Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Global domain activity continues to evolve at scale, with shifting registration patterns and persistent malicious use shaping the landscape.
Global Domain Activity Report: Q1 2026 focused on registrant behaviors connected to 26.5M+ NRDs, 6.7M+ of which may have been registered with malicious intent. The analysis further included 2.7B+ and 5.0B+ MX and NS domains, respectively, along with 3.3M+ confirmed malicious domains.
Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:
- The top NRD TLDs, zooming in on the top gTLDs and ccTLDs as well
- The most popular NRD registrars
- The top TLDs of the NRDs likely registered with malicious intent
- The top MX and NS domains
- The top TLDs of the confirmed malicious domains
Download Global Domain Activity Report: Q1 2026 now.