Global Domain Activity Report: Q1 2026

Global domain activity continues to evolve at scale, with shifting registration patterns and persistent malicious use shaping the landscape. 

Global Domain Activity Report: Q1 2026 focused on registrant behaviors connected to 26.5M+ NRDs, 6.7M+ of which may have been registered with malicious intent. The analysis further included 2.7B+ and 5.0B+ MX and NS domains, respectively, along with 3.3M+ confirmed malicious domains.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

  • The top NRD TLDs, zooming in on the top gTLDs and ccTLDs as well
  • The most popular NRD registrars
  • The top TLDs of the NRDs likely registered with malicious intent
  • The top MX and NS domains
  • The top TLDs of the confirmed malicious domains

Download Global Domain Activity Report: Q1 2026 now.

Try our WhoisXML API for free
Get started