# Domain Zone Resilience Index: Suspension Speed by TLD

> 14 TLDs ranked on 827 domains: closed share, median days to suspension and a 0–100 resilience score. Method, CSV download, updates.

- Language: en
- Published: 2026-10-28 · Updated: 2026-10-28
- HTML: https://rikidomains.at/en/domain-zone-resilience-index/
- Markdown: https://rikidomains.at/en/domain-zone-resilience-index/index.md
- RU version: https://rikidomains.at/ru/indeks-ustoychivosti-zon/

The **Domain Zone Resilience Index** shows how fast and how often a zone closes domains after complaints. One score from 0 to 100 per zone: the higher it is, the longer a domain survives after the first complaint and the smaller the share of domains that end up closed. The data comes from the log of the Riki Domains scam-site removal service: 827 domains, 76,473 complaints, May–October 2026. Index version **2026-10**, data period 7 May – 17 October 2026.

The slowest zone in the sample is **.at** (score 74: 39% closed, median 52 days). The fastest are **.sbs**, **.gr.com** and **.ink** (8–20 points: 63–89% closed, median 2–4 days). **.com** sits right in the middle: 30 points, half of the domains closed within a week.

## The index table

| TLD | Score | Reaction to complaints | Closed | Days to suspension (median) | Domains in sample | At Riki Domains |
|---|---:|---|---:|---:|---:|---|
| .at | **74** | slow | 39% | 52.3 | 59 | [Titan](https://rikidomains.at/en/tld/at/) |
| .app | **55** | slow | 31% | 24.9 | 13 | — |
| .io | **55** | slow | 50% | 35.9 | 22 | — |
| .to | **40** | medium | 36% | 10.1 | 64 | [Titan](https://rikidomains.at/en/tld/to/) |
| .org | **39** | medium | 45% | 13.5 | 102 | — |
| .net | **37** | medium | 50% | 14.6 | 30 | — |
| .co | **34** | medium | 82% | 29.9 | 11 | — |
| .com | **30** | medium | 52% | 7.4 | 215 | [Standard](https://rikidomains.at/en/tld/com/) |
| .pro | **29** | medium | 44% | 1.5 | 16 | [Standard](https://rikidomains.at/en/tld/pro/) |
| .co.com | **24** | fast | 79% | 15.7 | 48 | [Titan](https://rikidomains.at/en/tld/co-com/) |
| .ink | **20** | fast | 63% | 2.4 | 30 | — |
| .gr.com | **17** | fast | 72% | 4.0 | 29 | — |
| .beer | **14** | fast (preliminary) | 80% | 4.4 | 5 | — |
| .sbs | **8** | fast | 89% | 2.8 | 18 | — |

Classes: **fast** reaction — up to 25 points, **medium** — 26–50, **slow** — 51 and above. "Closed" is the share of the zone's domains that were suspended or deleted by the end of the period; "days to suspension" is the median from the first complaint to the suspension, over the closed domains.

[Download the table as CSV](/data/zone-resilience-index-2026-10.csv) — the same figures plus the index version and the period.

## How to read the index: two sides

This table has two readers with opposite interests, and it is honest with both.

**If you are trying to get a scam site closed.** The score tells you how long to wait. In zones up to 25 points a domain usually closes within days of a complete evidence package: the registry suspends it directly. In zones of 51 and above, expect weeks of correspondence and involve the hosting provider and payment services right away instead of waiting for the registrar. How the process works and how many complaints it takes is covered in [How long a scam domain survives after a complaint](https://rikidomains.at/en/guides/how-long-scam-domains-survive/).

**If you own a domain and run a legitimate project.** The score tells you how much time you have if a mistaken or malicious complaint arrives, or if the site is hacked and someone else's content appears on it. In a fast zone the domain can end up on clientHold before you have read the registrar's email — there the owner's contacts must be current and emails answered the day they arrive. In a slow zone there is time to sort things out, but lifting a suspension, if it does happen, also takes longer. What the statuses mean and how to lift them is in [The three domain locks](https://rikidomains.at/en/guides/three-domain-locks/).

The index does not say "where the rules can be broken". A confirmed and unresolved violation, a court order or a regulator's decision closes a domain in any zone; the difference is only in timing and in who makes the decision — the registrar or the registry.

## Method

**Score** = 50 × share of the zone's domains that stayed up + 50 × (median days to suspension / 60, capped at 1). Both halves carry equal weight: one for "how often they close", the other for "how fast". The median is capped at 60 days so that one zone with very long timelines does not stretch the scale. Example for .at: 50 × 0.61 + 50 × 0.87 = 74.

**Sample.** The log of the Riki Domains scam-site removal service: 827 crypto-phishing domains taken into work between 7 May and 17 October 2026. The TLD is known for every domain, so the breakdown by zone is complete. The index includes zones with five or more domains in the sample; with fewer than ten the score is marked as preliminary.

**What counts as closed.** A domain on clientHold or serverHold, deleted or pending deletion by the end of the period. Domains that came back after the status was lifted (14 of 407) are counted as closed by the first event.

**What is excluded.** The service's second stream — fake car dealers, 43 domains — is not included: almost all of them are in .com, and there is no data for other zones there. The breakdown by registrar is not published: the registrar is known for only 15% of closed domains, and samples of 1 to 20 domains are not enough for a ranking.

**What the index does not measure.** It describes how zones react to complaints about scam sites of one subject area over six months. It does not predict the fate of a specific domain, does not account for differences between registrars within a zone (in .com they are larger than between zones) and does not reflect court and regulator decisions, which have their own timelines.

> [Open the bot](https://t.me/riki_domains_bot?start=i2)

## What this means when choosing a zone

For a project that needs protection against mistaken and malicious complaints, the index is one criterion alongside price, registry rules and the owner-data requirements. At Riki Domains the zones with slow and medium reaction in this table are sold on the Titan plan: [.at](https://rikidomains.at/en/tld/at/) and [.to](https://rikidomains.at/en/tld/to/) are registered by a member of staff in the service's name, with the customer's own nameservers required. [.com](https://rikidomains.at/en/tld/com/) and [.pro](https://rikidomains.at/en/tld/pro/) are available on Standard; [.co.com](https://rikidomains.at/en/tld/co-com/) is on Titan but reacts fast — worth knowing before you buy.

For a service that removes scam sites the index works the other way round: the zones at the bottom of the table are where the effort pays off within days, the zones at the top are where you need a time buffer and parallel channels.

## Updates

The index is recalculated with every new export of the service log; the version and the data period are stated in the header and in the CSV. When using the table, cite the source: Riki Domains Domain Zone Resilience Index, version 2026-10.

| Version | Data period | Domains | Zones in table | What changed |
|---|---|---:|---:|---|
| 2026-10 | 7 May – 17 Oct 2026 | 827 | 14 | first publication |

## FAQ

**What does the resilience score mean?**

A number from 0 to 100: how slowly and how rarely a zone closes domains after complaints. 74 for .at means most domains in the sample stayed up, and those that were closed lasted almost two months on average. 8 for .sbs means almost all were closed within two or three days.

**Is a high score good or bad?**

It depends on who you are. For a legitimate owner a high score means a mistaken or malicious complaint will not take the domain down in a day and there is time to respond. For someone trying to get a scam site closed, a high score means long correspondence and the need to involve hosting and payment providers.

**Where does the data come from?**

From the log of the Riki Domains scam-site removal service: 827 crypto-phishing domains taken into work between 7 May and 17 October 2026, 76,473 complaints sent. The TLD is known for every domain, so the breakdown by zone is complete.

**Why is my zone not in the table?**

The index includes zones with at least five domains in the sample; with fewer than ten the score is marked as preliminary. Zones that never appeared in the service log cannot be scored — the index is updated with every new export.

**Can I use this data?**

Yes, the table is available as CSV. When publishing, cite the source: Riki Domains Domain Zone Resilience Index, version 2026-10.