Q2 2026 domain activity showed 30.0+ million newly registered domains, with 7.6+ million likely registered with malicious intent and 3.2+ million confirmed malicious domains analyzed for TLD trends. The report also found rising concentration in MX and NS infrastructure, with top provider usage increasing across email and DNS systems. #WhoisXMLAPI #NRDs #DNSDatabaseDownload #ThreatIntelligenceDataFeeds
Keypoints
- WhoisXML API analyzed 30.0+ million newly registered domains (NRDs) from 1 April to 30 June 2026.
- Q2 2026 NRD volume increased 13.1% compared with Q1 2026.
- 16.1+ million NRDs used the top 5 gTLDs, while 2.7+ million used the top 5 ccTLDs.
- 7.6+ million NRDs were likely registered with malicious intent, and 4.5+ million of the NRDs sporting the top 5 TLDs fell into that category.
- The top 5 MX domains served 1.4+ billion site owners in Q2 2026, up 6.8% from Q1.
- The top 5 NS domains served 1.5+ billion site owners in Q2 2026, up 18.8% from Q1.
- Confirmed malicious domains using the top 5 TLDs decreased 2.3% from 2.08+ million in Q1 to 2.03+ million in Q2 2026.
MITRE Techniques
- [T1583.001 ] Acquire Infrastructure: Domains – The report analyzes how domains were newly registered and how malicious activity concentrated in specific TLDs (‘7.6+ million of the quarter’s NRDs were likely registered with malicious intent’).
- [T1583.004 ] Acquire Infrastructure: Server – The report examines MX and NS infrastructure used by large numbers of site owners (‘The total number of site owners using the top 5 MX domains increased…’; ‘The total number of site owners using the top 5 NS domains…’).
Indicators of Compromise
- [Domain/TLD ] Top NRD and malicious-domain namespace trends – top 5 gTLDs, top 5 ccTLDs, and top 5 TLDs
- [Domain category ] Email and DNS infrastructure providers – top 5 MX domains, top 5 NS domains
- [Dataset/Feed ] Domain and threat intelligence sources used in the report – Newly Registered Domains (NRDs) Data Feed, DNS Database Download, Threat Intelligence Data Feeds
Read more: https://circleid.com/posts/global-domain-activity-trends-seen-in-q2-2026