Top 5000 not always relevant for smaller top-level domains

[rogersen]

I'm from Norway and thus visit many Norwegian sites ending with .no. This top-level domain is highly vetted, but many of the domains are still flagged as "suspicious" since Norway is a small country with an unusual language. Maybe you could flag suspicious domains per top-level domain? Like exclude the top 1000 .no-domains (and other country domains) in addition to the 5k domains?

I guess each top-level domain should be tuned to find out what is "suspicious".. Like the .top and .online domains should be flagged as suspicious at maybe below top 50? ;) Many top-level domains are very suspicious in themselves..

[livvielin]

Thanks for the suggestion! We'll need to look into how much of a maintenance burden it would be to flag domains at the tld level, but I think some amount of fleshing out the top sites list with popular domains by geo could be doable.

[jonathandl2]

Even Alexa itself, as well as the blog where Google announced the Suspicious Site Reporter, flag as orange due to not being in the top 5k, not to mention sites of regional or local significance such as wmata.com or montgomerycountymd.gov. And if a site such as cisco.com is actually in the top 5k but is slow to load (due to a firewall rule for example), the flag starts as orange and later turns green. (If the firewall were blocking the plug-in from working at all I wouldn't expect this behavior.)

[erlendorf]

A simple solution that accomplishes the same goal would be to expand to top 50k. Only downside I could see would be if there were dubious sites in the top 50k. So if that's the case, maybe use top 40k then.

[jonathandl2]

In my experience some top-level domains are nearly always malicious. Example: .xyz. By contrast, .gov domains are hardly if ever malicious.