October 2026: Domain Activity Highlights
WhoisXML API analyzed 14.0M+ domains registered between 1 and 31 October 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number rose by 13.7% from 12.3M+ NRDs last month.
We also determined the top TLD extensions used by 2.9M+ domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in October 2026. This number decreased by 8.6% from 3.2M+ in September.
Next, we studied the top TLD extensions of 1.3M+ confirmed malicious domains from the Threat Intelligence Data Feeds this month, which rose by 23.6% from 1.1M+ in September.
Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.
Zooming in on the October 2026 NRDs
TLD Distribution
Out of the 14.0M+ domains registered in October 2026, 79.4%, up from 77.1% last month, used gTLD extensions. The remaining 20.6%, down from 22.9%, meanwhile, used ccTLD extensions.
The top 5 TLDs of the October 2026 NRDs were the same five extensions in the same order as in September. Their volumes moved in different directions, though, with .com, .xyz, .top, and .shop growing, while .cn posted a decline.
The .xyz extension stood out with a 53.4% jump from 1.4M+ to 2.1M+ NRDs, lifting its share of the top 5 from 19.5% to 25.6%. That surge alone accounted for 61.8% of the growth of the top 5 NRD TLDs this month.
The .cn ccTLD, by contrast, fell by 26.7% from 788.0K+ to 577.9K+ NRDs. The drop followed its 63.6% spike in September, which suggests that month’s jump may have been driven by short-term bulk registration activity.
Here is a MoM comparison with ranking changes for the top 5 TLD extensions of the October 2026 NRDs.
| OCTOBER 2026 TOP TLD | OCTOBER 2026 TLD VOLUME | SEPTEMBER 2026 TLD VOLUME | RANKING CHANGE FROM SEPTEMBER TO OCTOBER 2026 |
| .com | 4,879,539 | 4,289,417 | → (Unchanged) |
| .xyz | 2,185,017 | 1,424,052 | → (Unchanged) |
| .cn | 577,961 | 788,050 | → (Unchanged) |
| .top | 553,149 | 495,302 | → (Unchanged) |
| .shop | 325,027 | 291,742 | → (Unchanged) |
Overall, the top 5 NRD TLD volume rose by 16.9% from 7.2M+ in September to 8.5M+ in October 2026.
We then analyzed the October 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.
The top 5 gTLDs for October 2026 saw no change in membership or ranking. All five members posted volume increases, ranging from 1.2% for .online to 53.4% for .xyz.
The .xyz extension’s gain of 760.9K+ domains made up 52.6% of the top 5 gTLDs’ total increase, widening its lead over third placer .top from 928.7K+ to 1.6M+ domains.
Here is a MoM comparison and ranking changes for the top 5 gTLD extensions used by this month’s NRDs.
| OCTOBER 2026 TOP gTLD | OCTOBER 2026 gTLD VOLUME | SEPTEMBER 2026 gTLD VOLUME | RANKING CHANGE FROM SEPTEMBER TO OCTOBER 2026 |
| .com | 4,879,539 | 4,289,417 | → (Unchanged) |
| .xyz | 2,185,017 | 1,424,052 | → (Unchanged) |
| .top | 553,149 | 495,302 | → (Unchanged) |
| .shop | 325,027 | 291,742 | → (Unchanged) |
| .online | 282,963 | 279,607 | → (Unchanged) |
Overall, the top 5 NRD gTLD volume rose by 21.3% from 6.7M+ in September to 8.2M+ in October 2026.
On the ccTLD front, the top 5 saw one membership change. The .si extension rocketed from 21st to fourth place, with its volume jumping by 563.7% from 27.8K+ to 184.7K+ NRDs. That pushed .ru down to fifth place and .br out of the top 5 to sixth.
The .si surge may be tied to the U.S. government’s mandate to adopt “super intelligence” (SI) as its term for AI via an executive order, which made Slovenia’s ccTLD a natural fit for SI-related names. A study revealed that only a small share of the new .si names carried explicit AI terms, which could suggest domain investors buying names for resale may have driven much of the demand.
Here is a MoM comparison with ranking changes for the top 5 ccTLD extensions of the October 2026 NRDs.
| OCTOBER 2026 TOP ccTLD | OCTOBER 2026 ccTLD VOLUME | SEPTEMBER 2026 ccTLD VOLUME | RANKING CHANGE FROM SEPTEMBER TO OCTOBER 2026 |
| .cn | 577,961 | 788,050 | → (Unchanged) |
| .uk | 242,569 | 209,246 | → (Unchanged) |
| .cc | 192,133 | 207,557 | → (Unchanged) |
| .si | 184,735 | 27,834 | ↑ from 21 to 4 |
| .ru | 175,280 | 163,273 | ↓ from 4 to 5 |
Overall, the top 5 NRD ccTLD volume fell by 9.5% from 1.5M+ in September to 1.3M+ in October 2026, largely due to the .cn decline.
Registrar Distribution
This month’s top 5 registrar list kept the same members, but Spaceship and Dynadot traded places. GMO Internet Group posted a 55.5% increase, widening its lead over GoDaddy from 135.8K+ to 812.4K+ domains.
Spaceship’s 21.6% growth, meanwhile, lifted it from fifth to fourth place, 62.7K+ domains ahead of Dynadot, which slipped by 2.4%.
Here is a MoM comparison with ranking changes for the top 5 NRD registrars.
| OCTOBER 2026 TOP REGISTRAR | OCTOBER 2026 REGISTRAR VOLUME | SEPTEMBER 2026 REGISTRAR VOLUME | RANKING CHANGE FROM SEPTEMBER TO OCTOBER 2026 |
| GMO Internet Group | 2,208,889 | 1,420,289 | → (Unchanged) |
| GoDaddy | 1,396,412 | 1,284,470 | → (Unchanged) |
| Namecheap | 1,108,062 | 1,125,686 | → (Unchanged) |
| Spaceship | 893,657 | 735,073 | ↑ from 5 to 4 |
| Dynadot | 830,932 | 851,198 | ↓ from 4 to 5 |
Overall, the top 5 NRD registrar volume rose by 18.9% from 5.4M+ in September to 6.4M+ in October 2026.
A Closer Look at the Domains Likely Registered with Malicious Intent in October 2026
TLD Distribution
Next, we sought to take a closer look at the domains likely registered with malicious intent in October 2026. We determined that 2.9M+ such domains appeared on the First Watch Malicious Domains Data Feed, down by 8.6% from 3.2M+ last month.
Overall, 21.3% of the October 2026 NRDs were likely registered with malicious intent, down from 26.6% in September. The First Watch domain volume fell even as the overall NRD count grew by 13.7%.
The top 5 TLDs of these domains saw one membership change. The .shop extension climbed from 15th to fifth place, displacing .online, which slipped to eighth. The .top extension also rose from fourth to second place, pushing .xyz down to fourth.
The .shop volume more than tripled with a 218.3% jump from 39.6K+ to 126.2K+, lifting the share of .shop NRDs that landed on First Watch from 13.6% to 38.8%. The .xyz extension, by contrast, fell by 75.2% from 565.3K+ to 139.9K+, bringing its First Watch ratio down from 39.7% to 6.4%. The .top extension still had the highest First Watch ratio among the top 5 NRD TLDs at 65.1%, up from 63.8%.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains likely registered with malicious intent.
| OCTOBER 2026 TOP FIRST WATCH TLD | OCTOBER 2026 FIRST WATCH TLD VOLUME | SEPTEMBER 2026 FIRST WATCH TLD VOLUME | RANKING CHANGE FROM SEPTEMBER TO OCTOBER 2026 |
| .com | 831,443 | 752,974 | → (Unchanged) |
| .top | 359,965 | 316,106 | ↑ from 4 to 2 |
| .cn | 325,152 | 359,263 | → (Unchanged) |
| .xyz | 139,948 | 565,392 | ↓ from 2 to 4 |
| .shop | 126,234 | 39,663 | ↑ from 15 to 5 |
Overall, the top 5 First Watch TLD volume fell by 16.2% from 2.1M+ in September to 1.7M+ in October 2026.
How Many NRDs Were Likely Registered with Malicious Intent?
Among the NRDs sporting the top 5 TLDs, 20.9% were likely registered with malicious intent.
Cybersecurity through the DNS Lens
TLD Distribution
The top 5 TLDs of the confirmed malicious domains detected in October 2026 stayed the same even in terms of ranking compared with September. All five members posted increases led by .com whose volume rose by 20.8% from 181.3K+ to 219.0K+.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the confirmed malicious domains.
| OCTOBER 2026 TOP DOMAIN IoC TLD | OCTOBER 2026 DOMAIN IoC TLD VOLUME | SEPTEMBER 2026 DOMAIN IoC TLD VOLUME | RANKING CHANGE FROM SEPTEMBER TO OCTOBER 2026 |
| .com | 219,097 | 181,382 | → (Unchanged) |
| .org | 170,915 | 166,521 | → (Unchanged) |
| .net | 164,175 | 158,887 | → (Unchanged) |
| .biz | 111,847 | 109,584 | → (Unchanged) |
| .bazar | 78,648 | 78,547 | → (Unchanged) |
Overall, the number of confirmed malicious domains sporting the top 5 TLDs increased by 7.2% from 694.9K+ in September to 744.6K+ this month.
Threat Reports
Take a quick look at the threat reports we published in October 2026 below.
- A DNS Investigation of the ASCII Smuggling Phishing Campaign: We investigated a phishing campaign that Microsoft’s Security Research team found hiding invisible Unicode tag characters inside finance lure words to slip past keyword filters. WhoisXML API analyzed 45 sender domains and IP addresses, uncovering 137 email-connected domains, 19 additional IP addresses, nine IP-connected domains, and eight malicious artifacts.
- DNS Spotlight: BigBear 2.0 PhaaS Targets Span 40+ Countries: We dissected BigBear 2.0, an Evilginx2-based PhaaS kit that steals post-MFA Microsoft 365 session cookies from 461 organizations in more than 40 countries. WhoisXML API investigated 38 of 48 published IoCs, uncovering 1,048 email-connected domains, eight additional IP addresses, 592 IP-connected domains, and five malicious artifacts.
- DNS Analysis: AI-Powered RatHat Smishing Campaign: We analyzed RatHat, an Android malware strain spread through smishing and malvertising that abuses Accessibility permissions to take over devices. WhoisXML API expanded the published network IoCs to 33 indicators, uncovering 8,461 email-connected domains, seven additional IP addresses, three IP-connected domains, and 12 malicious artifacts linked to the campaign.
- APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation: We looked into Operation RapidRust, a campaign by the Pakistan-linked group APT36 that used lookalike domains impersonating Indian news outlets to deliver PowerShell payloads and four new tools. WhoisXML API investigated five published IoCs, uncovering 341 email-connected domains, two additional IP addresses, three IP-connected domains, and two malicious artifacts.
- To Cache a Predator: Four hours before PHP2Shell’s Disclosure: We traced a server that surveyed five WhoisXML API honeypots 4 hours and 13 minutes before PHP2Shell’s official disclosure on 21 October 2026, then returned with requests matching the exploit fingerprint. The two exploit servers involved contacted at least 9,504 distinct IP addresses before the vulnerability was made public.
You can find more reports created in the past months here.
Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.