Top Level Domain (TLD) League Table

TLD League Table

The Top Level Domain Name (TLD) league table ranks TLD providers with the lowest report rates, and those who are actively mitigating fraudulent domains.

The TLD League table is based on signals received via the Global Signal Exchange from our providers over the last 30 days. This allows league tables to rapidly reflect changes implemented by entities, allowing those who are actively working to reduce their levels of digital abuse to see their efforts take effect as they climb the League Tables.

How is the TLD League Table ranked?

League Table data is based on all GSE feeds including paid for feeds, with the exception of predictive feeds. Examples of providers of signals include JustGuard, Cyber Defence Alliance, CERT.PL, NZ Phishing Feed, Abusix, Zetalytics, MPA, Google Shopping, Seraph Secure, URL Abuse, URLHaus, ZeroFox, SpamHaus, APWG and Scamadvisor. This list will grow over time as more entities contribute to GSE feeds.

Types of abuse that are reported include phishing, scams, spam, cloaking, malware, copyright, impersonation, exploit and unspecified. Domain names are parsed out of the signals, and then the total number of uniquely reported domains associated with each TLD is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

The average number of domains under each TLD is also calculated. For each TLD, their number of domains under management, as provided by DomainTools, is averaged over the last 30 days in order to match the time window for reports.

From these metrics, a report rate for each TLD is calculated by dividing the number of unique reported domains by the average number of domains under that TLD. By making report rates relative to a TLDs size, this allows for more fair comparison between differently sized TLDs, reducing bias due to sheer volume of domains. We use the report rate of a TLD to evaluate its position in the League Table, relative to others. Those with the lowest report rates have the least domain reports relative to their size and so are higher up the League Table. TLDs move up and down the League Table over time as the landscape changes and more domain based reports are received by the GSE. The report rates for each TLD are tracked over time.

In the TLD Tier One League Table, we only consider those TLDs with an average number of domains greater than 500,000. In the Global Regions Table TLDs are sorted into geographical regions, using the IANA DNS Root Zone data to map TLDs to the country in which their sponsoring organisation is located.

What does it mean to be top of the TLD League Table?

The TLD League Table rewards entities that are actively mitigating fraudulent domains, particularly within an impactful period of time, ideally, 24 hours. Entities that are mitigating fraudulent domains less than 24 hours after the domain was first reported are rewarded, and should move up the League Tables. Any mitigations carries out after the 24 hour period are not counted due to the large amount of harm that can be caused to users if malicious domains are left to route for any longer than this.