Global Domain Activity Trends Seen in Q1 2026

Global Domain Activity Trends Seen in Q1 2026
WhoisXML API’s Global Domain Activity Report: Q1 2026 analyzes 26.5+ million newly registered domains and finds that registration activity remains concentrated in a small number of TLDs, with 6.7+ million NRDs registered with malicious intent and 3.3+ million confirmed malicious domains studied for TLD trends. The report also shows growth in top MX and NS domain usage, while malicious-domain counts among the top 5 TLDs declined slightly quarter over quarter. #WhoisXMLAPI #GlobalDomainActivityReport #NRDs

Keypoints

  • WhoisXML API analyzed more than 26.5 million newly registered domains (NRDs) from 1 January to 31 March 2026.
  • Q1 2026 NRD volume fell 7.4% compared with Q4 2025, when 28.6+ million NRDs were recorded.
  • Top 5 gTLDs accounted for 13.9+ million NRDs, while the top 5 ccTLDs accounted for 2.2+ million NRDs.
  • About 6.7+ million Q1 2026 NRDs were assessed as likely registered with malicious intent from the start.
  • The top 5 MX domains grew to 1.3+ billion site owners, up 12.8% from Q4 2025, and the top 5 NS domains grew to 1.2+ billion, up 20.2%.
  • Confirmed malicious domains among the top 5 TLDs decreased 3.3% quarter over quarter, from 2.1+ million to 2.0+ million.
  • The report highlights global domain registration, DNS usage, and threat-intelligence trends to support business and security decisions.

MITRE Techniques

  • [T1583.001 ] Acquire Infrastructure: Domains – The report describes malicious actors registering domains with harmful purpose from the outset, indicating domain-based infrastructure acquisition (‘6.7+ million of the Q1 2026 NRDs were registered with malicious intent from the get-go’).

Indicators of Compromise

  • [Domain names/TLDs ] Malicious and high-volume domain registration analysis – .com, .xyz, and 3 more TLDs
  • [Domain names/TLDs ] DNS infrastructure usage trends – top 5 MX domains, top 5 NS domains
  • [Domain names/TLDs ] Confirmed malicious domain distribution – top 5 TLDs, and other TLDs in the report


Read more: https://circleid.com/posts/global-domain-activity-trends-seen-in-q1-2026