Home / Industry

Unveiling Global Domain Activity Trends in Q4 2023

The new domain name registration volume rose 10.24% from the third to the fourth quarter of 2023. WhoisXML API researchers uncovered this finding, along with other DNS trends, after analyzing more than 31 million newly registered domains (NRDs) added from 1 October to 31 December 2023 as seen in the Newly Registered Domains Data Feed. Our study revealed:

  • The most popular generic top-level domain (gTLD) and country-code TLD (ccTLD) among Q4-registered domains
  • The most used registrars
  • The most popular gTLDs and ccTLDs used for malicious domains detected as indicators of compromise (IoCs) in Q4

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report Q4 2023 here.

New Domain DNS Patterns

Domain registrant activities help shed light on the global digital market’s condition. For one, an increase in the volume of domains added during a specific period could indicate digitalization growth. On the flip side, a downward domain registration trend could hint at fewer businesses setting up shop. We can derive localized trends when this information is supplemented with ccTLD data.

In Q4, we noticed a 25.81% increase in gTLD usage compared with Q3 2024 and a 19.25% dip in ccTLD domain registrations.

We then ranked the most used gTLDs and ccTLDs for the period and noticed some new players. For gTLDs specifically, more e-commerce-related extensions (e.g., .shop and .store) emerged among the top 10. Our registrar distribution analysis further supported this finding, as we found two registrars (i.e., Alibaba and Squarespace) specializing in e-commerce among the most popular ones.

Confirmed Malicious Domains: What Were They Up To?

We also gleaned insights from the Threat Intelligence Data Feeds, specifically the November and December 2023 files. We found and analyzed more than 2.6 million unique domains first seen as malicious during these months.

We then sought to find the TLDs most used by the malicious domains. We found that while many used popular TLDs, some utilized less famous gTLDs and ccTLDs like .life and .pw, for instance.

The Global Domain Activity Report Q4 2023 provides high-level DNS insights into the behaviors of domain registrants around the globe. The report brings to light domain activities, preferences, and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.

By WhoisXML API, A Domain Research, Whois, DNS, and Threat Intelligence API and Data Provider

Whois API, Inc. (WhoisXML API) is a big data and API company that provides domain research & monitoring, Whois, DNS, IP, and threat intelligence API, data and tools to a variety of industries.

Visit Page

Filed Under


Commenting is not available in this channel entry.
CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byDNIB.com

Threat Intelligence

Sponsored byWhoisXML API

Domain Names

Sponsored byVerisign

IPv4 Markets

Sponsored byIPv4.Global

Brand Protection

Sponsored byCSC


Sponsored byVerisign

New TLDs

Sponsored byRadix