Bulk Registration Report: Methodology
The Bulk Registration Report covers one day of domain registrations and identifies groups of names that a single buyer evidently registered together. This page explains how those groups are found, how they are checked, and how to read the results. All times are UTC.
Finding clusters
We analyze every domain registration recorded on the report day (UTC) by the most active registrars, and group names that one buyer evidently registered together. The signals include:
- Numbered series: the same name with a changing number.
- Shared name templates: names built from a common pattern.
- Timing: registrations made minutes apart.
Sampling
For the 25 highest-priority clusters, we check random samples of members rather than every domain:
- Live DNS: a sample sized to estimate shares of the cluster within ±10 percentage points at 95% confidence.
- Web pages: a smaller random sample, sized for ±20 percentage points.
Percentages reported for a cluster are estimates from these samples.
Shared infrastructure
Infrastructure counts as shared only when a majority of the cluster uses it, at 95% confidence. Some infrastructure never counts, because large numbers of unrelated customers use it:
- pooled CDN addresses
- registrar defaults
- parking defaults
- hosting-platform defaults
Evidence ratings
A naming pattern alone is weak evidence. A cluster rated moderate or strong also needs shared infrastructure or page content.
Page signals
- A registrar’s default page counts as parked.
- A page presenting the brand that the domain name itself spells is not counted as impersonation.
- Page signals are automated leads, not verdicts. Verify them before acting on them.
Reading the report
Registrars are where names were bought, not who bought them. A cluster at a registrar says nothing about the registrar’s own involvement.