Detection data

Unit, window and classification criteria

• Apex domain

  The registrable domain according to the Public Suffix List: example.com, not www.example.com nor example.pages.dev. Every count on this site is over distinct apex domains.

• Window

  Thirty complete days, measured in a single run. A domain that reappears counts once, at the highest severity it reached.

• Severity

  Critical, high, medium, low: a technical measure, the effective severity described in step 5 of detection, not a legal qualification.

• Targeting Italy

  Decided by a single function that fuses native language, Italian references and targeting signals: the same one that feeds the analysts’ work queue.

• Market served

  An official language of the Union, English excluded, that the page serves natively or in translation. English does not identify a market.

• Named literally

  The domain appears, exactly, in the structured column of an authority’s warning. A name that merely resembles a cited name does not count.

From the observed certificate to effective severity

The cascade starts from domains whose page was read and classified and goes down to critical domains targeting Italy. Figures are rounded to two significant digits; the “measured” column carries the exact value for the window. The last two levels come from different definitions, targeting and market served: 1,221 domains target Italy, 972 serve Italian, and the two bars are read side by side, not one inside the other.

Comparison of four consecutive windows

To know how much a figure changes from month to month, four consecutive thirty-day windows were measured, in chronological order, with the same query and the same unit.

The maximum deviation from the median is +62%: that is why published figures are rounded to two significant digits.

The peak in the third window comes from suffix extraction, since corrected: in the peak week 61% of detected domains sat on shared-hosting suffixes, against 1% in steady state. The published window falls entirely after the fix.

Comparison with the domains cited in authorities’ warnings

The contribution of this comparison is breadth: 5,215 critical domains that no warning we read names. The external reference is the authorities’ warnings collected in the IOSCO Investor Alerts Portal: 44,894 warnings from 79 authorities, read from their structured column. The table keeps the modes of comparison and their populations apart.

Matching by name serves to find clones: a legitimate brand appears in warnings precisely because it is cloned, so similarity points to the clone.

“Absent from the warnings read” means no imported warning mentions it: the authority may know of it through other channels.

Gap from the warning

For domain–warning pairs where the domain is named literally in a warning published after monitoring began, we measure the gap between the domain’s first appearance in our registry and the warning date: it is positive when the domain appears after the warning. Rule set before looking: at least 1,000 pairs. With 895 pairs, on an earlier run, the measure was not publishable; with 1,161, over 1,113 domains and 34 authorities, it is.

For domains an authority has already named, in more than four pairs out of five our first observation does not come before the warning.

Three factors push the gap towards the positive: we observe the logs from the start of monitoring, so a domain born earlier and renewed later appears as new; earlier warnings stay excluded; and a domain with no financial keyword in its name enters our registry only through a match with a warning already imported. The second column, with warnings published at least a month after that start, reduces the two effects tied to the start of monitoring; the third cannot be separated, because the registry does not keep the way a domain came in.

The domains named in warnings are those that lived long enough to be reported: estimating how long a set-up lasts also needs the ones that vanish in three weeks, which observation at birth includes.

Union markets served by critical domains

1,561 of the 5,856 critical domains (27%) serve at least one official language of the Union, English excluded, natively or in translation: 1,279 one language, 43 two, 239 three or more. A domain that opens three or more markets in the same act is a European case, even when every national authority sees it from its own market.

Counts by language overlap: they say which markets are served and by how many domains.

Periodic check on critical domains

A list becomes a work queue only if it says which entries are still active. Of the 5,856 critical domains in the window, 5,769 have a reachability check (99%) and 327 are unreachable: 5,442 were still responding on the check date.

The check says the server responds; for the content, the preserved copy is the record, with its date. How a response is classified is described at step 7 of detection.

How to read these figures

• The false-positive rate needs a labelled sample.

  It is estimated on a random sample reviewed blind, under a protocol fixed in advance, and then with the authorities’ feedback. Until the sample is labelled, the document publishes no percentage.

• Severities are compared within a market.

  The classifier works with the framing “analyst for the Italian regulator”: severity shares and rankings by market cannot be derived from this data.

• The counts measure what the pipeline analysed.

  They are not a census of existing domains: the volume of the observed stream is not persisted, so no penetration rate can be derived.

• Certificate Transparency sees births.

  Out of scope are domains served over plain HTTP, those covered by a pre-existing wildcard certificate, and those registered before monitoring began.

• Severity and warnings are read together.

  The match with names cited in warnings enters the computation of effective severity, so a comparison between the two is partly circular.

• Reachability is measured from the European Union.

  Checks use a public resolver: a block applied by a country’s connectivity providers is visible from that country.

The queries that produce these figures are repeatable and runnable in front of you, in platform access.