WhoisXML API analyzed 26.0+ million domains registered between 1 April and 30 June 2025 from the Newly Registered Domains (NRDs) Data Feed. We found out that the number of NRDs increased by 11.0% compared with the previous quarter. We also looked closer into 3.9+ million domains tagged as indicators of compromise (IoCs) in Q2 2025, along with 1.9+ billion mail exchange (MX) server and 3.8+ billion name server (NS) resolutions for the past 365 days based on our June 2025 passive DNS database file.

Our domain activity trends analysis allowed us uncover the following:

• The top-level domain (TLD) type distribution of the Q2 2025 NRDs
• The most popular generic TLD (gTLD) and country-code TLD (ccTLD) extensions for the NRDs and IoCs
• The most popular NRD registrars
• The top MX and NS fully qualified domain names (FQDNs), their root domains, and their providers

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report: Q2 2025 here.

New Domain Registration Patterns

The number of NRDs increased from 23.4+ million in Q1 2025 to 26.0+ million in Q2 2025. Apart from that trend, let us tackle what other domain activities transpired this past quarter.

Our latest global domain activity analysis marked an 11.0% increase in the total NRD registration compared with Q1 2025. While the gTLD domain registration increased by 15.3%, the ccTLD domain registration decreased by 2.7%.

Based on our Q2 2025 ranking of the most popular gTLDs and ccTLDs, the same players pretty much made the list. The .com gTLD remained in first place, with other extensions like .top, .xyz, and .shop lagging far behind. Among the ccTLDs, .cn toppled last quarter’s .de from the top post.

GoDaddy held on to the top NRD registrar spot, accounting for 13.5% of the total number. Namecheap ranked second with a 9.6% share, followed by Dynadot with 4.9%.

Global DNS Activity: .cc ccTLD Still NRD Volume-to-Population-Incongruent

Each quarter, we analyze the top 10 ccTLDs of the NRDs and how each stacks up in terms of the corresponding country’s population and online penetration status.

The Cocos (Keeling) Islands’ .cc ccTLD continued to register an NRD volume-to-population size incongruence for the third consecutive quarter. In particular, .cc accounted for 262,468 NRDs despite having only 593 residents and an online penetration rate of 76.1%. That translated to an NRD per capita of 581.6.

The .cc ccTLD dominated Q4 2024 and Q1 2025 in terms of sporting an NRD volume-to-population size incongruence. That trend continues to hold true in Q2 2025.

Confirmed Malicious Domains: TLD Topnotchers

We also took a much closer look at our Threat Intelligence Data Feeds, specifically at the 3.9+million malicious domains tagged as IoCs in Q2 2025.

As shown, threat actors continued to favor using .com domains over others, with the gTLD accounting for 21.7% of the total IoC volume. Note that six other gTLD extensions, namely, .org, .net, .biz, .bazar, .info, and .pro also made the top 10.

Three ccTLDs, specifically .ru, .cn, and .io, also figured in the top 10 list.

Global Domain Activity Report: Q2 2025 provides high-level insights into domain registrations and DNS activity worldwide. The report sheds light on domain and DNS record preferences and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.