League Tables Methodology

All League Tables map Global Signal Exchange (GSE) reported threat signals to various entities within the Internet infrastructure, such as Top-Level Domains (TLDs) Registries, Registrars and Autonomous System Numbers (ASNs).

GSE Data Overview

GSE Signals are distinct pieces of data—including domains, IP addresses, URLs, email addresses, Banking identifiers, phone numbers, among others—that have been observed and reported by a variety of stakeholders. Each signal may or may not be accompanied by a confidence score. Confidence scores range from 0-100% ranging from 0 - low confidence to 100% - the highest confidence.

We currently track signals connected to a number of activities. Signal reports of all activity types are considered in League Table analysis.

The GSE combines observations and also algorithmic and predictive reports from a range of data partners. Predictive reports are based on AI and pattern recognition and are, at present, excluded from the League Table analysis.

Methodology for the TLD League Tables

The TLD League Table evaluates TLD registries based on their associated GSE signals.

Calculation for TLDs

Firstly we calculate the size of each TLD. DomainTools provides totals for the number of domains under each TLD. Because the number of domains under each TLD can fluctuate, we take an average of the number of domains under each TLD over the last 365 days and use this to reflect the size of a TLD. Please note, DomainTools does not give totals for second-level domains, such as co.uk. Instead second-level domains are aggregated and counted under their first-level TLD (for example, all co.uk registrations are counted under .uk).

Excluding predictive signals, we then analyse domain name, hostname and URL signals on the GSE. To ensure that data is relevant to the time period, we only consider those signals that were reported to the GSE within the last 365 days. Given that DomainTools aggregates second-level domains under their first-level TLD, we also only consider the first-level TLDs of reported DNS signals. After deduplicating signals, the total number of uniquely reported domains associated with each TLD is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

We calculate the Report Rate by dividing the total unique reported domains by the average number of domains under that TLD.

TLDs with the lowest Report Rates (the least domain reports relative to their size) are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. TLDs move up or down as their registration numbers change and new reports are received.

TLDs are also sorted into countries and geographical regions using IANA DNS Root Zone data. We map each TLD to the country in which their sponsoring organisation is located. The ‘Region’ radio buttons on the left hand side can be used to rank TLDs within a specific region.

Additionally, the default ‘Tier One’ table will only display and rank larger TLDs with at least half a million domains under management. The ‘All TLDs‘ Table can be selected in order to show how all TLDs compare to each other, regardless of size.

Methodology for the Registrar League Tables

The Registrar League Tables evaluate accredited domain registrars based on the signal activity associated with the domains they manage.

Calculation for Registrars

The number of domains registered with each accredited registrar is calculated by aggregating registrar totals across ICANN Monthly Registry Reports. Given that the ICANN Monthly Registry Reports are withheld until 3 months, we use the most recent totals to estimate the average number of registered domains per registrar over a period of 365 days.

Excluding predictive signals, we then analyse domain name, hostname and URL signals that were reported to the GSE in the last 365 days. WHOIS and RDAP look-ups are carried out on each signal, in order to bring back a registrar ID. After deduplicating signals, the total number of uniquely reported domains associated with each registrar ID is calculated. This means that if the same domain is reported multiple times, it is only counted as one, single, reported domain.

We calculate the Report Rate by dividing the number of unique reported domains by the average number of domains registered with that registrar.

Registrars with the lowest Report Rates are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. Registrars move up or down as their registration numbers change and new reports are received.

Registrars are also sorted into countries and geographical regions using the IANA DNS Root Zone data. We map each registrar to the country in which their administrative contact is located. The ‘Region’ radio buttons on the left hand side can be used to rank registrars within a specific region.

Additionally, the default ‘Tier One’ table will only display and rank larger registrars with at least 50 thousand domains under management. The ‘All Registrars‘ Table can be selected in order to show how all registrars compare to each other, regardless of size.

Please note that only accredited registrars are included in this League Table, due to yearly registration totals being unobtainable for any registrars not reported on by ICANN.

Methodology for the ASN League Tables

The ASN League Tables evaluate ASNs based on the signal activity associated with the IPs they serve.

Calculation for ASNs

The size of an ASN is calculated by summing up the total number of IP addresses allocated to that ASN by its respective RIR.

Due to the fact that the number of IP addresses an ASN controls can change over time, we take the average of this value over a 365 day period.

Excluding predictive signals, we then analyse IP-based signals that were reported to the GSE in the last 365 days. This includes both direct IP address signals and signals which indirectly reference IP addresses, such as domain names, hostnames and URLs where an A record can be looked up and resolved to an IP address. After deduplicating, the total number of uniquely reported IP addresses associated with each ASN is calculated. This means that if the same IP address is reported multiple times, it is only counted as one, single, reported IP address.

We calculate the Report Rate by dividing the number of unique reported IP addresses by the average number of IP addresses controlled by that ASN.

ASNs with the lowest Report Rates are ranked at the top of the League Table, thereby highlighting organisations who attract the fewest threat signals. ASNs move up or down as their number of IPs address blocks change and new reports are received.

ASNs are also sorted into their countries and geographical regions using statistics provided by each RIR. The ‘Region’ radio buttons on the left hand side can be used to rank ASNs within a specific region.

Additionally, the default ‘Tier One’ table will only display and rank larger ASNs that serve at least half a million IP addresses. The ‘All ASNs‘ Table can be selected in order to show how all ASNs compare to each other, regardless of size.

4. Methodology Change Notification

We are committed to an objective and transparent process. In the event of a material change to our methodology, data sourcing, or ranking algorithm, we will provide algorithmic change notifications to the community prior to implementation. Please check this section regularly for any updates to the League Table rules or methodology.