Internet measurement, security, and privacy research heavily relies on Internet domain top lists, which provide a set of purportedly popular or commonly used domains to investigate. Existing top lists, such as Alexa, Cisco Umbrella, and Tranco, have been used in hundreds of prior academic studies, making it a critical research resource. However, researchers have identified numerous issues with existing top lists, including a lack of transparency into the list data sources and construction methods, high volatility, and easy ranking manipulation. Despite these flaws, these top lists remain widely used today due to a lack of alternatives.

DNS abuse has been occurring since the early days of the Internet, and now it is affecting the daily lives of many Internet users around the world. Therefore, DNS abuse must be resolved to provide the people of the world a safer and more stable Internet.

What’s the difference? Simply put, in a thin registry, the contact details for a domain registration (namely the registrant, admin, technical and billing contacts) are stored at the registrar, and the registry’s whoisserver only shows basic domain information, and provides a referral to the “registrar whois” which then shows the relevant contact data. Conversely, in a thick registry system, the contact details are stored at the registry level, and are shown in the “registry whois”. There is no “registrar whois”.