

From these metrics, we calculate 3 different ratings for each registrar:

1. Report Rate = (number of unique reported domains / average number of domains registered) * 100
2. Dismantle Rate = (unique dismantled domains / number of unique reported domains) * 100
3. Weighted Report Rate = ((number of unique reported domains - unique dismantled domains) / average number of domains registered) * 100

These rate types can be toggled between in the settings panel on the left hand side of the League Table. Registrars with the lowest report rates are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. When looking at dismantle rates, those with the highest dismantle rates are ranked at the top, highlighting registrars who take the most action on domains under their management. Registrars move up or down the table as registration numbers change or new signals and dismantle feedback reports are received on the GSE.

Registrars are also sorted into countries and geographical regions using the ICANN’s list of Accredited Registrars. The ‘Region’ radio buttons on the left hand side can be used to rank registrars within a specific region.

Additionally, the default ‘Tier One’ table will only display and rank larger registrars with at least 50 thousand domains under management. The ‘All Registrars‘ Table can be selected in order to show how all registrars compare to each other, regardless of size.

Please note that only accredited registrars are included in this League Table, due to yearly registration totals being unobtainable for any registrars not reported on by ICANN.

Methodology for the ASN League Tables

The ASN League Tables evaluate ASNs based on the signal activity associated with the IPs they serve.

The size of an ASN is calculated by summing up the total number of IPv4 addresses allocated to that ASN by its respective RIR. Due to the fact that the number of IP addresses an ASN controls can change over time, we take the average of this value over a 365 day period.

Excluding predictive signals, we then analyse IP-based signals that were reported to the GSE in the last 365 days. This includes both direct IP address signals and signals which indirectly reference IP addresses, such as domain names, hostnames and URLs where an A record can be looked up and resolved to an IP address. After deduplicating, the total number of uniquely reported IPv4 addresses associated with each ASN is calculated. This means that if the same IP address is reported multiple times, it is only counted as one, single, reported IP address.

We calculate the Report Rate by dividing the number of unique reported IPv4 addresses by the average number of IPv4 addresses controlled by that ASN.

ASNs with the lowest Report Rates are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. ASNs move up or down as their number of IP address blocks change and new reports are received.

ASNs are also sorted into countries and geographical regions using statistics provided by BGPKIT. The ‘Region’ radio buttons on the left hand side can be used to rank ASNs within a specific region.

Additionally, the default ‘Tier One’ table will only display and rank larger ASNs that serve at least half a million IPv4 addresses. The ‘All ASNs‘ Table can be selected in order to show how all ASNs compare to each other, regardless of size.

4. Methodology Change Notification

We are committed to an objective and transparent process. In the event of a material change to our methodology, data sourcing, or ranking algorithm, we will provide algorithmic change notifications to the community prior to implementation. Please check this section regularly for any updates to the League Table rules or methodology.