February 2026: Domain Activity Highlights

WhoisXML API analyzed 8.7+ million domains registered between 1 and 28 February 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number dropped by 0.5% from 8.8+ million NRDs last month.

We also determined the top TLD extensions used by 2.3+ million domains registered with malicious intent from the First Watch Malicious Domains Data Feed in February 2026. This number increased by 5.4% from the previous month.

Next, we studied the top TLD extensions of 1.08+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which dropped by 1.4% from 1.09+ million in January.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

Zooming in on the February 2026 NRDs

TLD Distribution

Out of the 8.7+ million domains registered in February 2026, 82.0%, up from 81.8% last month, used gTLD extensions. The remaining 18.0%, down from 18.2%, meanwhile, used ccTLD extensions.

In February 2026, the .online TLD dropped out of the top 5 TLDs for NRDs. Meanwhile, .info entered the list. This shift may reflect a combination of factors, including preregistration activity ahead of announced price adjustments in early 2026, registrar promotions or bulk registrations, and broader diversification beyond using .com, as availability constraints continue to push some registrants toward alternative TLDs.

As with many NRD spikes, the trend may also be influenced by large-scale automated registrations, which can temporarily elevate specific TLDs in NRD datasets.

While the .com TLD remains dominant and continues to account for the largest share of NRD registrations, this trend has gone on for more than 20 years now. That said, many .com names may already be taken, benefiting new TLDs and legacy TLDs like .info.

Here is a MoM comparison and ranking changes for the top 5 TLD extensions used by the NRDs.

Overall, the top 5 NRD TLD volume dropped by 4.6% from 4.6+ million in January to 4.4+ million in February 2026.

We then analyzed the February 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.

As in the last month, the top 5 TLDs for February 2026 were also the top gTLDs for the month.

Meanwhile, .cn remained the most represented ccTLD in the ranking. However, the .in ccTLD replaced Cocos (Keeling) Islands’ .cc in the top 5. This shift may reflect continued growth in India’s digital economy and startup ecosystem as well as periodic fluctuations in registration activity tied to registrar promotions and pricing campaigns.

Here is a MoM comparison and ranking changes for the top 5 ccTLD extensions used by the NRDs.

Overall, the top 5 NRD ccTLD volume dropped by 6.1% from 734,304 in January to 689,775 in February 2026.

Registrar Distribution

The registrars in this month’s top 5 list remained unchanged, although their ranking shifted slightly. Notably, Hostinger Operations and Dynadot swapped positions, possibly reflecting fluctuations in promotional pricing campaigns and Hostinger’s continued growth in bundled hosting-and-domain offerings targeting small businesses and developers.

Here is a MoM comparison and ranking changes for the top 5 NRD registrars.

Overall, the top 5 NRD registrar volume dropped by 7.9% from 3.4+ million in January to 3.1+ million in February 2026.

A Closer Look at the Domains Registered with Malicious Intent in February 2026

TLD Distribution

Next up, we sought to take a closer look at the domains deemed to have been registered with malicious intent from the get-go in February 2026. We determined that 2.3+ million domains in all appeared on the First Watch Malicious Domains Data Feed, up by 5.8% from 2.2+ million last month.

The same TLDs figured in this month’s top 5 albeit slight changes in ranking. Specifically, the TLDs .xyz and .online exchanged places.

Here is a MoM comparison and ranking changes for the top 5 TLDs of the domains registered with malicious intent.

Overall, the top 5 First Watch TLD volume rose by 1.6% from 1.25+ million in January to 1.27+ million in February 2026.

How Many NRDs Were Registered with Malicious Intent?

We also sought to find out how many of the domains registered in February 2026 were registered with malicious intent. Our findings showed that 27.1% of the NRDs under the top 5 TLDs were deemed likely to turn malicious as soon as they were registered.

Cybersecurity through the DNS Lens

TLD Distribution

The top 5 TLDs of the confirmed malicious domains found in February 2026 were the same as those identified in January.

Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains registered with malicious intent.

Overall, the number of confirmed malicious domains sporting the top 5 TLDs decreased by 8.5% from 716,665 in January to 655,535 this month.

Threat Reports

Take a quick look at the threat reports we published in February 2026 below.

• Probing the DNS Depths of PHALT#BLYX: We further investigated the PHALT#BLYX campaign that targeted the European hospitality sector. It used click-fix social engineering, fake CAPTCHAs, and fake BSOD pages to trick users into downloading DCRat. As a result, the threat actors took full remote access to infected systems and dropped secondary payloads. Our analysis of 12 IoCs uncovered thousands of new artifacts and other pertinent insights.

• QakBot Named a 2026 Top Malware Threat: An IoC Analysis: Our further investigation of QakBot, which was named a top malware to watch in 2026 jumped off a list of 144 IoCs. Our analysis led to the discovery of thousands of new artifacts and more information on the IoCs.

• A Look Back at the Top Ransomware Attack Targeting the Salesforce Supply Chain: Several high-impact ransomware operations in 2025 leveraged SaaS supply chain access to infiltrate enterprise environments. But the Salesforce SaaS supply chain attack stood out for its scale and cross-sector impact. We analyzed 39 IoCs related to the threat and unearthed thousands of new artifacts and critical information on the IoCs.

• Top 10 Malware of Q4 2025: A DNS Deep Dive: On 29 January 2026, the Center for Internet Security (CIS) published its list of the top 10 malware for Q4 2025. They identified network IoCs for seven families—SocGholish, CoinMiner, Agent Tesla, Calendaromatic, ZPHP, VenomRAT, and ACR Stealer. We analyzed 46 IoCs and uncovered more than a thousand new artifacts and other pertinent IoC-related insights.

You can find more reports created in the past months here.

Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.