Global Domain Activity Report: Q1 2026

Global domain activity continues to evolve at scale, with shifting registration patterns and persistent malicious use shaping the landscape. 

Global Domain Activity Report: Q1 2026 focused on registrant behaviors connected to 26.5M+ NRDs, 6.7M+ of which may have been registered with malicious intent. The analysis further included 2.7B+ and 5.0B+ MX and NS domains, respectively, along with 3.3M+ confirmed malicious domains.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

December 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 10.2+ million domains registered between 1 and 31 December 2025, along with 27.3+ billion domains from our DNS database’s A record full file dated 4 December 2025 and 1.1+ million IoCs detected in the same period.

Our research team uncovered:

November 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 8.7+ million domains registered between 1 and 30 November 2025, along with 31.9+ billion domains from our DNS database’s A record full file dated 6 November 2025 and 1.0+ million IoCs detected in the same period.

Our research team uncovered:

October 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 9.6+ million domains registered between 1 and 31 October 2025, 38.7+ billion domains from our DNS database’s A record full file dated 4 October 2025, and 1.1+ million IoCs detected in the same period.

Our research team uncovered:

Global Domain Activity Report: Q3 2025

The latter half of 2025 brought to light new global domain activity trends aided by the Global Domain Activity Report for Q3 focusing on registrant behaviors connected to 25.7+ million newly registered domains (NRDs). We also analyzed 2.1+ billion mail exchange (MX) resolutions, 4.2+ billion name server (NS) resolutions, and 3.2+ million indicators of compromise (IoCs) detected in the same period.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

September 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 8.7+ million domains registered between 1 and 30 September 2025, 42.1+ billion domains from our DNS database’s A record full file dated 4 September 2025, and 1.0+ million IoCs detected in the same period.

Our research team uncovered:

August 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 8.5+ million domains registered between 1 and 31 August 2025, 45.1+ billion domains from our DNS database’s A record full file dated 7 August 2025, and 1.0+ million IoCs detected in the same period.

Our research team uncovered:

July 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 8.3+ million domains registered between 1 and 31 July 2025, 49.3+ billion domains from our DNS database’s A record full file dated 3 July 2025, and 1.1+ million IoCs detected in the same period.

Our research team uncovered:

Global Domain Activity Report: Q2 2025

Half of 2025 is over. It’s time to look at the global domain activity trends again aided by the Global Domain Activity Report for Q2 focusing on registrant behaviors connected to 26.0+ million newly registered domains (NRDs). We also analyzed 1.9+ billion mail exchange (MX) resolutions, 3.8+ billion name server (NS) resolutions, and 3.9+ million indicators of compromise (IoCs) detected in the same period.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

June 2025 Top 10 gTLD and ccTLD Highlights

WhoisXML API analyzed 9.8+ million domains registered between 1 and 30 June 2025, 51.7+ billion domains from our DNS database’s A record full file dated 5 June 2025, and 1.0+ million IoCs detected in the same period.

Our research team uncovered:

May 2025 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 8.5+ million domains registered between 1 and 31 May 2025, 54.6+ billion domains from our DNS database’s A record full file dated 1 May 2025, and 1.3+ million IoCs detected in the same period.

Our research team uncovered:

April 2025 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 7.6+ million domains registered between 1 and 30 April 2025, 55.8+ billion domains from our DNS database’s A record full file dated 3 April 2025, and 1.5+ million IoCs detected in the same period.

Our research team uncovered:

Global Domain Activity Report: Q1 2025

Let’s take a closer look at the start of 2025 aided by the Global Domain Activity Report for Q1 focusing on registrant behaviors connected to 23.4+ million newly registered domains (NRDs). We also analyzed 790.0+ million mail exchange (MX) resolutions, 1.5+ billion name server (NS) resolutions, and 2.1+ million indicators of compromise (IoCs) detected in the same period.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

March 2025 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 8.2+ million domains registered between 1 and 31 March 2025, 59.2+ billion domains from our DNS database’s A record full file dated 6 March 2025, and 1.1+ million IoCs detected in the same period.

Our research team uncovered:

February 2025 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 7.5+ million domains registered between 1 and 28 February 2025, 62.1+ billion domains from our DNS database’s A record full file dated 6 February 2025, and 1.0+ million IoCs detected in the same period.

Our research team uncovered:

January 2025 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 7.6+ million domains registered between 1 and 31 January 2025, along with 61.2+ billion domains from our DNS database’s A record full file released in January 2025.

Our research team uncovered:

Global Domain Activity Report: Q4 2024

Let’s cap off 2024 with the Global Domain Activity Report for Q4, this time focusing on registrant behaviors connected to 24.4+ million newly registered domains (NRDs). We also analyzed 3.5+ million indicators of compromise (IoCs) detected in the same period, 697.4+ million mail exchange (MX) resolutions, and 1.5+ billion name server (NS) resolutions.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

December 2024 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 7.9+ million domains registered between 1 and 31 December 2024, along with 60.1+ billion domains from our DNS database’s A record full file and 1.3+ million domains detected as indicators of compromise (IoCs) for the month.

Our research team uncovered:

November 2024 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed 8.2 million domains registered between 1 and 30 November 2024, 59.6 billion domains from our DNS database’s A record full file released in November 2024, and 1.1 million domains detected as indicators of compromise (IoCs) in the same month.

Our research team uncovered:

October 2024 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed more than 8.2 million domains registered between 1 and 31 October 2024, 57.4 billion domains from our DNS database’s A record full file released in October 2024, and more than 1 million domains detected as indicators of compromise (IoCs) in the same month.

Our research team uncovered:

Global Domain Activity Report: Q3 2024

Time for another edition of the Global Domain Activity Report, this time focusing on registrant behaviors connected to nearly 22 million newly registered domains (NRDs) in Q3 2024. We also analyzed 618+ million mail exchange (MX) resolutions, 1+ billion name server (NS) resolutions, and 3+ million indicators of compromise (IoCs) detected in the same period.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

September 2024 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed more than 7.1 million domains registered between 1 and 30 September 2024, 60.1 billion domains from our DNS database’s A record full file released in September 2024, and more than 1 million domains detected as indicators of compromise (IoCs) in the same month.

Our research team uncovered:

August 2024 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed more than 7.4 million domains registered between 1 and 31 August 2024, 59.2 billion domains from our DNS database’s A record full file released in August 2024, and more than 1 million domains detected as indicators of compromise (IoCs) in the same month.

Our research team uncovered:

July 2024 Top 10 gTLD and ccTLD Highlights

The WhoisXML API research team analyzed more than 7.3 million domains registered between 1 and 31 July 2024, 58.1 billion domains from our DNS database’s A record full file released in July 2024, and more than 1 million domains detected as indicators of compromise (IoCs) in the same month.

Our research team uncovered:

Global Domain Activity Report: Q2 2024

Here is another edition of the Global Domain Activity Report, this time focusing on registrant behaviors connected to 21.5+ million newly registered domains (NRDs) in Q2 2024. We also analyzed 630+ million mail exchange (MX) resolutions and 3.3+ million malicious indicators of compromise (IoCs) detected in the same period.

Our research team leveraged WhoisXML API’s extensive domain, DNS, and threat intelligence to uncover:

Global Domain Activity Report: Q1 2024

Our latest Global Domain Activity Report delivers insights into the registrant behaviors related to more than 21 million newly registered domains (NRDs) in Q1 20243. This analysis is complemented by the identification of 3.2 million indicators of compromise (IoCs) discovered during the same period.

Using our comprehensive domain, DNS, and threat intelligence, the report sheds light on:

Global Domain Activity Report: Q4 2023

Our researchers released another edition of the Global Domain Activity Report focusing on registrant behaviors for 31+ million newly registered domains in Q4 2023, along with an analysis of 1.4+M new malicious indicators detected in the same period.

By leveraging WhoisXML API’s extensive domain, DNS, and threat intelligence, we uncovered:

Global Domain Activity Report: Q3 2023

Using a combination of comprehensive global domain and cyber threat intelligence, WhoisXML API researchers analyzed the domain registrations in Q3 2023, zoomed in on suspicious new domains, and examined actual indicators of compromise (IoCs) reported within the same period.

The Global Domain Activity Report Q3 2023 drills down on specific trends, including: