Cloudflare Radar Domain Rankings is a DNS-based ranking of popular pay-level domains, built from queries to 1.1.1.1. It is free, requires an API token, and has been a default input of Tranco since 1 August 2023. This page is the construction and API note that Website selection points at. It is not a second copy of that page, and it is not a catalogue of the rest of Radar (outages, BGP, TLS adoption, content categories).

• Here: how Domain Rankings is built, which buckets exist, how the free API actually behaves, and what to put in a methods section.
• Website selection: why you would pick Radar rather than CrUX or Umbrella, and the DNS-list caveats that apply in full.
• Tranco: how Tranco turns those buckets into a virtual rank (geometric mean of the bounds) and mixes them with four other providers.
• Sampling and Longitudinal: drawing from a pinned file, and why a 2022 Tranco list and a 2024 Tranco list are different instruments partly because Radar joined the default set.

• Cloudflare's own launch post, 30 September 2022 [3Martinho, Celso; Zejnilovic, Sabina (2022): "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings". Cloudflare Blog. Published 2022-09-30 (Link)] — two models (head vs tail), popularity as estimated user-population size rather than query volume, and the bucket sizes. Read it for the instrument, not for today's dashboard chrome.
• The current Domain Rankings API docs — token, /radar/ranking/top, /radar/datasets/ranking_top_<n>. Checked 2026-08-27.
• [4Galloway, Tillson; Karakolios, Kleanthis; Ma, Zane; Perdisci, Roberto; Keromytis, Angelos D.; Antonakakis, Manos (2024): "Practical Attacks Against DNS Reputation Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] — IEEE S&P 2024. A $10/month VPN was enough to push a name into Radar's top 100k bucket and, through it, into Tranco. Current, and the reason a DNS ranking is not hard to game just because Alexa is gone.
• [5Ruth, Kimberly; Kumar, Deepak; Wang, Brandon; Valenta, Luke; Durumeric, Zakir (2022): "Toppling Top Lists: Evaluating the Accuracy of Popular Website Lists", in: Proceedings of the 22nd ACM Internet Measurement Conference, pp. 374–387. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] — IMC 2022, before Radar Rankings existed. Their ground truth is Cloudflare's server-side HTTP request logs (CDN hits), not 1.1.1.1 resolver traffic. They found CrUX closest to those logs. Domain Rankings is a different Cloudflare product — DNS to 1.1.1.1, a population-size model — and did not exist in February 2022. Do not cite Ruth as a Radar-versus-CrUX accuracy number.

Queried from the public dashboard on 2026-08-27 (the HTML app is 403 to curl; Playwright rendered it), worldwide, “Last 7 days” for the page chrome, Updated: Aug 27, 2026:

The latest Tranco daily list available that day (id 46W9X, generated 2026-08-26; the dated lookup for 2026-08-27 was still 404) started google.com, cloudflare.com, gstatic.com, facebook.com, microsoft.com. These are not prefixes of each other. Radar is a 1.1.1.1 view; it keeps CDN and API hostnames that a page-load ranking down-weights.

A second ranked table on the same dashboard is Top 100 Internet services (Google, Facebook, Apple, Microsoft, Instagram, …). That is not a domain list. Downloading it will not give you something you can crawl.

The dashboard itself warns that the top 100 and the trending lists “include domains with organic activity as well as domains with emerging malicious behavior.”¹⁾ Trending lists (TRENDING_RISE, TRENDING_STEADY) are a third ranking type on /radar/ranking/top. They are not a sampling frame.

Domain Rankings launched on 30 September 2022 [3Martinho, Celso; Zejnilovic, Sabina (2022): "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings". Cloudflare Blog. Published 2022-09-30 (Link)]. Tranco's methodology page dates the list to 26 September 2022. The input is aggregated, anonymised DNS to 1.1.1.1, not HTTP hits on Cloudflare-operated websites. (HTTP traffic powers other Radar products. Mixing the two is how a methods section becomes un-reproducible.) Rows are pay-level domains. Cloudflare boils names to the registrable domain, with a short exception list for .co.uk-style third-level registrations [3Martinho, Celso; Zejnilovic, Sabina (2022): "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings". Cloudflare Blog. Published 2022-09-30 (Link)].

Popularity is not query volume. The launch post's metric is “the estimated relative size of the user population that accesses a domain over some period of time”, using a bot-filtered proxy that is not a unique-user count [3Martinho, Celso; Zejnilovic, Sabina (2022): "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings". Cloudflare Blog. Published 2022-09-30 (Link)]. One model, trained on the head, produces the ordered top 100. A second model, trained on a broader population with fewer features, produces a top million which is then cut into unordered buckets. The buckets exist because the tail of a top list is not a total order worth publishing — Scheitle et al. and Ruth et al. already said this; Cloudflare agreed and refused to fake ranks past 100.

Current listings, from the API docs (fetched 2026-08-27):

The top-100 file is a prefix of nothing except itself. The top-1,000 bucket contains the top 100, but you cannot recover their order from the bucket file. Tranco, needing a number to feed Dowdall, replaces each bucket with the geometric mean of its bounds.²⁾ That is Tranco's conversion, not Cloudflare's.

Licences, from Radar's own About page (rendered 2026-08-27): graphs and images on radar.cloudflare.com are CC BY 4.0; API data and direct downloads are CC BY-NC 4.0. If you ship the default Tranco list as part of a product, Radar's clause is the one that bites — see Tranco. Academic measurement with attribution is the intended use.

Galloway et al. generated names, queried them through a $10/month VPN, and watched three lists [4Galloway, Tillson; Karakolios, Kleanthis; Ma, Zane; Perdisci, Roberto; Keromytis, Angelos D.; Antonakakis, Manos (2024): "Practical Attacks Against DNS Reputation Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]. On Radar, which publishes 2LDs, they “consistently achieved a ranking in the top 100,000”. That is a bucket, not rank 1. Downstream, Tranco (which was already averaging Radar) put the same names at rank 1 million within 10 days and inside 500k within 14 days. The paper's headline “$10 … in just two weeks” is about that campaign, including Umbrella. Radar was the easy 2LD list in the middle, not a hardened replacement for Alexa.

If your study needs a list an adversary cannot cheaply join, Radar-alone is the wrong instrument. Tranco's default list has included Radar since 1 August 2023, so Galloway's names reached Tranco through that input [4Galloway, Tillson; Karakolios, Kleanthis; Ma, Zane; Perdisci, Roberto; Keromytis, Angelos D.; Antonakakis, Manos (2024): "Practical Attacks Against DNS Reputation Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]. CrUX is the page-load ranking Ruth et al. found closest to Cloudflare's HTTP logs in 2022 [5Ruth, Kimberly; Kumar, Deepak; Wang, Brandon; Valenta, Luke; Durumeric, Zakir (2022): "Toppling Top Lists: Evaluating the Accuracy of Popular Website Lists", in: Proceedings of the 22nd ACM Internet Measurement Conference, pp. 374–387. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)]; Galloway et al. did not evaluate it. The cost of faking CrUX is argued on Website selection, not measured in either paper.

The API is free on every Cloudflare plan and refuses unauthenticated calls. On 2026-08-27, GET /client/v4/radar/ranking/top?limit=5 without a token returned HTTP 400, success: false, error code 9106, “Missing X-Auth-Key, X-Auth-Email or Authorization headers”. Create a Custom Token with Account → Radar → Read (first-request docs, fetched 2026-08-27).

There is no Tranco-style permanent id. A date plus a listing (ordered top 100 vs bucket size n) plus the SHA-256 of the saved CSV is the pin. The API response is a different object (JSON for /ranking/top; a domain list, sometimes with a header, for a bucket) — hash it too if you keep it. The dashboard CSV download is the same CC BY-NC 4.0 data; the graphs next to it are CC BY 4.0. Do not confuse them.

Endpoints this page uses:

limit greater than 100 on /ranking/top is not “give me the top 200 ordered”. The ordered object stops at 100. The script below refuses --top 200 instead of forwarding it.

The script talks to the same API the docs describe, writes a manifest, and prints a methods sentence. Without CLOUDFLARE_API_TOKEN it exits 2. That is the path this sitting can run:

$ python3 pin_radar.py --top 20
set CLOUDFLARE_API_TOKEN to a Cloudflare API token with Account > Radar, Read. https://developers.cloudflare.com/radar/get-started/first-request/
$ echo $?
2
$ python3 pin_radar.py --top 200
--top 200 is outside 1–100; the ordered list stops at 100. Use --bucket for a larger unordered prefix.
$ echo $?
2

pin_radar.py

#!/usr/bin/env python3
"""Pin a Cloudflare Radar Domain Rankings snapshot.
 
Talks to the Radar API (token required). Writes a CSV and a manifest whose
`cite` line is the methods sentence. Hashes the API response and the saved
CSV separately — they are not the same bytes. It does not draw a sample.
 
    export CLOUDFLARE_API_TOKEN=...
    python3 pin_radar.py
    python3 pin_radar.py --top 100
    python3 pin_radar.py --top 100 --location US
    python3 pin_radar.py --bucket 1000
    python3 pin_radar.py --bucket 1000000 --date 2026-08-20
    python3 pin_radar.py --domain google.com
 
`--top` is the ordered list and stops at 100. `--bucket` is an unordered
prefix (200 … 1,000,000). `--domain` looks up one name's rank or bucket.
Those three are mutually exclusive. `--location` is only valid with `--top`.
"""
from __future__ import annotations
 
import argparse
import csv
import hashlib
import json
import os
import sys
import urllib.error
import urllib.parse
import urllib.request
from datetime import datetime, timezone
 
UA = "measuretheweb-pin-radar/1.0"
API = "https://api.cloudflare.com/client/v4/radar"
BUCKETS = (
    200,
    500,
    1000,
    2000,
    5000,
    10000,
    20000,
    50000,
    100000,
    200000,
    500000,
    1000000,
)
PERM = "Account > Radar, Read. https://developers.cloudflare.com/radar/get-started/first-request/"
 
 
def token() -> str:
    if "CLOUDFLARE_API_TOKEN" not in os.environ:
        print(
            "set CLOUDFLARE_API_TOKEN to a Cloudflare API token with "
            f"{PERM}",
            file=sys.stderr,
        )
        raise SystemExit(2)
    value = os.environ["CLOUDFLARE_API_TOKEN"]
    if value == "":
        print("CLOUDFLARE_API_TOKEN is set but empty", file=sys.stderr)
        raise SystemExit(2)
    return value
 
 
def api_get(path: str, query: dict[str, str], tok: str) -> tuple[bytes, int]:
    qs = urllib.parse.urlencode(query)
    url = f"{API}{path}"
    if qs:
        url = f"{url}?{qs}"
    req = urllib.request.Request(
        url,
        headers={
            "User-Agent": UA,
            "Authorization": f"Bearer {tok}",
        },
    )
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            return resp.read(), resp.status
    except urllib.error.HTTPError as e:
        body = e.read()
        print(f"{url}: HTTP {e.code} {body[:300]!r}", file=sys.stderr)
        raise SystemExit(1)
 
 
def parse_json(raw: bytes, url: str) -> dict:
    payload = json.loads(raw.decode())
    if payload["success"] is not True:
        print(f"{url}: success!=true {payload}", file=sys.stderr)
        raise SystemExit(1)
    return payload["result"]
 
 
def write_csv(path: str, rows: list[list[str]]) -> None:
    with open(path, "w", encoding="utf-8", newline="") as handle:
        csv.writer(handle).writerows(rows)
 
 
def sha256_bytes(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()
 
 
def sha256_file(path: str) -> str:
    with open(path, "rb") as handle:
        return hashlib.sha256(handle.read()).hexdigest()
 
 
def main() -> int:
    ap = argparse.ArgumentParser(
        description=__doc__,
        formatter_class=argparse.RawDescriptionHelpFormatter,
    )
    ap.add_argument("--top", type=int, default=None, help="ordered prefix, 1–100")
    ap.add_argument("--bucket", type=int, default=None, help="unordered bucket size")
    ap.add_argument("--domain", default=None, help="look up one domain")
    ap.add_argument("--location", default=None, help="alpha-2 country code, only with --top")
    ap.add_argument("--date", default=None, help="YYYY-MM-DD; latest if omitted")
    ap.add_argument("--out", default="pin_radar.manifest.json")
    args = ap.parse_args()
 
    modes = [x for x in (args.top, args.bucket, args.domain) if x is not None]
    if len(modes) > 1:
        print("give one of --top, --bucket, --domain", file=sys.stderr)
        return 2
    if args.location is not None and args.top is None:
        print("--location is only valid with --top", file=sys.stderr)
        return 2
    if args.top is None and args.bucket is None and args.domain is None:
        args.top = 100
    if args.top is not None and (args.top < 1 or args.top > 100):
        print(
            f"--top {args.top} is outside 1–100; the ordered list stops at 100. "
            "Use --bucket for a larger unordered prefix.",
            file=sys.stderr,
        )
        return 2
    if args.bucket is not None and args.bucket not in BUCKETS:
        print(
            f"--bucket {args.bucket} is not a published size. "
            f"Allowed: {', '.join(str(b) for b in BUCKETS)}",
            file=sys.stderr,
        )
        return 2
 
    tok = token()
    fetched_at = datetime.now(timezone.utc).isoformat()
    query: dict[str, str] = {}
    if args.date is not None:
        query["date"] = args.date
 
    if args.top is not None:
        query["limit"] = str(args.top)
        query["rankingType"] = "POPULAR"
        if args.location is not None:
            query["location"] = args.location
        path = "/ranking/top"
        raw, _status = api_get(path, query, tok)
        result = parse_json(raw, path)
        rows_out = [["rank", "domain"]]
        for item in result["top_0"]:
            rows_out.append([str(item["rank"]), item["domain"]])
        if len(rows_out) - 1 != args.top:
            print(
                f"expected {args.top} ranked rows, got {len(rows_out) - 1}",
                file=sys.stderr,
            )
            return 1
        loc = args.location if args.location is not None else "WW"
        csv_path = f"radar_top{args.top}_{loc}.csv"
        write_csv(csv_path, rows_out)
        response_digest = sha256_bytes(raw)
        csv_digest = sha256_file(csv_path)
        date_note = args.date if args.date is not None else "latest"
        cite = (
            f"We used Cloudflare Radar Domain Rankings ordered top {args.top} "
            f"(location {loc}, date {date_note}), "
            f"GET /radar/ranking/top, "
            f"response SHA-256 {response_digest}, CSV SHA-256 {csv_digest}."
        )
        manifest = {
            "source": "cloudflare-radar",
            "mode": "top",
            "fetched_at": fetched_at,
            "path": path,
            "query": query,
            "location": loc,
            "date": date_note,
            "rows": args.top,
            "head": rows_out[1:6],
            "response_sha256": response_digest,
            "csv_sha256": csv_digest,
            "csv": csv_path,
            "meta": result["meta"],
            "cite": cite,
        }
 
    elif args.bucket is not None:
        alias = f"ranking_top_{args.bucket}"
        path = f"/datasets/{alias}"
        raw, _status = api_get(path, query, tok)
        text = raw.decode()
        domains = [ln.strip() for ln in text.splitlines() if ln.strip()]
        if domains and domains[0].lower() == "domain":
            domains = domains[1:]
        if len(domains) != args.bucket:
            print(
                f"expected {args.bucket} domain rows from {alias}, got {len(domains)}",
                file=sys.stderr,
            )
            return 1
        csv_path = f"radar_bucket_{args.bucket}.csv"
        write_csv(csv_path, [["domain"], *[[d] for d in domains]])
        response_digest = sha256_bytes(raw)
        csv_digest = sha256_file(csv_path)
        date_note = args.date if args.date is not None else "latest"
        cite = (
            f"We used the Cloudflare Radar Domain Rankings unordered top-{args.bucket} "
            f"bucket (date {date_note}), GET /radar/datasets/{alias}, "
            f"response SHA-256 {response_digest}, CSV SHA-256 {csv_digest}."
        )
        manifest = {
            "source": "cloudflare-radar",
            "mode": "bucket",
            "fetched_at": fetched_at,
            "path": path,
            "query": query,
            "alias": alias,
            "date": date_note,
            "rows": len(domains),
            "head": domains[:5],
            "response_sha256": response_digest,
            "csv_sha256": csv_digest,
            "csv": csv_path,
            "cite": cite,
        }
 
    else:
        path = f"/ranking/domain/{urllib.parse.quote(args.domain)}"
        raw, _status = api_get(path, query, tok)
        result = parse_json(raw, path)
        details = result["details_0"]
        digest = sha256_bytes(raw)
        date_note = args.date if args.date is not None else "latest"
        cite = (
            f"Cloudflare Radar Domain Rankings lookup of {args.domain} "
            f"(date {date_note}): {json.dumps(details, sort_keys=True)}."
        )
        csv_path = None
        manifest = {
            "source": "cloudflare-radar",
            "mode": "domain",
            "fetched_at": fetched_at,
            "path": path,
            "query": query,
            "domain": args.domain,
            "date": date_note,
            "details": details,
            "bytes_sha256": digest,
            "cite": cite,
        }
 
    with open(args.out, "w", encoding="utf-8") as handle:
        json.dump(manifest, handle, indent=2)
        handle.write("\n")
    print(json.dumps(manifest, indent=2))
    wrote = args.out if csv_path is None else f"{args.out} and {csv_path}"
    print(f"wrote {wrote}", file=sys.stderr)
    return 0
 
 
if __name__ == "__main__":
    raise SystemExit(main())

“Cloudflare Radar” in this seven-venue corpus is mostly not Domain Rankings. A full-text sweep for cloudflare next to radar, unioned with the schema's sourceList and tools[] fields, hits 32 papers. A hand verdict on each one:

Nine papers used Domain Rankings (sample, lookup, ingest, or attack): 0.2% of the 5,859-paper corpus, 3 of 1,120 crawling papers. First use is 2024. The 2025–2026 rows are provisional.

The schema's sourceList is the wrong query on its own. It fires on 6 papers; 2 of those 6 used Radar for BGP/RPKI, not rankings, and 5 of the 9 ranking-used papers have no sourceList hit. A ranking list is usually not recorded as a tool either (5 tools[] hits, one of them a column-spliced “Cloudflare's Radar API” for categories). Homographs the regex does not match — Tracker Radar, DappRadar, Weather Radar, Qrator.Radar — are a different problem; they are 0 overlap with this union.

The six papers this page cites for a Domain Rankings use:

The other three ranking-used papers (not cited above): Internet Yellow Pages ingested radar/ranking/top and radar/datasets (IMC 2024); OpenINTEL added the Radar zone in October 2022 (IMC 2025 sibling-prefixes); a USENIX 2025 CAPTCHA paper looked up popularity alongside Tranco.

1. Domain Rankings, not “Cloudflare Radar”. The same brand also publishes outage detectors and TLS pie charts.
2. The date (and timezone) of the snapshot, the listing (ordered top 100 vs bucket size n), and the location if you used a country top 100.
3. The SHA-256 of the saved CSV, or the file in the artefact. Hash the API response separately: it is not the same bytes. There is no permanent id to cite instead.
4. That the tail is unordered, if you used a bucket.
5. The licence: CC BY-NC 4.0 for the data.
6. If Radar reached you through Tranco, cite the Tranco list id and say Radar was in that configuration. See Tranco.

• Website selection — which ranking to pick; DNS-list caveats.
• Tranco — Radar as of 1 August 2023 is one of five default providers.
• CrUX — the page-load ranking. Not yet written.
• Sampling / Longitudinal — pinning and comparability.
• Corpus — seven-venue scope and the 2025–2026 edge.

Queries, the unedited report, the role table, quote checks, and every rejected source are on cloudflare_radar.

Corpus figures come from scripts/report_radar.mjs against data/extract/run1 (5,859 papers). The page population is a hand map over a 32-paper union, not a sourceList regex. Live API facts were fetched 2026-08-27; the dashboard top 10 was read out of a Playwright render because radar.cloudflare.com returns 403 to curl. This sitting had no CLOUDFLARE_API_TOKEN, so the authenticated download path is specified and the missing-token path is the one that was executed. 2025–2026 rows are starred because those venue-years are incomplete by construction.

[1]

Beugin, Yohan; McDaniel, Patrick (2024): "Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[2]

Wickramasinghe, Nimesha; Shaghaghi, Arash; Tsudik, Gene; Jha, Sanjay K. (2025): "SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[3]

Martinho, Celso; Zejnilovic, Sabina (2022): "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings". Cloudflare Blog. Published 2022-09-30 (Link)

[4]

Galloway, Tillson; Karakolios, Kleanthis; Ma, Zane; Perdisci, Roberto; Keromytis, Angelos D.; Antonakakis, Manos (2024): "Practical Attacks Against DNS Reputation Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Ruth, Kimberly; Kumar, Deepak; Wang, Brandon; Valenta, Luke; Durumeric, Zakir (2022): "Toppling Top Lists: Evaluating the Accuracy of Popular Website Lists", in: Proceedings of the 22nd ACM Internet Measurement Conference, pp. 374–387. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[6]

Ahmad, Sumeer; Polychronakis, Michalis; Benson, Theophilus A.; Hoang, Nguyen Phong (2026): "More Space, Less Privacy? Measuring the Effectiveness of IP-based Website Fingerprinting in IPv6", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[7]

Misell, Q.; Steurer, Florian; Zirngibl, Johannes; Feldmann, Anja; Fiebig, Tobias (2025): "Measuring the deployment of DNSSEC Bootstrapping Using Authenticated Signals", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[8]

Wu, Wenhao; Wang, Zhaohua; Li, Zihan; Li, Qinxin; Xia, Yiming; Gao, Chuan; Zhang, Guangxing; Li, Zhenyu (2026): "Tracking the Stray Sheep: Understanding DNS Response Manipulation in the Wild", in: Proceedings of the ACM Web Conference. (DOI)