A Cisco Umbrella rank is a domain’s position in the Cisco Umbrella Popularity List, a free daily ranking of the top one million most queried domains seen across Umbrella’s global DNS network. A rank of 1 is the most popular domain. Researchers, security teams and SEO tools use it as a measure of how widely a domain is used on the internet.
How the rank is calculated
- Data source: passive DNS data from Umbrella’s recursive resolvers, which handle requests from millions of users worldwide.
- Metric: the number of unique client IP addresses querying a domain, relative to all requests to all domains, rather than raw query volume.
- Normalisation: Cisco smooths the data to reduce bias from its sampling.
- Frequency: a new list is published every day, and historical daily snapshots are available.
What the list includes
| File | Contents | Format |
|---|---|---|
| top-1m.csv.zip | Top one million domains, including subdomains | rank,domain |
| top-1m-TLD.csv.zip | Top-level domains ranked by popularity | rank,tld |
| top-1m-YYYY-MM-DD.csv.zip | Historical snapshot for a given date | rank,domain |
The files are hosted publicly on Amazon S3, and the Investigate API offers programmatic access to the top-ranked domains.
How it differs from web traffic rankings
Unlike web-traffic rankings such as the old Alexa list, the Umbrella list reflects all DNS activity, not only people using browsers. That means:
- Infrastructure domains rank highly, including CDNs, software update servers, telemetry and ad networks.
- Subdomains appear separately, so several hostnames from one company can occupy many places.
- Machine-generated traffic from apps, IoT devices and background services counts as much as human browsing.
Common uses and caveats
| Use | Caveat |
|---|---|
| Building allow lists or reducing false positives in detection rules | Popular does not mean safe. Compromised or abused domains can still rank highly. |
| Internet measurement and academic research | The data reflects Umbrella’s user base, which skews towards businesses. |
| Rough estimates of a domain’s reach | Ranks below the top few thousand can move sharply from day to day. |
Treat the Umbrella rank as one signal among many, not as a trust score or an exact measure of human visitors.