Mapping the Mal Web

March 12, 2007

Introduction

Online safety risks are a truly global issue. Yet differences in threats vary significantly by country and other factors, for example:

  • A consumer is almost 12 times more likely to encounter a drive-by-download while surfing Russian domains as Columbian ones.
  • Registering at a Web site in India results in a 4.3% chance of getting spammy e-mail. Taking the same action with a domain registered in China yields a 7.2% chance.
  • 5.2% of Vietnamese Web sites have risky downloads. Just 0.5% of Singaporean sites host such files.
  • 2.7 million times every month, casual Web surfers visit risky Dutch Web sites. Even though Hong Kong has approximately the same percentage of risky Web sites, those risky domains receive just 52,000 clicks each month.

Geographic differences give rise to important big-picture questions. For example, what level of online risk is involved as an ever greater percentage of the world's population moves online and users seek out Web sites in their native languages? Are there relatively safer or riskier country domains? Should online consumers factor in this information when searching and surfing? Can the malicious Web be mapped in a way that is interesting and useful?

McAfee can help answer these questions thanks to data from SiteAdvisor. SiteAdvisor tests web sites to keep consumers safe from spyware, spam, viruses and scams. SiteAdvisor is a free download for use with Internet Explorer and Firefox.


Methodology

We compare the ratings of sites found in each of 265 country (example: .br for Brazil) and generic (example: .com) top-level domains (TLDs) and then rank these domains by risk.

Our site safety assessments come from McAfee SiteAdvisor's Web safety database of 8.1 million of the most trafficked Web sites and account for more than 95% of Web traffic. These sites have been tested for a wide variety of unwanted behaviors.

  • Web sites are tested for excessive pop-ups, other fraudulent practices, and browser exploits. Browser exploits, also known as drive-by-downloads, enable viruses or spyware to install on a consumer's computer without their consent and often without their knowledge.

  • Downloads are analyzed by installing software on our test computers and checking for viruses and any bundled adware, spyware or other unwanted programs.

  • Sign-up forms are completed using a one-time use e-mail address so the volume and "spamminess" of any subsequent e-mail can be tracked. Spamminess refers to the commercial content of e-mail, as well as the use of tactics to trick spam filter software.

  • Feedback from individual users and site owners, plus analysis by SiteAdvisor staff enhance SiteAdvisor's automated testing.

Red ratings are given to Web sites that fail one or more of these tests. Yellow ratings are given to sites that merit caution before using.

McAfee SiteAdvisor Rating Sources

Our analysis measures risk in four ways:

  • Percent of red and yellow rated sites

  • Percent of red and yellow rated sites, of those with tested downloads

  • Percent of red and yellow rated sites, of those with tested e-mail practices

  • Percent of sites in that domain rated red for exploits

The rankings are restricted to 71 top level domains, each containing at least 2,000 sites tested by SiteAdvisor.

Key Findings

4.1% of all sites tested by SiteAdvisor are rated red or yellow. But the incidence of red and yellow sites varies dramatically across top-level domains, ranging from a low of 0.1% for Finland (.fi) to a high of 10.1% for the tiny island of Tokelau (.tk). We find that Tokelauan domains, discussed later, offer some advantages to scammers.

  • The most risky large countries are Romania (.ro, 5.6% risky sites) and Russia (.ru, 4.5% risky sites). These country TLDs are also the most likely to host exploit sites.

  • .info is the riskiest generic TLD, with 7.5% of its sites rated as risky. .com is the second most risky generic TLD, with 5.5% of sites rated as risky.

  • Four of the five least risky country TLDs are Nordic countries - Finland (0.10%), Norway (.no, 0.16%), Sweden (.se, 0.21%) and Iceland (.is, 0.19%). Ireland (.ie, 0.11%) rounds out the top five least risky country TLDs.

  • .gov is the only frequently tested TLD for which SiteAdvisor has found no risky sites. .gov is only available to United States government agencies.

  • Even though the .com TLD is only the 5th most risky TLD by rank, its huge popularity magnifies its impact on search and browsing risk dramatically. 86.6% of clicks to red and yellow rated sites go to .com sites.

  • Even though the Netherlands (.nl), Germany (.de) and the United Kingdom (.uk) are all relatively safe TLDs, ranking 31st, 33rd and 51st most risky, each of their TLDs account for more than 2 million clicks to red and yellow sites every month. Likewise Japan (.jp) is ranked 57th most risky and yet red and yellow rated .jp sites receive an estimated 1.6 million clicks each month.

Click image for interactive map

Data Breakouts
Asia / Pacific TLDs
  • China (.cn) and South Korea (.kr) are the riskiest major country domains in the Asia/Pacific region, with 3.7% and 2.6% of their sites rated as risky, respectively. Japan and Australia (.au) are overwhelmingly less risky, with just 0.4% and 0.2% risky sites, respectively.

jpg

Figure: Asia Pacific TLDs ranked by overall percentage of red and yellow sites

Complete Asia / Pacific Results

Europe and the Middle East TLDs
  • Romania and Russia are the most risky domains in the Europe/Middle East region, with 5.6% and 4.5% risky results, respectively. By contrast, Germany, the region's domain with the most tested sites, has just over 1% risky sites.

jpg

Figure: Europe and the Middle East TLDs ranked by overall percentage of red and yellow sites

Complete Europe and the Middle East Results

The Americas TLDs

  • Latin American and South American countries are somewhat safer than countries in other regions. According to a recent study Internet penetration rates in Latin and South American countries are modest. 19.8% of Argentineans, 18.6% of Mexicans and 11.3% of Brazilians are online. By comparison, 70.5% of South Koreans and 63.6% of Americans are online. In general, we find that economically motivated scammers seek out the largest Web audiences in order to maximize profit potential. This may account for the lower incidence to date of red and yellow sites in these TLDs.

  • At 2.1% red and yellow, the United States (.us) is the riskiest TLD in the Americas, while Venezuela (.ve) is the riskiest TLD in Latin and South America, with 1.5% of sites rated as risky. Brazil (.br), Mexico (.mx) and Argentina (.ar) are all relatively safe domains, each with just under one percent risky sites.

jpg

Figure: Americas TLDs ranked by overall percentage of red and yellow sites

Complete Americas Results

Generic TLDs
  • .info is the riskiest generic TLD, with 7.5% of its sites rated as risky. .com, by far the largest TLD by number of registered sites, as well as the TLD with the greatest number of sites tested by SiteAdvisor, is the second most risky generic TLD, with 5.5% of sites rated as risky.

  • .gov is the only frequently tested TLD for which SiteAdvisor has found no risky sites. .edu is also quite safe, with just 0.3% of sites rated risky. We believe that the reason for this relative and absolute safety is because those applying for .gov and .edu domains must provide credentials and are significantly less likely to engage in risky or unethical Web practices.

jpg

Figure: Generic TLDs ranked by overall percentage of red and yellow sites

Complete Generic Results

Relative "facet" risk for downloads, e-mail registrations and exploits
  • Downloads Of those sites with tested downloads, Somoa (.ws), .biz and Bulgaria (.bg) are the most risky. 14.0%, 11.4% and 9.9%, respectively, contain risky downloads. In other words, a consumer that chooses to randomly download from one of these top level domains has at least a 1 in 10 chance of downloading from a risky site.

  • jpg

    Figure: Top 20 TLDs ranked by percentage of sites with red and yellow download ratings

    Complete Download Results

     
  • E-Mail A stunning 73.2% of the more than 6,000 .info sites that we have tested for e-mail practices are rated risky, meaning that SiteAdvisor registrations at these sites resulted in the receipt of high volume e-mail, spammy e-mail or both. Russia and South Korea trail the .info TLD with 21.7% and 19.6% respectively. While less risky than registering at a .info domain, consumers who provide their e-mail addresses to randomly chosen Korean or Russian domains have a 1 in 5 chance of receiving high volume e-mail, highly commercial e-mail or both.

  • jpg

    Figure: Top 20 TLDs ranked by percentage of sites with red and yellow e-mail practices ratings

    Complete E-mail Results

     
  • Exploits A casual Web surfer is more than five times as likely to encounter an exploit site while browsing a .nu or .ru site than he is while surfing the .com TLD. In fact, the tiny island of Niue and the massive Russia vie for the domain most frequently used to launch an exploit or drive-by-download type attack. While rare - just 0.45% and 0.43% of sites tested, respectively - exploits are arguably one of the most dangerous kinds of threats which Internet users face today because successful exploits can lead to permanent computer failure and identity theft.

  • jpg

    Figure: Top 20 TLDs ranked by percentage of sites with exploits

    Complete Exploit Results

The Safest TLDs
  • Four of the five least risky country TLDs are Nordic countries: Finland (0.10%), Norway (0.16%), Sweden (0.21%) and Iceland (0.19%).Ireland (0.11%) rounds out the top five least risky country TLDs. This could be due to governing bodies employing stricter regulations of these domains. Registrations in Norway are limited to companies registered with the government. Prior to 2003, Finland and Sweden had similar requirements.

  • .gov is the only frequently tested TLD for which SiteAdvisor has found no risky sites. .edu is also quite safe, with just 0.3% of sites rated risky. Strict registration requirements limit the kind of registrants who can operate sites with these domains to those who are least likely to be scammers.

The Most Pervasively Risky TLDs
  • Seven TLDs (.com, .info, .net, .biz, Tuvalu (.tv), Cocos Islands (.cc), and China (.cn)) earn the dubious distinction of ranking in the top 20 riskiest for each of the four risky facets we examined.

  • Of these seven domains, .biz and .info are the overall worst domains with highly risky rankings in each of the four categories:

  • .info ranks 2nd (overall risk), 1st (e-mail practices), 10th (download risk) and 12th (exploit risk)

  • .biz ranks 6th (overall risk), 6th (e-mail practices), 2nd (download risk) and 5th (exploit risk)

  • jpg

    Figure: 7 TLDs that rank in Top 20 for each of 4 tests

  • Again, low cost appears to be at least one factor in drawing scammers to the .info TLD.

Spammers flock to .info, which was created as an alternative to the crowded .com, because its domain names are cheaper - registrars often let people use them gratis for the first year - which is helpful for those, like sploggers, who buy Internet addresses in bulk. Splogs so commonly have .info addresses that many experts simply assume all blogs from that domain are fake.

  • Others note that ".info is the first and only top-level domain that was explicitly created and chartered for unrestricted use, though various other TLDs have ended up that way as a de facto situation."

  • .biz is said to be the most popular TLD for spammers because the name servers update immediately, meaning spammers can start using the domain as soon as they register, rather than wait up to 24 hours for the registration to take effect. This is particularly attractive due to the transient nature of spam and phishing Web sites.

Complete Pervasively Risky Results

Additional Analysis
Risky Clicks by TLD

Relative risk can be measured in many ways. The rankings presented thus far are not weighted to reflect the popularity of different TLDs. For example, .tv may have a higher percent of risky sites than .com, but .com's massive presence surely means that its TLD is responsible for many more risky Web interactions.

We can factor in the weight of a TLD through a series of approximations to arrive at a different ranking of relative risk. How many clicks are made to risky Web sites within a given TLD? It's hard to calculate global figures, but we can make some estimates based on US traffic patterns. US Internet users conduct approximately 5.7 billion searches per month. According to one reputable source, the average search results in 2.3 clicks per search. Multiplied by the percent of red and yellow sites within the TLD and weighted by the traffic received by that TLD, we can calculate an approximate number of risky clicks per TLD. For this ranking, we use the following formula:

5.7 billion searches/month * 2.3 clicks/search * TLD's % red + yellow * TLD's % traffic

Note that the TLDs' weighted traffic is based on analysis of the traffic patterns of the millions of SiteAdvisor users worldwide. While this user base is large enough to be representative, it does have some non-representative characteristics. For example, the SiteAdvisor safe search tool is particularly popular in the Netherlands which positively skews the number of red and yellow clicks attributed to searching Dutch domains.

Of an estimated 555 million risky clicks made each month via search engine results, the vast majority, 86.6% go to .com sites. Even though the .com TLD is only the 5th most risky TLD by rank, its huge popularity magnifies its impact on search and browsing risk dramatically.

As mentioned in the key findings above, even relatively safe TLDs like the Netherlands, Germany or Japan can generate enormous numbers of clicks through to red and yellow rated sites. This is because these countries have such large online populations searching within their native TLDs that even small percentages of risky sites can still yield dramatic aggregate risk environments.

Complete Clicks to Risk Results

How many days does it take to land on a risky site?

A different way of examining the relative risk of various TLDs is to pose a thought experiment. If a consumer restricted himself to browsing within a single TLD, how many days of surfing would it take before that user landed at a red or yellow site? For this thought experiment, we use the following formula:

30 days per month / (43.1 searches per month * 2.3 clicks per search * x% red+yellow sites) =n days

Where n is the number of days of surfing required to land at a risky site.

On average, it would take just 4 days of random browsing within the .info domain to land at a risky .info site. For the Tokelau domain, it's even worse - just 3 days of browsing. And it takes just 5.5 days to land at a risky .com site. By contrast, the average surfer would have to spend more than 318 days within the .fi domain to land at a risky site. Of course heavy users - who browse to more sites per day - face an even greater chance of infection.

Complete Days to Risk Results

Islands of Red

Small island nations and island territories frequently rank high on the list of most risky TLDs. If we include TLDs for which SiteAdvisor has tested 100 or more sites, we find five small island TLDs that are unusually risky.

  • Sao Tome / Principe (.st) 18.5%

  • Tokelau (.tk) 10.1%

  • Turks and Caicos (.tc) 9.9%

  • South Georgia / South Sandwich Islands (.gs) 9.3%

  • British Virgin Islands (.vg) 9.1%

Cocos Islands (.cc), while not highly ranked on overall risk, is 10th for e-mail practices (11.4% risky sites) and 4th for downloads (7.5% risky sites). Likewise, Tuvalu (.tv) ranks 13th for e-mail practices (7.4% risky sites) and 7th for downloads (6.7% risky sites). And Niue (.nu) ranks 1st for exploits (0.45%).

One possible reason for the relatively higher concentration of risky sites for at least some of these domains is cost. For example, Tokelau gives out domains for free. Scammers, particularly those employing phishing, exploit or spam tactics, are subject to frequent blacklisting and so they must register and discard many domains very quickly. Registration costs, minimal for one or two domains, become significant when the number of registered sites becomes large.

The .nu TLD makes itself attractive to registrants by allowing anonymous registration. The owner of the TLD indirectly acknowledged the problem some years ago when it announced a "zero tolerance" policy for spammers. But our tests indicate that this policy may not be effective in actually deterring scammers. By contrast, some larger nations require additional documentation as part of the site registration process. Japan, one of the safest TLDs, requires a local postal address as do Ireland, Sweden, and Finland. Norway, another safe TLD, requires businesses to register with the government in order to receive a .no domain.

Other countries, including relatively safe TLDs like Australia and Canada, require a local contact for all domain registrations. While this can be accomplished by hiring a third party to perform this function, the requirement adds time and cost to domain registration, two factors scammers certainly consider as they consider where to register.

Cautions About the Data
  • Individual domains can be owned by persons from any nationality. For example, .com's are registered to people of almost every nationality. This data should not be used to infer riskiness of nationality.

  • "Domain Hacks" like http://cr.yp.to/ , http://del.icio.us/ , http://blo.gs/ are increasingly popular and reduce the ability to infer risk from nationality.

  • SiteAdvisor's automated download and e-mail testing currently "reads" 13 of the world's most common languages. This means that we occasionally miss downloads and registration forms, particularly those in other languages. Note, however, that our exploit data is not language specific. We catch exploits no matter what the language of the sites that host them.

Conclusion

Between March 2004 and December 2006, the growth of Internet users in the US has been just below 4%. During the same time period, the growth rate in Germany was 18.6%. In Japan it was 31.7%.

These statistics underscore an important if sometimes overlooked fact about the Internet. As more and more of the world's population moves online, the World Wide Web increasingly earns its "world wide" moniker. This study shows that the distribution of Web safety threats is increasingly world wide as well. Problems that were once thought to largely affect surfers to say .com or .biz are now found throughout the trafficked Web.

Few Web consumers spend all of their online time surfing on a single top level domain, even if that TLD is in their native language. The ease of Web navigation and the variety of compelling content across TLDs mean that most users often "leave home." And while we do not recommend that the online population avoid any one TLD, we encourage users to search and browse with more knowledge. Tools like SiteAdvisor give consumers the kind of information they need, when they need it, to make smarter, and safer searching and surfing decisions.

Complete Data Matrices
Asia / Pacific TLDs ranked by overall percentage of red and yellow sites
Name
TLD
% sites rated red and yellow Regional Rank Overall rank % sites rated red and yellow
Tokelau
TK
10.1%
1
1
Samoa
WS
5.8%
2
3
People's Republic of China
CN
3.7%
3
11
Cocos (Keeling) Islands
CC
3.7%
4
12
Tuvalu
TV
3.0%
5
13
Tonga
TO
3.0%
6
14
South Korea
KR
2.6%
7
15
Christmas Island
CX
2.6%
8
16
India
IN
2.1%
9
18
Philippines
PH
2.1%
10
19
Niue
NU
2.1%
11
21
Hong Kong
HK
1.2%
12
28
Vietnam
VN
1.2%
13
29
Vanuatu
VU
1.1%
14
32
Republic of China (Taiwan)
TW
1.0%
15
34
New Zealand
NZ
0.6%
16
48
Thailand
TH
0.6%
17
49
Japan
JP
0.4%
18
57
Malaysia
MY
0.3%
19
61
Singapore
SG
0.3%
20
63
Australia
AU
0.2%
21
65

Europe and the Middle East TLDs ranked by overall percentage of red and yellow sites
Name
TLD
% sites rated red and yellow Regional Rank Overall rank % sites rated red and yellow
Romania
RO
5.6%
1
4
Russia
RU
4.5%
2
7
Slovakia
SK
3.9%
3
10
Estonia
EE
2.3%
4
17
Bulgaria
BG
1.9%
5
22
Ukraine
UA
1.7%
6
24
Hungary
HU
1.6%
7
25
Belgium
BE
1.5%
8
27
France
FR
1.2%
9
30
Netherlands
NL
1.1%
10
31
Germany
DE
1.0%
11
33
Poland
PL
1.0%
12
35
Czech Republic
CZ
1.0%
13
36
Italy
IT
1.0%
14
38
Yugoslavia 
YU
0.7%
15
43
Latvia
LV
0.7%
16
44
Spain
ES
0.6%
17
45
Austria
AT
0.6%
18
46
Denmark
DK
0.6%
19
47
Turkey
TR
0.5%
20
50
United Kingdom
UK
0.5%
21
51
Israel
IL
0.5%
22
52
Lithuania
LT
0.5%
23
53
Switzerland
CH
0.5%
24
54
Croatia
HR
0.5%
25
55
S. Africa
ZA
0.5%
26
56
Greece
GR
0.4%
27
58
Portugal
PT
0.4%
28
59
Slovenia
SI
0.3%
29
62
Sweden
SE
0.2%
30
66
Iceland
IS
0.2%
31
67
Norway
NO
0.2%
32
68
Ireland
IE
0.1%
33
69
Finland
FI
0.1%
34
70

Americas TLDs ranked by overall percentage of red and yellow sites
Name TLD % sites rated red and yellow Regional Rank Overall rank % sites rated red and yellow
United States
US
2.1%
1
20
Venezuela
VE
1.5%
2
26
Argentina
AR
1.0%
3
37
Mexico
MX
0.9%
4
39
Brazil
BR
0.9%
5
40
Chile
CL
0.7%
6
41
Canada
CA
0.7%
7
42
Colombia
CO
0.3%
8
64

Generic TLDs ranked by overall percentage of red and yellow sites
Name
TLD
% sites rated red and yellow Regional Rank Overall rank % sites rated red and yellow
Information INFO 7.5% 1 2
Commercial COM 5.5% 2 5
Business BIZ 4.9% 3 6
Network NET 4.4% 4 8
Families and Individuals NAME 4.2% 5 9
Organization ORG 1.8% 6 23
Educational EDU 0.3% 7 60
Governmental GOV 0.0% 8 71

Top 20 TLDs ranked by percentage of sites with red and yellow download ratings
Name
TLD
Of those sites w/ download ratings, % red and yellow Download ratings rank Overall rank % sites rated red and yellow
Samoa
WS
14.0%
1
3
Business
BIZ
11.4%
2
6
Bulgaria
BG
9.9%
3
22
Cocos (Keeling) Islands
CC
7.5%
4
12
People's Republic of China
CN
7.4%
5
11
Belgium
BE
6.8%
6
27
Tuvalu
TV
6.7%
7
13
Romania
RO
6.1%
8
4
Families and Individuals
NAME
5.6%
9
9
Information
INFO
5.6%
10
2
Vietnam
VN
5.2%
11
29
Tonga
TO
5.1%
12
14
Network
NET
4.7%
13
8
Venezuela
VE
4.5%
14
26
Estonia
EE
4.0%
15
17
France
FR
3.9%
16
30
Commercial
COM
3.9%
17
5
United States
US
3.7%
18
20
Israel
IL
3.2%
19
52
Thailand
TH
3.2%
20
49

Top 20 TLDs ranked by percentage of sites with red and yellow e-mail practices ratings
Name
TLD
Of those sites w/ e-mail ratings, % rated red or yellow E-mail ratings rank Overal rank % sites rated red and yellow
Information
INFO
73.2%
1
2
Russia
RU
21.7%
2
7
South Korea
KR
19.6%
3
15
People's Republic of China
CN
17.2%
4
11
Japan
JP
16.1%
5
57
Business
BIZ
13.2%
6
6
Ukraine
UA
12.9%
7
24
Network
NET
12.9%
8
8
Republic of China (Taiwan)
TW
11.6%
9
34
Cocos (Keeling) Islands
CC
11.4%
10
12
Hong Kong
HK
10.0%
11
28
Estonia
EE
8.2%
12
17
Tuvalu
TV
7.4%
13
13
Turkey
TR
6.9%
14
50
Commercial
COM
6.5%
15
5
Slovakia
SK
6.4%
16
10
Lithuania
LT
6.1%
17
53
Christmas Island
CX
6.1%
18
16
Brazil
BR
5.8%
19
40
Tokelau
TK
5.6%
20
1

Top 20 TLDs ranked by percentage of sites with exploits
Name
TLD
% of sites with exploits Exploit Rank Overall rank % sites rated red and yellow
Niue
NU
0.450%
1
21
Russia
RU
0.427%
2
7
Romania
RO
0.376%
3
4
Families and Individuals
NAME
0.358%
4
9
Business
BIZ
0.237%
5
6
Christmas Island
CX
0.174%
6
16
Samoa
WS
0.171%
7
3
Cocos (Keeling) Islands
CC
0.158%
8
12
Network
NET
0.134%
9
8
Belgium
BE
0.119%
10
27
People's Republic of China
CN
0.113%
11
11
Information
INFO
0.113%
12
2
Commercial
COM
0.083%
13
5
Yugoslavia 
YU
0.080%
14
43
Organization
ORG
0.076%
15
23
Tonga
TO
0.074%
16
14
Ukraine
UA
0.071%
17
24
Poland
PL
0.061%
18
35
Croatia
HR
0.049%
19
55
Tuvalu
TV
0.046%
20
13

Pervasive Risk: Seven TLDs that score in the Top 20 for each of our four rankings
Country / Generic 
TLD
Overall rank % sites rated red and yellow E-mail ratings rank Download ratings rank Exploit Rank
Information
INFO
2
1
10
12
Business
BIZ
6
6
2
5
People's Republic of China
CN
11
4
5
11
Cocos (Keeling) Islands
CC
12
10
4
8
Network
NET
8
8
13
9
Tuvalu
TV
13
13
7
20
Commercial
COM
5
15
17
13

Clicks to Risk: Top 50 TLDs ranked by percentage of estimated monthly clicks to red and yellow sites
Name 
TLD
% of overall clicks to red + yellow Estimated clicks to red + yellow / month  Rank of Clicks to Red + Yellow Overall rank % sites rated red and yellow
Commercial
COM
86.60%
481,143,591
1
5
Network
NET
6.13%
34,060,427
2
8
Organization
ORG
2.07%
11,511,747
3
23
Information
INFO
0.74%
4,130,859
4
2
Netherlands
NL
0.49%
2,695,749
5
31
United Kingdom
UK
0.41%
2,297,096
6
51
Germany
DE
0.38%
2,099,952
7
33
Japan
JP
0.30%
1,653,240
8
57
France
FR
0.21%
1,186,737
9
30
Russia
RU
0.20%
1,107,725
10
7
United States
US
0.20%
1,098,066
11
20
Business
BIZ
0.17%
925,737
12
6
Italy
IT
0.17%
917,225
13
38
Brazil
BR
0.14%
793,146
14
40
Romania
RO
0.14%
777,712
15
4
Belgium
BE
0.14%
765,627
16
27
Canada
CA
0.14%
764,518
17
42
People's Republic of China
CN
0.13%
743,164
18
11
Samoa
WS
0.11%
593,095
19
3
Tuvalu
TV
0.10%
556,402
20
13
Spain
ES
0.09%
490,266
21
45
Educational
EDU
0.08%
446,593
22
60
Poland
PL
0.07%
402,905
23
35
Cocos (Keeling) Islands
CC
0.06%
325,706
24
12
Slovakia
SK
0.05%
299,964
25
10
India
IN
0.04%
246,390
26
18
Tonga
TO
0.04%
230,171
27
14
Colombia
CO
0.04%
228,157
28
64
Australia
AU
0.04%
227,423
29
65
Mexico
MX
0.04%
214,368
30
39
Argentina
AR
0.04%
202,257
31
37
Hungary
HU
0.03%
165,170
32
25
Denmark
DK
0.03%
160,814
33
47
Switzerland
CH
0.03%
146,732
34
54
Czech Republic
CZ
0.03%
139,207
35
36
Israel
IL
0.02%
133,374
36
52
Republic of China (Taiwan)
TW
0.02%
131,647
37
34
Tokelau
TK
0.02%
128,471
38
1
Niue
NU
0.02%
127,761
39
21
Austria
AT
0.02%
121,766
40
46
Chile
CL
0.02%
111,106
41
41
South Korea
KR
0.02%
91,248
42
15
Turkey
TR
0.02%
87,323
43
50
New Zealand
NZ
0.01%
83,197
44
48
Philippines
PH
0.01%
71,804
45
19
Bulgaria
BG
0.01%
71,534
46
22
Portugal
PT
0.01%
68,418
47
59
Venezuela
VE
0.01%
64,665
48
26
Vietnam
VN
0.01%
55,284
49
29
Hong Kong
HK
0.01%
51,813
50
28

Days to Risk: Top 20 TLDs ranked by days of surfing required to land on a red or yellow site
Name
TLD
Rank of sites by days it takes to land on red and yellow sites Days of surfing required to land on a red or yellow site
Tokelau
TK
1
3.0
Information
INFO
2
4.0
Samoa
WS
3
5.2
Romania
RO
4
5.4
Commercial
COM
5
5.5
Business
BIZ
6
6.1
Russia
RU
7
6.7
Network
NET
8
7.0
Families and Individuals
NAME
9
7.2
Slovakia
SK
10
7.7
People's Republic of China
CN
11
8.1
Cocos (Keeling) Islands
CC
12
8.3
Tuvalu
TV
13
10.0
Tonga
TO
14
10.1
South Korea
KR
15
11.5
Christmas Island
CX
16
11.5
Estonia
EE
17
13.2
India
IN
18
14.2
Philippines
PH
19
14.5
United States
US
20
14.6

Complete Results
Name
TLD
% sites rated red + yellow Overall rank % sites rated red + yellow Of those sites w/ e-mail ratings, % rated red + yellow E-mail ratings rank Of those sites w/ download ratings, % red + yellow Download ratings rank
Tokelau
TK
10.1%
1
5.6%
20
0.0%
69
Information
INFO
7.5%
2
73.2%
1
5.6%
10
Samoa
WS
5.8%
3
3.2%
36
14.0%
1
Romania
RO
5.6%
4
1.5%
55
6.1%
8
Commercial
COM
5.5%
5
6.5%
15
3.9%
17
Business
BIZ
4.9%
6
13.2%
6
11.4%
2
Russia
RU
4.5%
7
21.7%
2
2.0%
36
Network
NET
4.4%
8
12.9%
8
4.7%
13
Families and Individuals
NAME
4.2%
9
0.0%
69
5.6%
9
Slovakia
SK
3.9%
10
6.4%
16
3.2%
22
People's Republic of China
CN
3.7%
11
17.2%
4
7.4%
5
Cocos (Keeling) Islands
CC
3.7%
12
11.4%
10
7.5%
4
Tuvalu
TV
3.0%
13
7.4%
13
6.7%
7
Tonga
TO
3.0%
14
1.0%
65
5.1%
12
South Korea
KR
2.6%
15
19.6%
3
2.1%
34
Christmas Island
CX
2.6%
16
6.1%
18
3.2%
21
Estonia
EE
2.3%
17
8.2%
12
4.0%
15
India
IN
2.1%
18
4.3%
28
1.5%
48
Philippines
PH
2.1%
19
3.7%
31
0.8%
63
United States
US
2.1%
20
2.8%
38
3.7%
18
Niue
NU
2.1%
21
4.6%
26
2.3%
29
Bulgaria
BG
1.9%
22
4.6%
25
9.9%
3
Organization
ORG
1.8%
23
3.1%
37
1.7%
41
Ukraine
UA
1.7%
24
12.9%
7
1.8%
39
Hungary
HU
1.6%
25
4.7%
23
2.2%
33
Venezuela
VE
1.5%
26
4.0%
30
4.5%
14
Belgium
BE
1.5%
27
2.1%
49
6.8%
6
Hong Kong
HK
1.2%
28
10.0%
11
1.8%
38
Vietnam
VN
1.2%
29
1.8%
51
5.2%
11
France
FR
1.2%
30
3.4%
33
3.9%
16
Netherlands
NL
1.1%
31
1.9%
50
3.1%
24
Vanuatu
VU
1.1%
32
0.0%
70
0.0%
70
Germany
DE
1.0%
33
1.6%
53
0.9%
61
Republic of China (Taiwan)
TW
1.0%
34
11.6%
9
1.2%
56
Poland
PL
1.0%
35
1.6%
54
2.8%
25
Czech Republic
CZ
1.0%
36
4.8%
22
1.6%
45
Argentina
AR
1.0%
37
4.6%
27
2.6%
27
Italy
IT
1.0%
38
2.6%
41
3.2%
23
Mexico
MX
0.9%
39
2.1%
46
1.4%
49
Brazil
BR
0.9%
40
5.8%
19
2.2%
32
Chile
CL
0.7%
41
2.2%
44
2.2%
31
Canada
CA
0.7%
42
1.5%
57
0.8%
62
Yugoslavia 
YU
0.7%
43
4.7%
24
2.5%
28
Latvia
LV
0.7%
44
1.6%
52
2.6%
26
Spain
ES
0.6%
45
1.2%
62
1.0%
59
Austria
AT
0.6%
46
1.1%
63
1.3%
51
Denmark
DK
0.6%
47
3.4%
34
1.7%
42
New Zealand
NZ
0.6%
48
0.8%
67
0.9%
60
Thailand
TH
0.6%
49
4.1%
29
3.2%
20
Turkey
TR
0.5%
50
6.9%
14
1.5%
47
United Kingdom
UK
0.5%
51
1.2%
60
1.2%
54
Israel
IL
0.5%
52
5.0%
21
3.2%
19
Lithuania
LT
0.5%
53
6.1%
17
2.3%
30
Switzerland
CH
0.5%
54
1.3%
58
1.8%
40
Croatia
HR
0.5%
55
3.2%
35
1.0%
58
S. Africa
ZA
0.5%
56
2.1%
45
1.2%
52
Japan
JP
0.4%
57
16.1%
5
0.5%
65
Greece
GR
0.4%
58
2.6%
42
2.0%
35
Portugal
PT
0.4%
59
1.1%
64
1.2%
55
Educational
EDU
0.3%
60
0.9%
66
1.6%
46
Malaysia
MY
0.3%
61
1.5%
56
0.4%
68
Slovenia
SI
0.3%
62
2.1%
48
1.9%
37
Singapore
SG
0.3%
63
2.6%
43
0.5%
64
Colombia
CO
0.3%
64
2.7%
40
1.7%
43
Australia
AU
0.2%
65
0.7%
68
1.7%
44
Sweden
SE
0.2%
66
1.2%
59
1.2%
53
Iceland
IS
0.2%
67
3.4%
32
1.1%
57
Norway
NO
0.2%
68
2.1%
47
1.4%
50
Ireland
IE
0.1%
69
1.2%
61
0.4%
66
Finland
FI
0.1%
70
2.8%
39
0.4%
67
Governmental
GOV
0.0%
71
0.0%
71
0.0%
71

Complete Results, Continued
Name
TLD
% of sites with exploits Exploit Rank Rank of Clicks to Red + Yellow % of overall clicks to red + yellow Estimated clicks to red + yellow / month  Days of surfing required to land on a red or yellow site
Tokelau
TK
0.030%
25
38
0.02%
128,471
3.0
Information
INFO
0.110%
12
4
0.74%
4,130,859
4.0
Samoa
WS
0.170%
7
19
0.11%
593,095
5.2
Romania
RO
0.380%
3
15
0.14%
777,712
5.4
Commercial
COM
0.080%
13
1
86.60%
481,143,591
5.5
Business
BIZ
0.240%
5
12
0.17%
925,737
6.1
Russia
RU
0.430%
2
10
0.20%
1,107,725
6.7
Network
NET
0.130%
9
2
6.13%
34,060,427
7.0
Families and Individuals
NAME
0.360%
4
52
0.01%
50,824
7.2
Slovakia
SK
0.010%
41
25
0.05%
299,964
7.7
People's Republic of China
CN
0.110%
11
18
0.13%
743,164
8.1
Cocos (Keeling) Islands
CC
0.160%
8
24
0.06%
325,706
8.3
Tuvalu
TV
0.050%
20
20
0.10%
556,402
10.0
Tonga
TO
0.070%
16
27
0.04%
230,171
10.1
South Korea
KR
0.010%
40
42
0.02%
91,248
11.5
Christmas Island
CX
0.170%
6
54
0.01%
39,704
11.5
Estonia
EE
0.000%
51
51
0.01%
50,984
13.2
India
IN
0.000%
57
26
0.04%
246,390
14.2
Philippines
PH
0.000%
60
45
0.01%
71,804
14.5
United States
US
0.050%
21
11
0.20%
1,098,066
14.6
Niue
NU
0.450%
1
39
0.02%
127,761
14.8
Bulgaria
BG
0.000%
55
46
0.01%
71,534
16.0
Organization
ORG
0.080%
15
3
2.07%
11,511,747
17.1
Ukraine
UA
0.070%
17
56
0.01%
35,934
17.9
Hungary
HU
0.000%
54
32
0.03%
165,170
19.3
Venezuela
VE
0.000%
59
48
0.01%
64,665
19.7
Belgium
BE
0.120%
10
16
0.14%
765,627
19.7
Hong Kong
HK
0.000%
50
50
0.01%
51,813
25.7
Vietnam
VN
0.000%
64
49
0.01%
55,284
26.1
France
FR
0.000%
47
9
0.21%
1,186,737
26.2
Netherlands
NL
0.000%
45
5
0.49%
2,695,749
27.8
Vanuatu
VU
0.000%
70
69
0.00%
2,633
28.1
Germany
DE
0.010%
42
7
0.38%
2,099,952
28.9
Republic of China (Taiwan)
TW
0.040%
22
37
0.02%
131,647
30.0
Poland
PL
0.060%
18
23
0.07%
402,905
30.4
Czech Republic
CZ
0.010%
31
35
0.03%
139,207
30.7
Argentina
AR
0.000%
56
31
0.04%
202,257
31.0
Italy
IT
0.010%
38
13
0.17%
917,225
31.3
Mexico
MX
0.010%
37
30
0.04%
214,368
34.5
Brazil
BR
0.010%
32
14
0.14%
793,146
34.9
Chile
CL
0.000%
62
41
0.02%
111,106
43.7
Canada
CA
0.010%
36
17
0.14%
764,518
44.7
Yugoslavia 
YU
0.080%
14
66
0.00%
8,450
45.0
Latvia
LV
0.030%
24
61
0.00%
16,403
45.3
Spain
ES
0.000%
67
21
0.09%
490,266
47.0
Austria
AT
0.000%
44
40
0.02%
121,766
48.4
Denmark
DK
0.000%
48
33
0.03%
160,814
49.6
New Zealand
NZ
0.000%
69
44
0.01%
83,197
52.7
Thailand
TH
0.000%
58
53
0.01%
45,732
54.6
Turkey
TR
0.030%
26
43
0.02%
87,323
56.3
United Kingdom
UK
0.020%
27
6
0.41%
2,297,096
57.4
Israel
IL
0.000%
53
36
0.02%
133,374
59.9
Lithuania
LT
0.000%
52
62
0.00%
15,401
61.5
Switzerland
CH
0.010%
39
34
0.03%
146,732
63.5
Croatia
HR
0.050%
19
59
0.01%
30,287
64.4
S. Africa
ZA
0.020%
29
57
0.01%
34,291
65.9
Japan
JP
0.000%
49
8
0.30%
1,653,240
73.5
Greece
GR
0.010%
33
58
0.01%
34,152
77.0
Portugal
PT
0.020%
30
47
0.01%
68,418
80.3
Educational
EDU
0.000%
68
22
0.08%
446,593
100.4
Malaysia
MY
0.000%
65
64
0.00%
13,844
101.2
Slovenia
SI
0.000%
63
68
0.00%
3,983
110.3
Singapore
SG
0.020%
28
60
0.00%
16,416
115.8
Colombia
CO
0.040%
23
28
0.04%
228,157
118.6
Australia
AU
0.010%
35
29
0.04%
227,423
140.0
Sweden
SE
0.010%
43
55
0.01%
37,415
144.3
Iceland
IS
0.000%
61
70
0.00%
2,287
155.3
Norway
NO
0.000%
46
63
0.00%
14,569
184.2
Ireland
IE
0.000%
66
65
0.00%
10,974
283.9
Finland
FI
0.010%
34
67
0.00%
8,316
318.6
Governmental
GOV
0.000%
71
71
0.00%
0