July 2026: Domain Activity Highlights

WhoisXML API analyzed 11.1+ million domains registered between 1 and 31 July 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number rose by 20.1% from 9.2+ million NRDs last month.

We also determined the top TLD extensions used by 1.9+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in July 2026. This number decreased by 1.1% from the previous month.

Next, we studied the top TLD extensions of 1.09+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which rose by 1.8% from 1.07+ million in June.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

Zooming in on the July 2026 NRDs

TLD Distribution

Out of the 11.1+ million domains registered in July 2026, 80.1%, up from 79.7% last month, used gTLD extensions. The remaining 19.9%, down from 20.3%, meanwhile, used ccTLD extensions.

The top 5 TLDs of the July 2026 NRDs were the same five extensions we saw in June, but everything below second place reshuffled—.top and .shop each moved up one rung, while .cn slid from third to fifth place.

Note that .top climbed in ranking despite a volume decline from 445,993 in June to 417,301 this month. Its move to third place may, therefore, say more about the contraction in .cn registrations than about any growth of its own.

The .cn decline could be tied to a pullback from an elevated June volume, when the ccTLD’s volume rose month over month.

Here is a MoM comparison with ranking changes for the top 5 TLD extensions of the July 2026 NRDs.

JULY 2026 TOP TLD	JULY 2026 TLD VOLUME	JUNE 2026 TLD VOLUME	RANKING CHANGE FROM JUNE TO JULY 2026
.com	4,185,494	3,242,280	→ (Unchanged)
.xyz	760,682	798,501	→ (Unchanged)
.top	417,301	445,993	↑ from 4 to 3
.shop	384,439	312,573	↑ from 5 to 4
.cn	381,621	446,766	↓ from 3 to 5

Overall, the top 5 NRD TLD volume rose by 16.8% from 5.2+ million in June to 6.1+ million in July 2026.

We then analyzed the July 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.

The top 5 gTLDs for July 2026 were identical to June’s, down to their ranking. Their volumes moved in different directions, though, with .com, .shop, and .org growing, while .xyz and .top contracted.

The .org gTLD’s recovery may reflect registration activity settling after the Public Interest Registry’s wholesale price increase, which took effect on 1 June 2026 and coincided with the extension’s June dip.

Here is a MoM comparison and ranking changes for the top 5 gTLD extensions used by this month’s NRDs.

JULY 2026 TOP gTLD	JULY 2026 gTLD VOLUME	JUNE 2026 gTLD VOLUME	RANKING CHANGE FROM JUNE TO JULY 2026
.com	4,185,494	3,242,280	→ (Unchanged)
.xyz	760,682	798,501	→ (Unchanged)
.top	417,301	445,993	→ (Unchanged)
.shop	384,439	312,573	→ (Unchanged)
.org	267,682	217,481	→ (Unchanged)

Overall, the top 5 NRD gTLD volume rose by 19.9% from 5.0+ million in June to 6.0+ million in July 2026.

On the ccTLD front, the top 5 also stayed the same in membership and order. The internal balance shifted markedly, however. The .cn volume fell, while every other member posted gains. As a result, .cn’s share of the top 5 ccTLDs dropped from 45.4% in June to 35.4% this month, making the list noticeably less concentrated than it was.

Here is a MoM comparison with ranking changes for the top 5 ccTLD extensions of the July 2026 NRDs.

JULY 2026 TOP ccTLD	JULY 2026 ccTLD VOLUME	JUNE 2026 ccTLD VOLUME	RANKING CHANGE FROM JUNE TO JULY 2026
.cn	381,621	446,766	→ (Unchanged)
.uk	197,253	151,816	→ (Unchanged)
.cc	191,317	135,219	→ (Unchanged)
.br	156,272	132,204	→ (Unchanged)
.ru	152,353	118,423	→ (Unchanged)

Overall, the top 5 NRD ccTLD volume rose by 9.6% from 984,428 in June to 1,078,816 in July 2026.

Registrar Distribution

This month’s top 5 registrar list saw no change in membership or ranking. All five posted growth, but not at the same pace. GMO Internet Group’s cushion over fifth placer Spaceship narrowed down considerably.

Here is a MoM comparison with ranking changes for the top 5 NRD registrars.

JULY 2026 TOP REGISTRAR	JULY 2026 REGISTRAR VOLUME	JUNE 2026 REGISTRAR VOLUME	RANKING CHANGE FROM JUNE TO JULY 2026
GoDaddy	1,303,432	1,110,470	→ (Unchanged)
Namecheap	1,139,846	917,533	→ (Unchanged)
Dynadot	1,017,561	810,428	→ (Unchanged)
GMO Internet Group	792,961	767,357	→ (Unchanged)
Spaceship	651,520	551,640	→ (Unchanged)

Overall, the top 5 NRD registrar volume rose by 18.0% from 4.1+ million in June to 4.9+ million in July 2026.

A Closer Look at the Domains Likely Registered with Malicious Intent in July 2026

TLD Distribution

Next, we sought to take a closer look at the domains likely registered with malicious intent in July 2026. We determined that 1.9+ million such domains appeared on the First Watch Malicious Domains Data Feed, down by 1.1% from 2.0+ million last month.

Overall, 17.9% of the July 2026 NRDs were likely registered with malicious intent. That improvement is worth reading carefully—the absolute number barely moved, so the lower ratio mostly reflects the much larger denominator created by this month’s NRD growth rather than a retreat by the actors behind these registrations.

The top 5 TLDs of these domains did change this month. The .online extension entered at fifth place, displacing .lol, while .xyz and .cn swapped spots.

Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains likely registered with malicious intent.

JULY 2026 TOP FIRST WATCH TLD	JULY 2026 FIRST WATCH TLD VOLUME	JUNE 2026 FIRST WATCH TLD VOLUME	RANKING CHANGE FROM JUNE TO JULY 2026
.com	516,900	483,115	→ (Unchanged)
.top	194,175	234,982	→ (Unchanged)
.xyz	191,670	188,374	↑ from 4 to 3
.cn	142,506	213,401	↓ from 3 to 4
.online	86,126	72,666	↑ from 6 to 5

Overall, the top 5 First Watch TLD volume declined by 9.0% from 1.2+ million in June to 1.1+ million in July 2026.

How Many NRDs Were Likely Registered with Malicious Intent?

Among the NRDs sporting the top 5 TLDs, 17.5% were likely registered with malicious intent.

Cybersecurity through the DNS Lens

TLD Distribution

The top 5 TLDs of the confirmed malicious domains detected in July 2026 stayed the same even in terms of ranking compared with June. Legacy gTLDs continued to dominate, with .info as the only member that posted a decline.

Here is a MoM comparison with ranking changes for the top 5 TLDs of the confirmed malicious domains.

JULY 2026 TOP DOMAIN IoC TLD	JULY 2026 DOMAIN IoC TLD VOLUME	JUNE 2026 DOMAIN IoC TLD VOLUME	RANKING CHANGE FROM JUNE TO JULY 2026
.com	195,051	188,694	→ (Unchanged)
.org	169,719	164,404	→ (Unchanged)
.net	160,730	155,041	→ (Unchanged)
.biz	111,178	108,398	→ (Unchanged)
.info	53,400	56,734	→ (Unchanged)

Overall, the number of confirmed malicious domains sporting the top 5 TLDs increased by 2.5% from 673,271 in June to 690,078 this month.

Threat Reports

Take a quick look at the threat reports we published in July 2026 below.

• 237 Domains Referencing Venezuela’s Earthquake, Most Registered Within 48 Hours: We profiled 237 domains registered between 24 and 30 June 2026 that referenced Venezuela’s magnitude 7.5 earthquake. WhoisXML API found out that 44% of the high-confidence names appeared on 25 June alone, then analyzed registrars, registrant email addresses, name servers, and naming themes to support rapid disaster-driven abuse monitoring worldwide.
• Under the DNS Hood of an Ongoing Legacy MSHTA Tool Attack: We examined how attackers keep abusing Microsoft’s legacy MSHTA utility, notably the CountLoader chain deploying the LummaStealer and Amatera infostealers. WhoisXML API narrowed down 128 published network IoCs to 120 after filtering inactive and legitimately owned domains, then used DNS intelligence to surface connected infrastructure and artifacts for defenders.
• DNS Investigation: Threat Actor TA4922 Goes Global: We tracked TA4922, a suspected Chinese-speaking cybercrime group rotating Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT through localized HR-, tax-, and invoice-themed lures across Asia, Europe, and Africa. WhoisXML API investigated eight IoCs after extracting an apex domain, uncovering further infrastructure connections and artifacts worth monitoring closely.
• 1,755 Domains Referencing the 2026 F1 World Championship: We profiled 1,755 domains referencing the 2026 Formula 1 World Championship, including team, driver, circuit, ticketing, streaming, and fan terms. WhoisXML API analyzed creation dates, registrars, registrant email addresses, name servers, naming themes, and threat signals, noting that the volume rose across January to June and peaked in June.
• 6,442 Domains Referencing Grand Theft Auto VI: We profiled 6,442 domains referencing Grand Theft Auto VI, built from markers such as gta6, vicecity, and leonida. WhoisXML API analyzed creation dates, registrars, registrant email addresses, name servers, naming themes, and threat signals, observing a sharp June increase after pre-orders opened on 25 June 2026.
• Inside a TDS-Powered ClickFix Malware Ecosystem: A DNS Deep Dive: We expanded Check Point Research findings on fake open-source project portals that funneled download clicks through a gated TDS toward RemusStealer, AnimateClipper, and SessionGate infrastructure. WhoisXML API investigated 30 IoCs after extracting apex domains and running legitimacy checks, revealing additional connected infrastructure for defenders.
• 62,081 Domains Referencing the 2026 U.S. Midterm Elections, Hundreds More Registered Every Week: We tracked 62,081 domains referencing the 2026 U.S. midterm elections registered since September 2025. WhoisXML API narrowed down the set to the best-funded Senate and House campaigns from official FEC filings, surfacing dozens of candidate-named domains traced to one overseas registrant, several running online shops.
• A DNS Investigation of LenAI’s ErrTraffic ClickFix Distribution Network: We analyzed ErrTraffic, a fast-growing ClickFix MaaS framework sold by the threat actor LenAI that injects JavaScript into compromised WordPress sites to trigger malicious PowerShell commands. WhoisXML API investigated all 71 published domain IoCs after confirming none belonged to legitimate entities, mapping additional connected infrastructure.
• APT37 Strikes Again, This Time with NarwhalRAT: We covered a North Korean campaign deploying NarwhalRAT, a Python-based Trojan spread through spear-phishing emails posing as Microsoft account security alerts. WhoisXML API analyzed all 11 network IoCs published by Genians Security Center, after confirming no domain belonged to a legitimate entity, to map the wider footprint.

You can find more reports created in the past months here.

Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.