Raw Data

All data used in the registrar report is available for download in My Registrations → Registrar → Reports → .be registrar report → Raw data. All data is bundled in a zip archive. The file names in the zip archive all have the format <quarter>-<topic>-<registrar(group)>.csv. Example: 2021Q3-bounced-emails-retail-and-hosting.csv

• <quarter>: <year>'Q'<quarter-number>. Temporal coverage of the data set. Example 2021Q3.

• <topic>: the variable measured in the dataset.

  • bounced-emails: emails to registrants that bounced

  • create: created domains

  • delete-age: deleted domains per age at deletion time

  • delete: deleted domains

  • infections: infected URLs

  • registrant-verification: selected and approved contacts and domains per day. Only available for registrar, no aggregations for other groups

  • registrants-per-country: number of registrants per country

  • registrations-per-age: number of registrations per age

  • renewal-age: number of renewals per month per age of registration at renewal time

  • revoke: revoked domains (revoke or revoke+)

  • support-cases: support cases

  • total-domains: total number of domains

  • transfer: transferred domains

• <registrar(group)>: who is the topic about, which registrar or registrar group

  • top10: Top 10 registrars. For each row/observation, the top 10 is calculated at the time of that observation.

  • top50: Top 50 registrars. For each row/observation, the top 50 is calculated at the time of that observation.

  • all-registrars: All registrars

  • <registrar-id>: The registrar corresponding to <registrar-id>. You can only access the file with your own registrar ID.

  • <registrar-category>: the RRDG Registrar business model classification where you belong to

All files are in CSV format with the following settings:

• All files are UTF-8 encoded

• Field delimiter: , Unicode Comma (U+002C)

• Quote character: " Unicode Quotation Mark (U+0022). Fields which contain special characters such as field delimiter, quote character or line terminator are quoted.

• Line terminator: \n Unicode New Line (U+000A)

Data types:

• Date format: YYYY-MM-DD

• DateTime format: YYYY-MM-DD hh:mm:ss

• Month format: YYYY-MM

• Numeric: currently, all numeric fields are positive integer values

• Domain names: all domain names are unicode labels (no TLD), unless specified otherwise. The TLD is implicit and equals to .be

In the next sections, we go deeper into the details of the data for the specific topics and registrar groups

Bounced emails

Registrar

The raw data file for your registrar for bounced emails to registrants contains following data:

• DateTime: date and time of the bounce. Example 2020-01-01 01:24:29

• Email: registrant email address that bounced. Example john.doe@gmail.com

• StatusCode: SMTP status code. Example: 5.1.10

• DiagnosticCode: detailed reason of the bounce. Example: smtp; 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup

• BounceType: primary bounce category. Always Permanent. In the future, Transient errors may be shared.

• BounceSubType: secondary bounce category. See list of all bounce subtypes.

Aggregations

Other files for bounced emails contain aggregations for the various registrar groups

• Date: date of the aggregation

• StatusCode: SMTP status code

• Bounces: count of all bounces on given date and for given status code

Created domains

Registrar

The raw data file for your registrar contains following data:

• DateTime: date and time of the new registration. Example: 2020-10-24 08:32:17

• DomainName: domain name as unicode label (without TLD). Example: café

Aggregations

Other files for created domains contain aggregations for the various registrar groups

• Date: date of the aggregation. Example 2020-10-24

• Creates: number of new registrations for that group on the given date

Deleted domains

Registrar

The raw data file for your registrar contains following data:

• Date: date of the deleted registration. We do not provide any details on the deletion time. Domain names are deleted at random times to prevent drop catching.

• DomainName: domain name as unicode label (without TLD). Example: café

Aggregations

Other files for deleted domains contain aggregations for the various registrar groups

• Date: date of the aggregation. Example 2020-10-24

• Deletes: number of deleted registrations for that group on the given date

Deleted domains per age

The raw data file for your registrar is aggregated per month and per age and contains following data:

• Month: the month in which the domains were deleted. Example 2021-01

• Age: the age of the domains at the deletion date in months. Integer number (floor)

• Deletes: number of domains that were deleted in month Month that had age Age at deletion time

Other files for deleted domains contain aggregations for the various registrar groups, and have the same columns

Infected URLs

Registrar

The raw data file for your registrar contains following data:

• DateTime: date and time of the infection. Example 2020-10-01 00:26:04

• Type: MALWARE or PHISHING. Beware that this classification is not always reliable. Some sources do not distinguish between the two types.

• DomainName: domain name as unicode (including TLD)

• URL: URL/location that contained the infection

Aggregations

Other files for infections contain aggregations for the various registrar groups

• Date: date of the aggregation. Example 2020-10-24

• Type: MALWARE or PHISHING

• Infections: number of infections for the given date and type

Registrant Verification

There’s only data for your account. No aggregations for registrar segments. Data is aggregated per day.

• Date: date of the aggregation. Example 2021-01-24

• ContactsSelected: contacts selected for verification on this date

• ContactsApproved: contacts approved on this date

• DomainsSelected: domains selected for verification on this date

• DomainsApproved: domains approved on this date

Note: A contact that is used for multiple new registrations but selected for verification, results in multiple registrations that are selected for verification. On the other hand, if you change the contact of a registration (by transferring that domain) which is pending verification, results in multiple contacts that are pending verification. So both scenario’s (more selected contacts or more selected domains) are plausible.

Note: a contact/domain is possibly approved on another day than the day it was registered/selected. Hence, it is possible that the number of approved contacts/domains is larger thatn the number of selected contacts on a specific date

Registrants per country

• Date: date of the aggregation. Example 2021-01-24

• CountryCode: ISO 3166-1 alpha-2 country code of the registrant. Example: BE

• Count: number of registrants, counted as unique number of registrant email addresses of contacts having:

  • an active registration on date Date

  • country code CountryCode

  • sponsoring registrar that equals to the registrar or in the registrar segment of the data set

When a registrant email address is used in multiple contacts with different country codes, the registrant is counted for all these country coddes.

Only data for last date of quarter is exported because this is the only data required for the report. In the future we can extend that data set for a larger date range.

Registrations per age

• Date: date of the aggregation. Example 2021-01-24

• Months: age of the registrations on date Date

• Count: number of registrations on date Date having:

  • age Age

  • sponsoring registrar that equals to the registrar or in the registrar segment of the data set

Only data for last date of quarter is exported because this is the only data required for the report. In the future we can extend that data set for a larger date range.

Renewal age

• Month: renewal month. Example 2021-01

• Age: age of the registrations at renewal time

• Count: number of registrations that wheen renewed in the month Month had:

  • age Age

  • sponsoring registrar that equals to the registrar or in the registrar segment of the data set

Revoked domains

Registrar

The raw data file for your registrar contains following data:

• DateTime: date and time of the revoke action. Example 2020-10-01 00:26:04

• DomainName: domain name as unicode label (without TLD). Example: café

• RegistrationDateTime: creation date and time of the registration. Example 2020-10-01 00:26:04

• RegistrantCountryCode: ISO 3166-1 alpha-2 country code of the registrant. Example: BE

• Type: Revoke type.

• Source: the detection source of the revoked domain. I.e., who reported the malicious registration.

  • Manual: daily screening by DNS Belgium, further investigation of known cases (whether originally reported by third parties or not).

  • Auto: rules-based query that regularly queries for suspicious domain names. Fake web shop detection crawler (runs intermittently).

  • Abuse List: reported by Netcraft

  • Law Enforcement: reported by CERT, FPS Economy, FPS Finance or law enforcement.

  • Third Party: reported by other security companies or private individuals.

Aggregations

Other files for revoked domains contain aggregations for the various registrar groups

• Date: date of the aggregation. Example 2020-10-24

• Type: Revoke type.

• Source: the detection source of the revoked domain. I.e., who reported the malicious registration. See previous chapter for all possible values.

• Revokes: number of revokes for the given date, type and source

Support cases

Registrar

The raw data file for your registrar contains following data:

• Date: date of the support case. We don’t provide the time for privacy reasons. Example 2020-10-24

• ContactType: how the user contacted us. Phone or Email

• Category: topic of the support case. See Subject

Aggregations

Other files for support cases contain aggregations for the various registrar groups

• Date: date of the aggregation. Example 2020-10-24

• ContactType: how the user contacted us. Phone or Email

• Category: topic of the support case. See Subject

• Cases: number of suupport cases for the given date, contact type and category

Total domains

All files contain aggregations for the registrar and registrar groups

• Date: date of the aggregation. Example 2020-10-24

• Creates: total number of registrations for that group on the given date (at start of day)

Transferred domains

Registrar

The raw data file for your registrar contains all transfer data for a quarter:

• DateTime: date and time of the transfer. Example 2020-10-01 00:26:04

• DomainName: domain name as unicode label (without TLD). Example: café

• LosingRegistrar: the registrar the domain name was transferred from

• GainingRegistrar: the registrar the domain name was transferred to

• Transfer: direction of the transfer out or in. It is sometimes useful to have this column without having to check the LosingRegistrar or GainingRegistrar field.

Aggregations

Other files for transferred domains contain aggregations for the various registrar groups.

• Date: date of the aggregation. Example 2020-10-24

• LosingGroup: registrar group from where the domain names are transferred. Values depend on the registrar group aggregation. Example: for the top 10 registrar group, values are Top 10 and Non-Top 10. For the registrar categories, values can be any RRDG Registrar business model classification value.

• GainingGroup: registrar group to which the domain names are transferred. Values depend on the registrar group aggregation.

• IntraRegistrar: total number of transfers where the winning and the losing registrar are the same. only applies if LosingGroup and GainingGroup are the same

• Transfers: total number of transfers from LosingGroup to GainingGroup

Website Content (starting from Q2 2022)

Registrar

The raw data file for your registrar contains following data:

• Date: crawler

• NoContent: number of domains without website

• LowContent: number of domains where crawler detected error pages, holding pages, under construction pages, …

• HighContent: number of domains where crawler detected content other than low content

Aggregations

Other files for bounced emails contain aggregations for the various registrar groups

• Date: crawler date

• NoContent: number of domains without website

• LowContent: number of domains where crawler detected error pages, holding pages, under construction pages, …

• HighContent: number of domains where crawler detected content other than low content