August 2024: Domain Activity Highlights | WhoisXML API

Newly Registered & Just Expired Domains Blog

August 2024: Domain Activity Highlights

The WhoisXML API research team analyzed more than 7.4 million domains registered between 1 and 31 August 2024 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by the more than 59.2 billion domains from our DNS database’s A record full file released in the same month.

Next, we studied the top TLDs and associated threat types of more than 1.0 million domains detected as indicators of compromise (IoCs) in August.

Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Want more insights? Download the full top 10 gTLD and ccTLD analysis results from our website.

Zooming in on the August 2024 NRDs

TLD Distribution

Of the 7.4 million domains registered in August, 76.7% used generic TLD (gTLD) extensions, while 23.3% used country-code TLD (ccTLD) extensions.

TLD type breakdown of the August 2024 NRDs

The .com TLD remained the most popular extension used by 39.1% of the total number of newly registered domains (NRDs) in August. The other most used TLDs on the top 5 followed with a significant gap as in the previous month. They included three other gTLDs and one ccTLD, namely, .xyz (3.9%), .top and .shop (3.1% each), and .cn (3.0%).

Top 5 TLDs of the August 2024 NRDs

We then analyzed the August TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.

Out of 636 gTLDs, .com remained the most used, accounting for a 51.0% share. The rest of the top 5 lagged far behind. In fact, .xyz only had a 5.0% share. The three other gTLDs in the list were .top (4.1%), .shop (4.0%), and .online (3.6%).

Top 5 gTLDs pf the August 2024 NRDs

Meanwhile, .cn remained the top ccTLD out of 241 extensions with a 13.1% share, up from 11.3% in July. The other commonly used ccTLDs were .ru (7.5%), .de (7.3%), .uk (6.9%), and .in (4.8%).

Top 5 ccTLDs of the August 2024 NRDs

Registrar Distribution

GoDaddy.com LLC continued to top the list of registrars with a 17.0% share, up from 16.6% in July. Namecheap, Inc. came in second with a 10.7% share. GMO Internet Group, Inc. (3.9%) and Tucows Domains, Inc. and NameSilo LLC (3.8% each) rounded out the top 5.

Top 5 registrars of the August 2024 NRDs

WHOIS Data Redaction

A majority of the NRDs, 61.3% to be exact, continued to have redacted WHOIS records. On the other hand, 38.7% of the August NRDs had public WHOIS records.

WHOIS redaction breakdown of the August 2024 NRDs

A Closer Look at the August 2024 DNS Records

Top TLDs of the A Record Domains

Next, we analyzed more than 59.2 billion domains from our DNS database’s A record full file for August 2024, which included DNS resolutions from the past 365 days. We found that half of them used the .com TLD. The rest of the top 5 comprised two other gTLDs, namely, .net (9.5%) and .org (3.5%), and two ccTLDs, specifically, .de (2.3%) and .ru (2.2%).

Top 5 TLDs of the August 2024 A record domains

Cybersecurity through the DNS Lens

Top TLDs of the August 2024 Domain IoCs

As usual, we analyzed more than 1.0 million domains tagged as IoCs for various threats detected in August. Our analysis revealed that .com remained the most popular TLD with a 17.4% share of the total number of IoCs. The remaining top TLDs were all gTLDs as well, namely, .org (15.9%), .net (15.1%), .biz (10.5%), and .info (5.0%).

Top 5 TLDs of the August 2024 domains IoCs

Threat Type Breakdown of the August 2024 Domain IoCs

When we grouped the August domain IoCs based on associated threat type, we discovered that an overwhelming majority, 95.5% to be exact, seemingly served as command-and-control (C&C) servers. This trend varied significantly from July when none of the IoCs were connected to C&C. The rest of the IoCs were related to six other threat types, namely, phishing (2.6%), malware attacks (1.0%), generic threats (0.7%), other attack types (0.1%), suspicious activities (0.1%), and spam campaigns (0.0%, which translates to 2 domains).

August 2024 IoC threat type breakdown

Threat Reports

Below are the threat reports we published in August 2024.

  • On a DNS Threat Hunt for DISGOMOJI: The WhoisXML API research team expanded a list of IoCs for a UTA0137 cyber espionage campaign targeting Indian organizations. The threat actors used DISGOMOJI, a malware coded in Golang and came in the guise of emojis, a first for cyber attacks.

You can find more reports created in the past months here.

Download the August 2024 Top 10 gTLD and ccTLD Highlights from our website or contact us for more product information.

Try our WhoisXML API for free
Get started