Methodology for the TLD League Tables

The TLD League Tables evaluate TLD registries based on their associated abuse activity.

Calculation

    1. Timeframe: We consider domain-based threat signals— excluding predictive signals —received by the GSE also within the last 90 days.
    1. Unique Reports: We de-duplicate all signals, meaning if multiple signals point to the same domain, we count that domain as potentially abusive only once. We then calculate the total number of uniquely reported domains associated with each TLD.
    1. TLD Size: We determine the average number of domains under each TLD over the last 90 days.
    1. Report Rate: We calculate the Report Rate by dividing the total unique reported domains by the average number of domains under that TLD.
    1. Ranking: TLDs with the lowest Report Rates (the least domain reports relative to their size) rank higher in the League Table, thereby highlighting organisations who attract the fewest threat signals. TLDs move up or down as their registration numbers change and new reports are received.

League Tiers & Grouping

  • Tier One League Table: This tier includes only those TLDs that have an average of more than 500,000 domains under management.
  • General League Table: This tier includes all TLDs regardless of size
  • Regional Grouping: To provide global insights, we use the IANA DNS Root Zone data to map each TLD to the country where its sponsoring organization is located. Based on that data, we also group them by region and subregion.
PrevNext