WhoisXML API analyzed 25.7+ million domains registered between 1 July and 30 September 2025 from the Newly Registered Domains (NRDs) Data Feed. We discovered that the number of NRDs decreased by 1.2% compared with the previous quarter. We also looked closer into 3.2+ million domains tagged as indicators of compromise (IoCs) in Q3 2025, along with 2.1+ billion mail exchange (MX) server and 4.2+ billion name server (NS) resolutions for the past 365 days based on our passive DNS database file for September 2025.

Our domain activity trends analysis allowed us uncover the following:

• The top-level domain (TLD) type distribution of the Q3 2025 NRDs
• The most popular generic TLD (gTLD) and country-code TLD (ccTLD) extensions for the NRDs and IoCs
• The most popular NRD registrars
• The top MX and NS fully qualified domain names (FQDNs), their root domains, and their providers

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report: Q3 2025 here.

New Domain Registration Patterns

The number of NRDs decreased from 26.0+ million in Q2 2025 to 25.7+ million in Q3. Apart from that trend, let us tackle what other domain activities transpired this quarter.

Our latest global domain activity analysis marked a 1.2% decrease in the total NRD registration compared with Q2 2025. While the gTLD domain registration increased by 1.9%, the ccTLD domain registration decreased by a massive 13.3%.

Based on our Q3 2025 ranking of the most popular gTLDs and ccTLDs, the same players pretty much made the list. The .com gTLD remained in first place, with other extensions like .xyz, .top, and .shop lagging far behind. Among the ccTLDs, .cn continued to reign supreme.

GoDaddy held on to the top NRD registrar spot, accounting for 14.0% of the total number. Namecheap ranked second with a 9.4% share, followed by GMO Internet Group, which toppled Dynadot with 7.9%.

Global DNS Activity: .cc ccTLD Still NRD Volume-to-Population-Incongruent

Each quarter, we analyze the top 10 ccTLDs of the NRDs and how each stacks up in terms of the corresponding country’s population and online penetration status.

The Cocos (Keeling) Islands’ .cc ccTLD continued to register an NRD volume-to-population size incongruence for the fourth consecutive quarter. In particular, .cc accounted for 366,698 NRDs, even much higher than 262,468 last quarter, despite having only 593 residents and an online penetration rate of 76.1%. That translated to an NRD per capita of 812.6.

The .cc ccTLD dominated Q4 2024, Q1 2025, and Q2 2025 in terms of sporting an NRD volume-to-population size incongruence. That trend continues to hold true this quarter.

Confirmed Malicious Domains: TLD Topnotchers

We also took a much closer look at our Threat Intelligence Data Feeds, specifically at the 3.2+ million malicious domains tagged as IoCs in Q3 2025.

As shown, threat actors continued to favor using .com domains over others, with the gTLD accounting for 17.5% of the total IoC volume. Note that nine other gTLD extensions, namely, .org, .net, .biz, .info, .bazar, .hosting, .blackfriday, .feedback, and .tickets also made the top 10.

Only two ccTLDs, specifically .ru and .cn, meanwhile, also figured in the top 10 list.

Global Domain Activity Report: Q3 2025 provides high-level insights into domain registrations and DNS activity worldwide. The report sheds light on domain and DNS record preferences and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.