This quarter, while many of the top 5 players across NRD registrations, including those likely registered with malicious intent and confirmed malicious, remained the same, we witnessed several ranking changes.

To provide more context to the current namespace, WhoisXML API analyzed 35.1+ million NRDs registered between 1 July and 30 September 2026 as recorded in the Newly Registered Domains (NRDs) Data Feed.

Apart from uncovering key domain registration trends focusing on the prevalence of popular gTLD and ccTLD extensions and registrars, we learned that 8.2+ million of the Q3 2026 NRDs were likely registered with malicious intent.

We also took a closer look at 3.0+ billion MX domains and 4.5+ billion NS domains obtained from DNS Database Download to determine the top 5 for both covering the past three months.

Finally, we studied 3.2+ million confirmed malicious domains based on data from the Threat Intelligence Data Feeds to identify the top 5 TLDs in Q3 2026.

Our domain activity trends analysis allowed us to uncover the following:

• The top NRD TLD extensions, zooming in on the gTLD and ccTLD extensions as well
• The most popular NRD registrars
• The top TLDs of the NRDs likely registered with malicious intent
• The top MX and NS domains
• The top TLDs of the confirmed malicious domains

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report: Q3 2026 here.

New Domain Registration Patterns

In Q3 2026, 35.1+ million NRDs were registered, up 16.8% from the 30.0+ million NRDs seen in Q2 2026.

We learned that 27.6+ million NRDs used gTLDs in Q3 2026, while 7.4+ million NRDs sported ccTLDs.

We then dissected the data further and discovered that:

• The top 5 gTLDs this quarter saw one new player, with .online replacing .org. Only two kept their ranking. The .xyz and .top gTLDs exchanged places.

  Q3 2026 TOP gTLD	Q3 2026 gTLD VOLUME	Q2 2026 gTLD VOLUME	QoQ RANKING CHANGE
  .com	12,650,150	11,588,825	→ (Unchanged)
  .xyz	3,377,136	1,332,646	↑ from 3 to 2
  .top	1,399,556	1,575,021	↓ from 2 to 3
  .shop	977,401	879,245	→ (Unchanged)
  .online	792,390	653,063	↑ from 7 to 5

• The top 5 ccTLD extensions remained the same from Q2 to Q3 2026, even in terms of ranking.

  Q3 2026 TOP ccTLD	Q3 2026 ccTLD VOLUME	Q2 2026 ccTLD VOLUME	QoQ RANKING CHANGE
  .cn	1,651,224	983,659	→ (Unchanged)
  .uk	607,941	478,745	→ (Unchanged)
  .cc	579,679	434,814	→ (Unchanged)
  .ru	487,982	421,979	→ (Unchanged)
  .br	452,266	407,748	→ (Unchanged)

Check out more NRD-related trends in the report.

How Many of the Q3 2026 NRDs Were Likely Registered with Malicious Intent?

We learned that the 4.8+ million of the NRDs sporting the top 5 TLDs were likely registered with malicious intent.

Learn more about the NRDs registered with malicious intent from the report.

Global DNS Activity Trends

Our analysis of the top MX and NS domains revealed that:

• The total number of site owners using the top 5 MX domains increased by 4.6% from 1.42+ billion in Q2 to 1.49+ billion in Q3 2026.
• The total number of site owners using the top 5 NS domains, meanwhile, increased by 19.8% from 1.5+ billion in Q2 to 1.8+ billion in Q3 2026.

Know more about these trends and more in the report.

TLD Topnotchers for the Confirmed Malicious Domains

Finally, we discovered that the total number of confirmed malicious domains sporting the top 5 TLDs rose by 0.8% from 2.03+ million in Q2 to 2.05+ million in Q3 2026.

Stay secure with more insights about the confirmed malicious domains in the report.

Global Domain Activity Report: Q3 2026 provides high-level insights into the domain registrations and DNS activity worldwide. It hopes to shed light on domain and DNS record preferences and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.