August 2026: Domain Activity Highlights
WhoisXML API analyzed 11.6+ million domains registered between 1 and 31 August 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number rose by 4.4% from 11.1+ million NRDs last month.
We also determined the top TLD extensions used by 3.0+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in August 2026. This number increased by 51.7% from the previous month.
Next, we studied the top TLD extensions of 1.097+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which rose by 0.3% from 1.094+ million in July.
Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.
Zooming in on the August 2026 NRDs
TLD Distribution
Out of the 11.6+ million domains registered in August 2026, 79.3%, down from 80.1% last month, used gTLD extensions. The remaining 20.7%, up from 19.9%, meanwhile, used ccTLD extensions.
The top 5 TLDs of the August 2026 NRDs were the same five extensions we saw in July, with only one change in the pecking order. The .cn ccTLD climbed from fifth to fourth place, trading spots with .shop.
The .xyz gTLD remained in second place while posting the steepest climb in the group from 760,682 registrations in July to 1.1+ million this month.
The .cn ccTLD recovery, meanwhile, could be tied to a return toward the elevated registration levels seen in June after July’s pullback. That said, the .cn and .shop swap may say as much about .shop’s contraction—its volume fell from 384,439 to 301,220—as about .cn’s own rebound.
Here is a MoM comparison with ranking changes for the top 5 TLD extensions of the August 2026 NRDs.
| AUGUST 2026 TOP TLD | AUGUST 2026 TLD VOLUME | JULY 2026 TLD VOLUME | RANKING CHANGE FROM JULY TO AUGUST 2026 |
| .com | 4,175,239 | 4,185,494 | → (Unchanged) |
| .xyz | 1,192,402 | 760,682 | → (Unchanged) |
| .top | 486,953 | 417,301 | → (Unchanged) |
| .cn | 481,553 | 381,621 | ↑ from 5 to 4 |
| .shop | 301,220 | 384,439 | ↓ from 4 to 5 |
Overall, the top 5 NRD TLD volume rose by 8.3% from 6.1+ million in July to 6.6+ million in August 2026.
We then analyzed the August 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.
The top 5 gTLDs for August 2026 were identical to July’s, down to their ranking. Their volumes moved in different directions, though, with .xyz and .top growing while .com, .shop, and .org contracting.
Here is a MoM comparison and ranking changes for the top 5 gTLD extensions used by this month’s NRDs.
| AUGUST 2026 TOP gTLD | AUGUST 2026 gTLD VOLUME | JULY 2026 gTLD VOLUME | RANKING CHANGE FROM JULY TO AUGUST 2026 |
| .com | 4,175,239 | 4,185,494 | → (Unchanged) |
| .xyz | 1,192,402 | 760,682 | → (Unchanged) |
| .top | 486,953 | 417,301 | → (Unchanged) |
| .shop | 301,220 | 384,439 | → (Unchanged) |
| .org | 261,211 | 267,682 | → (Unchanged) |
Overall, the top 5 NRD gTLD volume rose by 6.7% from 6.0+ million in July to 6.4+ million in August 2026.
On the ccTLD front, the top 5 stayed the same in membership although .ru and .br exchanged places at the bottom of the list. The swap may owe as much to .br’s volume decline from 156,272 in July to 146,640 this month as to .ru’s growth over the same period. Meanwhile, .cn reversed last month’s trend—its volume rose markedly, lifting its share of the top 5 ccTLDs from 35.4% in July to 40.7% this month—making the list more concentrated once again.
Here is a MoM comparison with ranking changes for the top 5 ccTLD extensions of the August 2026 NRDs.
| AUGUST 2026 TOP ccTLD | AUGUST 2026 ccTLD VOLUME | JULY 2026 ccTLD VOLUME | RANKING CHANGE FROM JULY TO AUGUST 2026 |
| .cn | 481,553 | 381,621 | → (Unchanged) |
| .uk | 201,442 | 197,253 | → (Unchanged) |
| .cc | 180,805 | 191,317 | → (Unchanged) |
| .ru | 172,356 | 152,353 | ↑ from 5 to 4 |
| .br | 146,640 | 156,272 | ↓ from 4 to 5 |
Overall, the top 5 NRD ccTLD volume rose by 9.6% from 1.0+ million in July to 1.1+ million in August 2026.
Registrar Distribution
This month’s top 5 registrar list saw no change in membership but the ranking underwent a major reshuffle. GMO Internet Group vaulted from fourth to first place after its volume grew from 792,961 in July to 1.2+ million this month, pushing GoDaddy, Namecheap, and Dynadot each down one rung. Spaceship held on to fifth place.
GMO Internet Group’s surge may reflect its aggressive first-year pricing—the registrar has been known to offer deeply discounted or even free first-year registrations for extensions like .xyz, .com, and .net, which could also help explain the .xyz volume spike noted earlier. The volume contractions GoDaddy and Dynadot posted may have amplified the ranking movement.
Here is a MoM comparison with ranking changes for the top 5 NRD registrars.
| AUGUST 2026 TOP REGISTRAR | AUGUST 2026 REGISTRAR VOLUME | JULY 2026 REGISTRAR VOLUME | RANKING CHANGE FROM JULY TO AUGUST 2026 |
| GMO Internet Group | 1,254,504 | 792,961 | ↑ from 4 to 1 |
| GoDaddy | 1,226,147 | 1,303,432 | ↓ from 1 to 2 |
| Namecheap | 1,145,653 | 1,139,846 | ↓ from 2 to 3 |
| Dynadot | 951,423 | 1,017,561 | ↓ from 3 to 4 |
| Spaceship | 652,413 | 651,520 | → (Unchanged) |
Overall, the top 5 NRD registrar volume rose by 6.6% from 4.9+ million in July to 5.2+ million in August 2026.
A Closer Look at the Domains Likely Registered with Malicious Intent in August 2026
TLD Distribution
Next, we sought to take a closer look at the domains likely registered with malicious intent in August 2026. We determined that 3.0+ million such domains appeared on the First Watch Malicious Domains Data Feed, up by 51.7% from 1.9+ million last month.
Overall, 26.0% of August 2026 NRDs were likely registered with malicious intent, up from 17.8% in July. The increase was mainly driven by the 51.7% rise in likely malicious domains compared with a 4.4% increase in the overall NRD volume.
The top 5 TLDs of these domains kept the same membership this month even though .xyz and .top traded places. The .xyz gTLD climbed from third to second place while .top slipped from the second to third post.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains likely registered with malicious intent.
| AUGUST 2026 TOP FIRST WATCH TLD | AUGUST 2026 FIRST WATCH TLD VOLUME | JULY 2026 FIRST WATCH TLD VOLUME | RANKING CHANGE FROM JULY TO AUGUST 2026 |
| .com | 739,494 | 516,900 | → (Unchanged) |
| .xyz | 456,334 | 191,670 | ↑ from 3 to 2 |
| .top | 332,816 | 194,175 | ↓ from 2 to 3 |
| .cn | 215,760 | 142,506 | → (Unchanged) |
| .online | 121,366 | 86,126 | → (Unchanged) |
Overall, the number of domains likely registered with malicious intent sporting the top 5 TLDs rose by 64.9% from 1.1+ million in July to 1.8+ million in August 2026.
How Many NRDs Were Likely Registered with Malicious Intent?
Among the NRDs sporting the top 5 TLDs, 26.8% were likely registered with malicious intent.
Cybersecurity through the DNS Lens
TLD Distribution
The top 5 TLDs of the confirmed malicious domains detected in August 2026 stayed the same even in terms of ranking compared with July. Legacy gTLDs continued to dominate, with .net, .biz, and .info posting slight gains while .com and .org recorded marginal declines.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the confirmed malicious domains.
| AUGUST 2026 TOP DOMAIN IoC TLD | AUGUST 2026 DOMAIN IoC TLD VOLUME | JULY 2026 DOMAIN IoC TLD VOLUME | RANKING CHANGE FROM JULY TO AUGUST 2026 |
| .com | 192,831 | 195,051 | → (Unchanged) |
| .org | 168,844 | 169,719 | → (Unchanged) |
| .net | 162,738 | 160,730 | → (Unchanged) |
| .biz | 111,599 | 111,178 | → (Unchanged) |
| .info | 53,470 | 53,400 | → (Unchanged) |
Overall, the number of confirmed malicious domains sporting the top 5 TLDs decreased marginally by 0.1% from 690,078 in July to 689,482 this month.
Threat Reports
Take a quick look at the threat reports we published in August 2026 below.
- Massive Photo ZIP Campaign Targets Booking.com Partner and Other Hotels across Japan and Europe: We examined a Microsoft-uncovered multistage intrusion campaign targeting hospitality organizations across Europe and Asia, particularly Japan, using photo-themed ZIP archives, obfuscated PowerShell, a Node.js-based implant, and abused legitimate services. WhoisXML API analyzed 77 of the 78 published network IoCs after excluding one legitimately owned domain, uncovering additional connected infrastructure components.
- 5 of the Biggest Cyber Attacks in 2026 So Far: DNS Deep Dive: We zoomed in on five of CRN’s biggest cyber attacks of 2026 so far—zero-day exploitation campaigns against Cisco Catalyst SD-WAN and Ivanti EPMM, the Stryker wiper attack, and ShinyHunters’ Instructure Canvas and Oracle PeopleSoft campaigns against the education sector. WhoisXML API used DNS intelligence to surface connected infrastructure and artifacts.
- A DNS Infrastructure Analysis of a Microsoft 365 Device Code Phishing Campaign: We investigated a ReversingLabs-uncovered phishing campaign abusing Microsoft 365’s legitimate OAuth 2.0 Device Authorization Grant flow, whose kit persuades victims to enter real device codes on Microsoft’s genuine sign-in page, authorizing attacker-controlled devices without password theft. WhoisXML API analyzed the published network IoCs to map connected infrastructure worth monitoring.
You can find more reports created in the past months here.
Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.