Defaults.Exposed › Stats › TLDs compared
Which TLD has the worst security?
October 2026 census edition
As of October 12, 2026, among TLDs (Top-Level Domains) with at least one million graded domains, .bond has the highest security failure rate in the Defaults.Exposed census: 99.4% of its 1,152,710 graded domains score an F.
Restricted to TLDs with at least 1,000,000 graded domains so small registries cannot dominate the ranking.
Worst large TLD by F rate: how it is measured
It comes from the existence pass, which unions three source feeds (zone files, DNS measurement data and web crawl data), removes the names that do not exist and the wildcard phantoms, and records which of the scanned domains could be graded. Every domain in the census is measured directly and counted once.
A poorly performing TLD is usually a cheap, open one with high registration churn, which concentrates parked, disposable and abandoned domains. The extension reflects who registers there, and a domain’s own records still decide its posture.
The figure is a name rather than a number: whichever entry holds the largest share of the population being measured, with that share stated beside it.
It moves when registry policy changes and when the population under a TLD turns over. A registry that mandates or subsidises a control can shift its whole TLD inside one edition. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see the per-TLD data.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| TLD | Domains graded | F rate |
|---|---|---|
| .bond | 1,152,710 | 99.4% |
| .cn | 6,297,295 | 98.2% |
| .top | 5,530,948 | 98.1% |
| .vip | 1,666,243 | 98.0% |
| .lol | 1,059,035 | 97.9% |
| .cc | 2,130,610 | 95.3% |
| .shop | 3,827,213 | 87.0% |
| .store | 1,863,504 | 86.0% |
| .site | 1,645,023 | 85.0% |
| .ru | 4,720,339 | 84.9% |
Worst large TLD by F rate: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "Which TLD has the worst security?" (as of October 12, 2026). https://defaults.exposed/stats/which-tld-has-the-worst-security
Permalink: https://defaults.exposed/stats/which-tld-has-the-worst-security · Machine-readable: /stats/s/riskiest-tld.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.