Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
WhoisXML API analyzed 10.5+ million domains registered between 1 and 31 May 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number rose by 3.6% from 10.2+ million NRDs last month.
We also determined the top TLD extensions used by 2.9+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in May 2026. This number rose by 6.4% from the previous month.
Next, we studied the top TLD extensions of 1.0+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which decreased by 2.4% from 1.1+ million in April.
Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.
Zooming in on the May 2026 NRDs
TLD Distribution
Out of the 10.5+ million domains registered in May 2026, 81.0%, slightly up from 80.8% last month, used gTLD extensions. The remaining 19.0%, down from 19.2%, meanwhile, used ccTLD extensions.
In May 2026, .cn entered the top 5 TLD list, while .shop dropped out. The .cn climb may reflect the current local namespace demand.
Here is a MoM comparison with ranking changes for the top 5 TLD extensions of the May 2026 NRDs.
| MAY 2026 TOP TLD | MAY 2026 TLD VOLUME | APRIL 2026 TLD VOLUME | RANKING CHANGE FROM APRIL TO MAY 2026 |
| .com | 4,198,195 | 4,148,350 | → (Unchanged) |
| .top | 574,589 | 554,439 | → (Unchanged) |
| .cn | 294,183 | 242,710 | ↑ from 6 to 3 |
| .xyz | 284,832 | 249,313 | ↑ from 5 to 4 |
| .org | 280,111 | 279,014 | ↓ from 4 to 5 |
Overall, the top 5 NRD TLD volume rose by 2.0% from 5.5+ million in April to 5.6+ million in May 2026.
We then analyzed the May 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.
The top 5 gTLDs for May 2026 were the same as those identified in April, although .xyz rose from fifth to third place, pushing .shop down from the third to fifth place.
The .xyz movement may be aligned with continued demand for flexible alternatives to .com. Shifts in TLD demand and interest in emerging extensions could also help explain why some newer gTLDs continue to move within the top rankings.
Here is a MoM comparison and ranking changes for the top 5 gTLD extensions used by this month’s NRDs.
| MAY 2026 TOP gTLD | MAY 2026 gTLD VOLUME | APRIL 2026 gTLD VOLUME | RANKING CHANGE FROM APRIL TO MAY 2026 |
| .com | 4,198,195 | 4,148,350 | → (Unchanged) |
| .top | 574,589 | 554,439 | → (Unchanged) |
| .xyz | 284,832 | 249,313 | ↑ from 5 to 3 |
| .org | 280,111 | 279,014 | → (Unchanged) |
| .shop | 278,987 | 287,685 | ↓ from 3 to 5 |
Overall, the top 5 NRD gTLD volume rose by 1.8% from 5.5+ million in April to 5.6+ million in May 2026.
On the ccTLD front, .co entered the top 5, while .us dropped out. This change could be tied to .co’s broad global positioning beyond its original role as Colombia’s ccTLD.
Here is a MoM comparison with ranking changes for the top 5 ccTLD extensions of the May 2026 NRDs.
| MAY 2026 TOP ccTLD | MAY 2026 ccTLD VOLUME | APRIL 2026 ccTLD VOLUME | RANKING CHANGE FROM APRIL TO MAY 2026 |
| .cn | 294,183 | 242,710 | → (Unchanged) |
| .uk | 161,423 | 165,506 | → (Unchanged) |
| .cc | 157,647 | 141,948 | ↑ from 5 to 3 |
| .co | 149,331 | 62,077 | ↑ from 9 to 4 |
| .ru | 142,094 | 161,462 | ↓ from 3 to 5 |
Overall, the top 5 NRD ccTLD volume rose by 5.2% from 859,994 in April to 904,678 in May 2026.
Registrar Distribution
This month’s top 5 registrar list remained unchanged from April 2026, down to the rankings. GoDaddy, Namecheap, Dynadot, Spaceship, and Hostinger Operations continued to account for the largest shares of the May 2026 NRDs.
Although there were no top 5 replacements, Dynadot’s volume increase stood out. This may reflect stronger registrar-level demand, pricing, reseller activity, or portfolio behavior rather than a single identifiable market event.
Here is a MoM comparison with ranking changes for the top 5 NRD registrars.
| MAY 2026 TOP REGISTRAR | MAY 2026 REGISTRAR VOLUME | APRIL 2026 REGISTRAR VOLUME | RANKING CHANGE FROM APRIL TO MAY 2026 |
| GoDaddy | 1,389,769 | 1,449,009 | → (Unchanged) |
| Namecheap | 1,096,064 | 1,130,313 | → (Unchanged) |
| Dynadot | 951,917 | 690,446 | → (Unchanged) |
| Spaceship | 605,750 | 652,378 | → (Unchanged) |
| Hostinger Operations | 439,590 | 451,563 | → (Unchanged) |
Overall, the top 5 NRD registrar volume rose by 2.5% from 4.3+ million in April to 4.4+ million in May 2026.
A Closer Look at the Domains Likely Registered with Malicious Intent in May 2026
TLD Distribution
Next up, we sought to take a closer look at the domains deemed to have been likely registered with malicious intent from the get-go in May 2026. We determined that 2.9+ million domains in all appeared on the First Watch Malicious Domains Data Feed, up by 6.4% from 2.7+ million last month.
Overall, 27.7% of the May 2026 NRDs were likely registered with malicious intent. In addition, .cn entered the top 5 at fourth place. Former fifth placer .info, meanwhile, dropped out of the list.
The .cn entry may reflect the same broader volume movement visible in the NRD TLD distribution. It could also show that large ccTLD namespaces can surface more frequently in predictive threat intelligence simply because they account for a higher volume of new registrations.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains deemed to have been registered with malicious intent.
| MAY 2026 TOP FIRST WATCH TLD | MAY 2026 FIRST WATCH TLD VOLUME | APRIL 2026 FIRST WATCH TLD VOLUME | RANKING CHANGE FROM APRIL TO MAY 2026 |
| .com | 814,571 | 804,151 | → (Unchanged) |
| .top | 400,794 | 370,072 | → (Unchanged) |
| .lol | 183,431 | 169,254 | → (Unchanged) |
| .cn | 149,116 | 113,577 | ↑ from 6 to 4 |
| .xyz | 129,859 | 149,150 | ↓ from 4 to 5 |
Overall, the top 5 First Watch TLD volume rose by 2.5% from 1.63+ million in April to 1.67+ million in May 2026.
How Many NRDs Were Likely Registered with Malicious Intent?
We also sought to find out how many of the domains registered in May 2026 were registered with malicious intent. Our findings showed that 26.9% of the NRDs under the top 5 TLDs were deemed likely to turn malicious as soon as they were registered.
Cybersecurity through the DNS Lens
TLD Distribution
The top 5 TLDs of the confirmed malicious domains found in May 2026 changed slightly from April. While the .info TLD entered the top 5, .bazar dropped out.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains registered with malicious intent.
| MAY 2026 TOP DOMAIN IoC TLD | MAY 2026 DOMAIN IoC TLD VOLUME | APRIL 2026 DOMAIN IoC TLD VOLUME | RANKING CHANGE FROM APRIL TO MAY 2026 |
| .com | 193,340 | 189,019 | → (Unchanged) |
| .org | 169,093 | 165,056 | → (Unchanged) |
| .net | 160,304 | 155,150 | → (Unchanged) |
| .biz | 111,603 | 108,655 | → (Unchanged) |
| .info | 53,972 | 53,688 | ↑ from 6 to 5 |
Overall, the number of confirmed malicious domains sporting the top 5 TLDs decreased by 1.0% from 695,529 in April to 688,312 this month.
Threat Reports
Take a quick look at the threat reports we published in May 2026 below.
- A Network IoC Analysis for 8 Iran-Affiliated APT Groups: WhoisXML API analyzed 191 IoCs tied to eight Iran-affiliated APT groups, including APT42, APT34, and MuddyWater. The investigation expanded the original set of IoCs through DNS and domain intelligence, uncovering client IP communications, malicious registration indicators, email-connected domains, IP-connected domains, and additional malicious infrastructure.
- A Look Back at the Top 10 Ransomware of 2025: This report revisited the DNS footprint of 10 major ransomware operations using 267 network IoCs from public threat reports. WhoisXML API’s analysis surfaced look-alike registrations, malicious domain indicators, victim-communicating IP addresses, email-connected domains, additional malicious IP addresses, IP-connected domains, and string-connected domains linked to ransomware infrastructure.
- The DNS Anatomy of the Axios Supply Chain Attack: WhoisXML API examined 22 IoCs connected to the Axios NPM supply chain attack after deduplication, domain extraction, and filtering. The DNS analysis found client IP communications, typosquatting groups, malicious registration timing, victim-owned IP interactions, email-connected domains, additional malicious IP addresses, and other related connected artifacts.
- An Analysis of the AtlasCross RAT Network IoCs: WhoisXML API analyzed 13 IoCs from an AtlasCross RAT campaign attributed to the Silver Fox APT group. The investigation identified client IP communications, look-alike registrations, domains likely registered with malicious intent, potential victim-owned IP addresses, email-connected domains, additional malicious IP addresses, and other connected artifacts.
You can find more reports created in the past months here.
Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.