Research and data · 7 October 2026

Internet Infrastructure Research & Open Datasets

Hosting, DNS, email and security statistics from 145 million domains.

The whoami barometers rest on the continuous analysis of 145,032,452 domain names: for each one, the addresses it resolves to, the network and company that host it, its DNS and email providers, and its email security records. This page documents the sources, the methodology and the published datasets, and says how to cite them. The barometers themselves stay the place to explore the figures.

Data as of 7 October 2026. Figures on the barometer pages move with each data update; the CSV files below are rebuilt from the same data at most one hour later.

Key figures

39%

of the top 1M websites are hosted by Cloudflare

Hosting barometer →

35%

of .fr domains are hosted by OVHcloud

.fr hosting →

202 of 205

countries where Cloudflare hosts the largest share of the most visited sites

Country map →

34%

of the top 100K websites use Cloudflare for DNS

DNS barometer →

29%

of the top 100K websites receive their email at Google

Email barometer →

37%

of the top 100K websites publish no DMARC record

Email security →

37%

of the top 100K websites are reachable over IPv6

IPv6 and DNSSEC →

274,491

domains listed as phishing, scam or malware in public blocklists

Phishing listings →

As of 7 October 2026. Top 1M: Tranco list. Top 100K: its first 100,000 names that resolve.

Datasets (CSV, UTF-8, CC BY 4.0) · README: licence, fields, citation

File	What it contains	Columns	Updated
`hosting-segments.csv` live statistics →	Web hosting market share by segment For every segment (top 1M, top 10K, most visited from each country, each domain extension) the 25 largest hosting companies with their number of domains and share, plus an "Others" row. Latest monthly snapshot.	`snapshot_date, segment, segment_label, sample_size, segment_domains, rank, provider, domains, share_percent`	monthly snapshot, refreshed with each data update
`hosting-countries.csv` live statistics →	Main web host by country For each country with enough data: the five largest hosting companies among the websites most visited from that country, plus Cloudflare when it is not among them.	`snapshot_date, country_code, country_name, sample_size, rank, provider, domains, share_percent`	monthly snapshot, refreshed with each data update
`dns-providers.csv` live statistics →	DNS hosting provider market share, top 100K websites Number and share of the Tranco top 100K websites that use each DNS provider (from their NS records).	`snapshot_date, sample_size, provider, slug, domains, share_percent`	rebuilt when the Tranco part of the data changes
`mail-providers.csv` live statistics →	Email provider market share, top 100K websites Number and share of the Tranco top 100K websites that receive their email at each provider (from their MX records).	`snapshot_date, sample_size, provider, slug, domains, share_percent`	rebuilt when the Tranco part of the data changes
`email-security.csv` live statistics →	DMARC and SPF adoption, top 100K websites DMARC policy and SPF qualifier counts for the Tranco top 100K websites: overall, by popularity band, by email provider and by domain extension.	`snapshot_date, breakdown, group, sample_size, dmarc_reject, dmarc_quarantine, dmarc_none, dmarc_missing, dmarc_enforced_percent, spf_hard, spf_soft, spf_neutral, spf_missing`	records resolved weekly
`ipv6-dnssec.csv` live statistics →	IPv6 and DNSSEC adoption, top 100K websites Number and share of the Tranco top 100K websites reachable over IPv6 and signed with DNSSEC: overall, by popularity band, by hosting company and by domain extension.	`snapshot_date, breakdown, group, sample_size, ipv6_domains, ipv6_percent, dnssec_sample_size, dnssec_signed, dnssec_percent`	DNS records and DS records refreshed weekly
`technologies.csv` live statistics →	Website technologies, top 1M websites and countries Number and share of websites per detected technology (content platform, e-commerce platform, web server, CDN, server language, JavaScript framework, security headers, protocols), from their home page: Tranco top 100K, top 1M, and the most visited sites of each country (Chrome UX Report).	`snapshot_date, segment, category, value, sample_size, domains, percent`	home pages probed weekly
`phishing-by-tld.csv` live statistics →	Domains listed in public phishing blocklists, by extension Number of domains listed as phishing, scam or malware in public blocklists, per domain extension, with the extension's size when its zone is known. A listing is what the lists say; it is not verified by us.	`snapshot_date, tld, listed_domains, zone_domains, listed_per_100k_zone_domains`	rebuilt daily from public feeds

Web hosting

Live statistics: View live hosting statistics
Data snapshot: October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: 539 segments; top 1M websites: 921,699 domains resolved to a known network.
Datasets: hosting-segments.csv
Method: Each domain is resolved in DNS; its IP address is mapped to the network (ASN) that announces it, and ASNs are grouped by company. A site behind a CDN counts for the CDN, not for the origin server.

Hosting by country

Live statistics: View the live hosting map by country
Data snapshot: October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: 205 countries (websites most visited from each country, Chrome UX Report).
Datasets: hosting-countries.csv
Method: Same hosting measure applied to the popular sites of each country. A country needs enough resolved sites to appear.

DNS providers

Live statistics: View live DNS provider statistics
Data snapshot: Tranco list of 3 October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: Top 100K websites: 97,603 with NS records.
Datasets: dns-providers.csv
Method: The provider is identified from the name servers (NS) of each domain, matched against a table of known providers; a domain running its own is counted as self-hosted.

Email providers

Live statistics: View live email provider statistics
Data snapshot: Tranco list of 3 October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: Top 100K websites: 71,829 with MX records.
Datasets: mail-providers.csv
Method: The provider is identified from the mail exchangers (MX) of each domain, matched against a table of known providers.

Email security (DMARC, SPF)

Live statistics: View live email security statistics
Data snapshot: Tranco list of 3 October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: 89,977 of the top 100K websites that resolve.
Datasets: email-security.csv
Method: DMARC: the policy (p=) of the _dmarc record: reject, quarantine, none, or no record. SPF: the qualifier ending the SPF record: -all, ~all, neutral or open, or no record. A policy applied to a percentage of messages counts as its policy.

IPv6 and DNSSEC adoption

Live statistics: View live IPv6 and DNSSEC statistics
Data snapshot: Tranco list of 3 October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: 89,977 of the top 100K websites that resolve.
Datasets: ipv6-dnssec.csv
Method: IPv6: the domain, or its www name, resolves to at least one AAAA address. DNSSEC: the parent zone publishes a DS record for the domain (presence only, signature validity is not checked); the DNSSEC base is the domains whose DS lookup answered.

Website technologies

Live statistics: View live technology statistics
Data snapshot: Tranco list of 3 October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: Top 100K: 71,256 websites that answered and did not show an anti-bot page; also the top 1M and the most visited sites of each country.
Datasets: technologies.csv
Method: One GET / request per domain per week, identified as xj1-whoami-research; platform, server, CDN, language and framework are detected from the headers and the HTML of the home page (no JavaScript is run), security headers are read as present or absent. Only indicators are stored.

Phishing listings

Live statistics: View live phishing listing statistics
Data snapshot: 7 October 2026
Last computed: 7 October 2026
Page text updated: 2 October 2026
Base: 274,491 domains listed, of which 112,704 are in the whoami dataset; 6 public sources.
Datasets: phishing-by-tld.csv
Method: Aggregates of public blocklists (PhishTank, OpenPhish and others, listed on the page). A listing is what a list says: whoami does not verify it, and never links to a listed site. Very popular domains are excluded, and hosts on shared platforms are counted apart from registered domains.

Sources

Domain lists: ICANN Centralized Zone Data Service (generic extensions), AFNIC open data (.fr), Internetstiftelsen (.se, .nu), Estonian Internet Foundation (.ee), Certificate Transparency logs (new domains in extensions whose zone is not published).
Popularity: Tranco top 1M (Le Pochat et al., NDSS 2019) and the Chrome UX Report by country (CC BY-SA 4.0).
Network ownership: This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
DNS: every name is resolved by our own recursive resolver; records are refreshed about every 90 days (the top 100K weekly).

Only aggregates are published here. Zone files and per-domain records are not redistributed.

Definitions and limits

Hosted by: the company whose network announces the IP address a name resolves to. For sites behind a CDN or a protection service (Cloudflare, Fastly, Akamai, DDoS-Guard…), this is the CDN: the real origin server is not visible.
Domains, not sites or traffic: parked, dormant and redirected domains count like active ones in the extension segments. The popularity segments (top 1M, top 100K, by country) are closer to actual use.
Snapshots: a domain resolved to several networks is counted once, for the main one. Shares are rounded; the CSV files carry two decimals.
Coverage: the full zone files of .com and .net are not available to us: since 3 October 2026 these two extensions are fed only from Certificate Transparency logs (domains that obtained a certificate), so they are incomplete and under-represented in the extension segments, as is any extension whose zone is not public. Names found this way are recorded from the day the collection started, not back-dated. Country views depend on the Chrome UX Report, which reflects Chrome users.
Popularity bias: Tranco and the Chrome UX Report rank sites differently; their lists change from one month to the next, and a share can move because the list moved, not because hosting did.
Email security: a domain that does not send email should still publish p=reject, so "no DMARC" is a missing protection, not necessarily a misconfigured mail setup.
Phishing: the listings reflect the coverage and the delays of the public lists. A high count for an extension also reflects its size and its price, not only its abuse handling.

Licence and how to cite

The datasets are published under Creative Commons Attribution 4.0 (CC BY 4.0): use, share and adapt them, including commercially, with a link to the source.

Whoami Internet Research, whoami.xj1.fr.
Dataset snapshot: 7 October 2026.
https://whoami.xj1.fr/research/

For specific statistics, please cite the corresponding dataset or barometer page. The same text, with the field definitions, is in the README.