League Tables Methodology

All League Tables map Global Signal Exchange (GSE) reported threat signals to various entities within the Internet infrastructure, such as Top-Level Domain (TLD) Registries and Registrars.

GSE Data Overview

GSE Signals are distinct pieces of data—including domains, IP addresses, URLs, email addresses, IBAN numbers, phone numbers, among others—that have been observed and reported by a variety of stakeholders. Each signal may or may not be accompanied by a confidence score. Confidence scores range from 0-100% ranging from 0 - low confidence to 100% - the highest confidence.

We currently track signals connected to a number of activities. Signal reports of all activity types are considered in League Table analysis.

The GSE combines observations and also algorithmic and predictive reports from a range of data partners. Predictive reports are based on AI and pattern recognition and are, at present, excluded from the League Table analysis.

Methodology for the TLD League Tables

The TLD League Table evaluates TLD registries based on their associated GSE signals.

Calculation for TLDs

First, we calculate the size of each TLD. DomainTools provides totals for the number of domains under each TLD. Because the number of domains under each TLD can fluctuate, we take an average of the number of domains under each TLD over the last 365 days and use this to reflect the size of a TLD. Please note, DomainTools does not give totals for second-level domains, such as co.uk. Instead second-level domains are aggregated and counted under their first-level TLD (for example, all co.uk registrations are counted under .uk).

Excluding predictive signals, we then analyse hostname, url and domain name signals on the GSE. To ensure that data is relevant to the time period, we only consider those signals that were both received within the last 365 days and that relate to threats occurring in that same period. Given that DomainTool’s aggregates second-level domains under their first-level TLD, we also only consider the first-level TLDs of reported DNS signals. After deduplicating signals, the total number of uniquely reported domains associated with each TLD is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

We calculate the Report Rate by dividing the total unique reported domains by the average number of domains under that TLD.

TLDs with the lowest Report Rates (the least domain reports relative to their size) are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. TLDs move up or down as their registration numbers change and new reports are received.

TLDs are sorted into countries and geographical regions using IANA DNS Root Zone data. We map each TLD to the country in which their sponsoring organisation is located.

TLDs can be ranked based on size. By selecting the 'Show >500k' checkbox, the table will display larger TLDs with at least half a million domains under management. Likewise, TLDs can be viewed by country and region.

Methodology for the Registrar League Tables

The Registrar League Tables evaluate domain registrars based on the signal activity associated with the domains they manage.

Calculation for Registrars

The number of domains registered with each accredited registrar is calculated by aggregating registrar totals across ICANN Monthly Registry Reports. Given that the ICANN Monthly Registry Reports are withheld until 3 months, we use the most recent totals to estimate the average number of registered domains per registrar over a period of 365 days.

Excluding predictive signals, we then analyse hostname, url and domain name signals on the GSE, considering only those received within the last 365 days and relating to threats that occurred in that same period. WHOIS and RDAP look-ups are carried out on each signal, in order to bring back a registrar ID, where available. Where no registrar ID is provided but a registrar name was obtained, we attempt to match the registrar to its corresponding ID, using the IANA Registrar IDs list. Due to the lack of consistency in registrar names acquired, the matching of IDs is a best effort and something that we aim to improve as we evolve our algorithm. After deduplicating signals, the total number of uniquely reported domains associated with each registrar ID is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

We calculate the Report Rate by dividing the number of unique reported domains by the average number of domains registered with that registrar.

Registrars with the lowest Report Rates are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. Registrars move up or down as their registration numbers change and new reports are received.

Registrars are sorted into countries and geographical regions using the IANA DNS Root Zone data. We map each registrar to the country in which their administrative contact is located.

Registrars can be ranked based on size. By selecting the 'Show >50k' checkbox, the table will display larger registrars with at least 50 thousand domains under management. Likewise, registrars can be viewed by country and region.

Please note that only accredited registrars are included in this League Table, due to yearly registration totals being unobtainable for any registrars not reported on by ICANN.

4. Methodology Change Notification

We are committed to an objective and transparent process. In the event of a material change to our methodology, data sourcing, or ranking algorithm, we will provide algorithmic change notifications to the community prior to implementation. Please check this section regularly for any updates to the League Table rules or methodology.