Domain registration activity remains concentrated across a relatively small number of TLDs, shaping both how new domains are distributed and where potentially malicious activity is more likely to cluster.

To provide more context to the current namespace, WhoisXML API analyzed 26.5+ million NRDs registered between 1 January and 31 March 2026 as recorded in the Newly Registered Domains (NRDs) Data Feed.

Apart from uncovering key domain registration trends focusing on the prevalence of popular gTLD and ccTLD extensions and registrars, our analysis shows that 6.7+ million of the Q1 2026 NRDs were registered with malicious intent from the get-go.

We also took a closer look at 2.7+ billion MX domains and 5.0+ billion NS domains obtained from DNS Database Download to determine the top 5 for both covering the past three months.

Finally, we studied 3.3+ million confirmed malicious domains based on data from the Threat Intelligence Data Feeds to identify the top 5 TLDs in Q1 2026.

Our domain activity trends analysis allowed us uncover the following:

• The top NRD TLD extensions, zooming in on the gTLD and ccTLD extensions as well
• The most popular NRD registrars
• The top TLDs of the NRDs likely registered with malicious intent
• The top MX and NS domains
• The top TLDs of the confirmed malicious domains

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report: Q1 2026 here.

New Domain Registration Patterns

In Q1 2026, 26.5+ million NRDs were registered, down 7.4% from the 28.6+ million NRDs seen in Q4 2025.

We learned that 13.9+ million NRDs used the top 5 gTLDs in Q1 2026, while 2.2+ million NRDs sported the top 5 ccTLDs.

We then dissected the data further and discovered that:

• The .shop and .org gTLD extensions replaced .bond and .info in this quarter’s top 5 NRD gTLDs list.

  Q1 2026 TOP gTLD	Q1 2026 gTLD VOLUME	Q4 2025 gTLD VOLUME	QoQ RANKING CHANGE
  .com	10,479,458	9,707,072	→ (Unchanged)
  .top	1,000,527	1,212,056	↑ from 4 to 2
  .shop	938,453	1,042,209	↑ from 6 to 3
  .xyz	791,749	3,033,998	↓ from 2 to 4
  .org	733,219	670,756	↑ from 7 to 5

• The top 5 ccTLD extensions remained the same from Q4 2025 to Q1 2026 albeit ranking changes for some.

  Q1 2026 TOP ccTLD	Q1 2026 ccTLD VOLUME	Q4 2025 ccTLD VOLUME	QoQ RANKING CHANGE
  .cn	607,552	769,406	→ (Unchanged)
  .uk	486,710	415,301	↑ from 3 to 2
  .ru	450,594	440,699	↓ from 2 to 3
  .br	334,951	267,366	↑ from 5 to 4
  .cc	329,815	349,695	↓ from 4 to 5

Check out more NRD-related trends in the report.

How Many of the Q1 2026 NRDs Were Registered with Malicious Intent?

This year, we began to determine how many of the total number of NRDs were likely registered with malicious intent from the get-go.

We learned that the 3.8+ million of the NRDs sporting the top 5 TLDs were likely registered with malicious intent.

We also analyzed the NRDs, specifically those that sported the top 5 NRD TLDs, and quantified the registration volume of those likely created with malicious intent. See the full report for a detailed breakdown.

Global DNS Activity Trends

Our analysis of the top MX and NS domain TLDs revealed that:

• The total number of site owners using the top 5 MX domains increased by 12.8% from 1.1+ billion in Q4 2025 to 1.3+ billion in Q1 2026.
• The total number of site owners using the top 5 NS domains, meanwhile, increased by 20.2% from 1.0+ billion in Q4 2025 to 1.2+ billion in Q1 2026.

Know more about these trends and more in the report.

TLD Topnotchers for the Confirmed Malicious Domains

Finally, we discovered that the total number of confirmed malicious domains sporting the top 5 TLDs dropped by 3.3% from 2.1+ million in Q4 2025 to 2.0+ million in Q1 2026.

Gain more insights about the confirmed malicious domains from the report.

Global Domain Activity Report: Q1 2026 provides high-level insights into the domain registrations and DNS activity worldwide. It hopes to shed light on domain and DNS record preferences and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.