TLD Reputation Metrics Data

This repository contains per-TLD reputation metrics derived from domain categorization data from Palo Alto Networks. We report the malicious ratio, malicious-to-benign ratio, and non-benign ratio for all TLDs with at least 1,000 domains, beginning from June 2021.

Each TLD is labeled with its generation based on when it was introduced: Legacy (before 2012), First Wave (2012--2015), Second Wave (2016--2020), Third Wave (2021--2025), Fourth Wave (2026--onwards), or ccTLD (country-code TLDs). This generational classification follows ICANN's New gTLD Program, which began in 2012 and represents the most significant expansion of the DNS namespace to date.

Our Research

This data accompanies our study on the impact of the expanding gTLD namespace on the DNS ecosystem. Our analysis shows that newer generations of gTLDs are increasingly used for malicious purposes: first, second, and third wave gTLDs are 2.3, 2.7, and 4.2 times more malicious than legacy gTLDs, respectively. We will continue to update this repository periodically with new data, and continue to monitor how newer gTLDs are being utilized.

Research Papers:

• Not What It Used To Be: Generational Analysis of Top-level Domain Reputation. Janos Szurdi, Reethika Ramesh, Ram Sundara Raman, Daiping Liu. Published at: MADWeb 2026 (Workshop on Measurements, Attacks, and Defenses for the Web, co-located with NDSS 2026). February 27, 2026.
  🏆 Distinguished Paper Award

Cite Our Work

If you use our data for published research, please cite our research paper:

@inproceedings{Szurdi2026TLD,
  title={Not What It Used To Be: Generational Analysis of Top-level Domain Reputation},
  author={Szurdi, Janos and Ramesh, Reethika and Sundara Raman, Ram and Liu, Daiping},
  booktitle={Proceedings of the 2026 Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb)},
  year = {2026},
  organization={Internet Society},
  url = {https://www.ndss-symposium.org/wp-content/uploads/madweb2026-30.pdf}
}

Citing our papers helps us track data usage within the research community and to gauge interest for continued development.

Data Files

• 2021-06-15
• 2022-01-20
• 2022-06-16
• 2023-02-16
• 2023-04-06
• 2024-10-17
• 2025-02-27
• 2025-09-06
• 2025-11-30
• 2026-02-03
• 2026-03-02
• 2026-03-31
• 2026-04-30
• 2026-05-31

Definitions

Metric	Definition
Malicious Ratio	malicious / total
Malicious-to-Benign Ratio	malicious / benign
Non-Benign Ratio	(malicious + low-content) / total