Analyse a site

Statistics

The state of the web, in numbers

Every figure below is drawn from the 607,294 domains LegitSonar has assessed. Read together they say something uncomfortable: most of the web's newest addresses are not built to last, and a great many are not built to be traced.

See the rankings How scores are built

607,294

Domains assessed

Across 753 top-level domains.

341,317

Rated trustworthy

56% of everything on file.

112,361

Flagged high risk

19% scored in the bottom band.

62.9

Average trust score

Out of 100, across every scored domain.

Distribution

Scores do not cluster in the middle

A healthy population would bunch around the average. This one splits in two: a large mass of sites that pass every check, and a second mass at the very bottom that fails almost all of them. The middle is thin, and that is the useful part — most domains are not ambiguous.

Verdicts

How that becomes a verdict

Scores are grouped into bands, because the difference between 71 and 74 is noise and the difference between 71 and 14 is not.

  • Likely trustworthy
    251,040 · 41.3%
  • Probably legitimate
    90,277 · 14.9%
  • Doubtful
    59,723 · 9.8%
  • High risk
    40,575 · 6.7%
  • Very high risk
    112,361 · 18.5%
  • Not yet analysed
    53,318 · 8.8%

Top-level domains

The address ending is a signal in itself

Registries price their domains differently, and cheap bulk registration attracts bulk abuse. The gap between the extremes is not subtle — the share of high-risk domains ranges from under one percent to over three quarters. Only endings with at least 1,000 assessed domains are ranked, so a handful of bad addresses cannot distort a small one.

Riskiest endings

Share of domains in the bottom band.

  • .buzz 1,171 77%
  • .asia 1,183 73.5%
  • .dev 3,426 71.3%
  • .online 72,101 66.3%
  • .sbs 1,318 60.5%
  • .click 3,371 56.5%
  • .top 5,598 53.8%
  • .site 7,011 45.9%
  • .app 3,919 39.6%
  • .vip 1,397 37.2%
  • .xyz 10,655 35.8%
  • .ru 6,653 35.7%

Safest endings

Same measure, other end of the table. Bars are scaled within this panel — every figure here is under three percent.

  • .ph 37,472 0.1%
  • .br 18,217 0.4%
  • .jp 2,125 0.6%
  • .au 3,290 0.8%
  • .ar 1,393 1.1%
  • .vn 1,425 1.5%
  • .ir 2,012 1.7%
  • .mx 1,954 1.8%
  • .tr 1,333 2.1%
  • .za 1,943 2.2%
  • .es 3,371 2.5%
  • .in 9,304 2.8%

By volume

The endings that carry the most domains, with the average score each one earns.

  • .com 232,777 domains 72/100
  • .online 72,101 domains 14/100
  • .ph 37,472 domains 98/100
  • .br 18,217 domains 94/100
  • .shop 14,758 domains 51/100
  • .net 14,659 domains 74/100
  • .org 11,920 domains 70/100
  • .xyz 10,655 domains 33/100
  • .in 9,304 domains 70/100
  • .de 9,053 domains 70/100
  • .uk 8,467 domains 76/100
  • .site 7,011 domains 28/100
  • .ru 6,653 domains 37/100
  • .top 5,598 domains 22/100
  • .cn 5,251 domains 63/100
  • .fr 5,211 domains 85/100

Transparency

Most domains do not say who owns them

Registrars have redacted WHOIS records by default since GDPR, which protects individuals and also shields anyone who would rather not be found. It is not evidence of wrongdoing on its own — but it removes the single fastest way to check that a business is real.

80%

Owner not disclosed

485,587 domains hide their registrant; 121,707 publish it.

464,486

Valid certificate

A certificate is now nearly free, so its presence proves far less than its absence disproves.

66,911

No usable certificate

Expired, mismatched, or absent entirely.

261

Registrant countries

Where a country is declared at all.

Age

Fraud is a young business

Age is the single most informative signal LegitSonar has, and this is why: the corpus is dominated by addresses registered within the last year. A domain that has been renewed for a decade has survived scrutiny that a three-week-old one has not yet met.

  • Under 3 months 161,415
  • 3–12 months 85,276
  • 1–3 years 80,510
  • 3–10 years 50,108
  • Over 10 years 43,360

Who issues the certificates

Certificate authorities across the corpus.

  • Let's Encrypt 324,112
  • Google Trust Services 76,725
  • GoDaddy.com 25,113
  • Sectigo Limited 10,030
  • SSL Corporation 5,814
  • ZeroSSL GmbH 5,032
  • Amazon 4,753
  • GoDaddy.com, Inc. 4,364
  • DigiCert Inc 3,397
  • TrustAsia Technologies, Inc. 1,531

Where registrants say they are

Only the fifth of domains that declare a country.

  • United States 43,159
  • Iceland 11,583
  • Brazil 11,402
  • India 9,924
  • China 7,725
  • Canada 6,321
  • France 3,369
  • Japan 3,200
  • Netherlands 2,939
  • Spain 2,726
  • Germany 2,470
  • United Kingdom 1,837

Signals

What the scanner recognises most often

Tags are the patterns the analysis detects — a shop, a helpdesk, a subscription funnel, a language. They describe what a site is, which is what makes a score interpretable rather than arbitrary.

Figures are recomputed hourly. The corpus was last extended 7 hours ago, and any domain can be added to it by running a scan.