Raw Data[Link]

All data used in the registrar report is available for download in My Registrations → Registrar → Reports → .be registrar report → Raw data. All data is bundled in a zip archive. The file names in the zip archive all have the format <quarter>-<topic>-<registrar(group)>.csv. Example: 2021Q3-bounced-emails-retail-and-hosting.csv

  • <quarter>: <year>'Q'<quarter-number>. Temporal coverage of the data set. Example 2021Q3.

  • <topic>: the variable measured in the dataset.

    • bounced-emails: emails to registrants that bounced

    • create: created domains

    • delete: deleted domains

    • infections: infected URLs

    • revoke: revoked domains (revoke or revoke+)

    • support-cases: support cases

    • total-domains: total number of domains

    • transfer: transferred domains

  • <registrar(group)>: who is the topic about, which registrar or registrar group

    • top10: Top 10 registrars. For each row/observation, the top 10 is calculated at the time of that observation.

    • top50: Top 50 registrars. For each row/observation, the top 50 is calculated at the time of that observation.

    • all-registrars: All registrars

    • <registrar-id>: The registrar corresponding to <registrar-id>. You can only access the file with your own registrar ID.

    • <registrar-category>: the RRDG Registrar business model classification where you belong to

All files are in CSV format with the following settings:

  • All files are UTF-8 encoded

  • Field delimiter: , Unicode Comma (U+002C)

  • Quote character: " Unicode Quotation Mark (U+0022). Fields which contain special characters such as field delimiter, quote character or line terminator are quoted.

  • Line terminator: \n Unicode New Line (U+000A)

Data types:

  • Date format: YYYY-MM-DD

  • DateTime format: YYYY-MM-DD hh:mm:ss

  • Numeric: currently, all numeric fields are positive integer values

  • Domain names: all domain names are unicode labels (no TLD), unless specified otherwise. The TLD is implicit and equals to .be

In the next sections, we go deeper into the details of the data for the specific topics and registrar groups

Bounced emails[Link]

Registrar[Link]

The raw data file for your registrar for bounced emails to registrants contains following data:

  • DateTime: date and time of the bounce. Example 2020-01-01 01:24:29

  • Email: registrant email address that bounced. Example john.doe@gmail.com

  • StatusCode: SMTP status code. Example: 5.1.10

  • DiagnosticCode: detailed reason of the bounce. Example: smtp; 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup

  • BounceType: primary bounce category. Always Permanent. In the future, Transient errors may be shared.

  • BounceSubType: secondary bounce category. See list of all bounce subtypes.

Aggregations[Link]

Other files for bounced emails contain aggregations for the various registrar groups

  • Date: date of the aggregation

  • StatusCode: SMTP status code

  • Bounces: count of all bounces on given date and for given status code

Created domains[Link]

Registrar[Link]

The raw data file for your registrar contains following data:

  • DateTime: date and time of the new registration. Example: 2020-10-24 08:32:17

  • DomainName: domain name as unicode label (without TLD). Example: café

Aggregations[Link]

Other files for created domains contain aggregations for the various registrar groups

  • Date: date of the aggregation. Example 2020-10-24

  • Creates: number of new registrations for that group on the given date

Deleted domains[Link]

Registrar[Link]

The raw data file for your registrar contains following data:

  • Date: date of the deleted registration. We do not provide any details on the deletion time. Domain names are deleted at random times to prevent drop catching.

  • DomainName: domain name as unicode label (without TLD). Example: café

Aggregations[Link]

Other files for deleted domains contain aggregations for the various registrar groups

  • Date: date of the aggregation. Example 2020-10-24

  • Deletes: number of deleted registrations for that group on the given date

Infected URLs[Link]

Registrar[Link]

The raw data file for your registrar contains following data:

  • DateTime: date and time of the infection. Example 2020-10-01 00:26:04

  • Type: MALWARE or PHISHING. Beware that this classification is not always reliable. Some sources do not distinguish between the two types.

  • DomainName: domain name as unicode (including TLD)

  • URL: URL/location that contained the infection

Aggregations[Link]

Other files for infections contain aggregations for the various registrar groups

  • Date: date of the aggregation. Example 2020-10-24

  • Type: MALWARE or PHISHING

  • Infections: number of infections for the given date and type

Revoked domains[Link]

Registrar[Link]

The raw data file for your registrar contains following data:

  • DateTime: date and time of the revoke action. Example 2020-10-01 00:26:04

  • DomainName: domain name as unicode label (without TLD). Example: café

  • RegistrationDateTime: creation date and time of the registration. Example 2020-10-01 00:26:04

  • RegistrantCountryCode: ISO 3166-1 alpha-2 country code of the registrant. Example: BE

  • Type: Revoke type.

  • Source: the detection source of the revoked domain. I.e., who reported the malicious registration.

    • Manual: daily screening by DNS Belgium, further investigation of known cases (whether originally reported by third parties or not).

    • Auto: rules-based query that regularly queries for suspicious domain names. Fake web shop detection crawler (runs intermittently).

    • Abuse List: reported by Netcraft

    • Law Enforcement: reported by CERT, FPS Economy, FPS Finance or law enforcement.

    • Third Party: reported by other security companies or private individuals.

Aggregations[Link]

Other files for revoked domains contain aggregations for the various registrar groups

  • Date: date of the aggregation. Example 2020-10-24

  • Type: Revoke type.

  • Source: the detection source of the revoked domain. I.e., who reported the malicious registration. See previous chapter for all possible values.

  • Revokes: number of revokes for the given date, type and source

Support cases[Link]

Registrar[Link]

The raw data file for your registrar contains following data:

  • Date: date of the support case. We don’t provide the time for privacy reasons. Example 2020-10-24

  • ContactType: how the user contacted us. Phone or Email

  • Category: topic of the support case. See Subject

Aggregations[Link]

Other files for support cases contain aggregations for the various registrar groups

  • Date: date of the aggregation. Example 2020-10-24

  • ContactType: how the user contacted us. Phone or Email

  • Category: topic of the support case. See Subject

  • Cases: number of suupport cases for the given date, contact type and category

Total domains[Link]

All files contain aggregations for the registrar and registrar groups

  • Date: date of the aggregation. Example 2020-10-24

  • Creates: total number of registrations for that group on the given date (at start of day)

Transferred domains[Link]

Registrar[Link]

The raw data file for your registrar contains all transfer data for a quarter:

  • DateTime: date and time of the transfer. Example 2020-10-01 00:26:04

  • DomainName: domain name as unicode label (without TLD). Example: café

  • LosingRegistrar: the registrar the domain name was transferred from

  • GainingRegistrar: the registrar the domain name was transferred to

  • Transfer: direction of the transfer out or in. It is sometimes useful to have this column without having to check the LosingRegistrar or GainingRegistrar field.

Aggregations[Link]

Other files for transferred domains contain aggregations for the various registrar groups.

  • Date: date of the aggregation. Example 2020-10-24

  • LosingGroup: registrar group from where the domain names are transferred. Values depend on the registrar group aggregation. Example: for the top 10 registrar group, values are Top 10 and Non-Top 10. For the registrar categories, values can be any RRDG Registrar business model classification value.

  • GainingGroup: registrar group to which the domain names are transferred. Values depend on the registrar group aggregation.

  • IntraRegistrar: total number of transfers where the winning and the losing registrar are the same. only applies if LosingGroup and GainingGroup are the same

  • Transfers: total number of transfers from LosingGroup to GainingGroup