Over the last month, Aug 2025, we observed 8,554,122 newly registered domains. Nearly 85% of these records have cleaned registrar information, while 80% include cleaned address details. Additionally, gTLDs continue to outpace ccTLDs. Country, registrar, and TLD leaderboards show a highly concentrated head with a long competitive tail.
Key highlights
Total newly registered: 8,554,122
TLD mix: gTLDs 75% (6,417,964) vs ccTLDs 25% (2,136,158)
Top country: United States (1,357,261)
Top registrar: GoDaddy.com, LLC (1,220,522)
Top TLD: .com (3,288,280)
TLD-wise analysis
Top 20 TLDs - Full Period
The TLD landscape this period is heavily concentrated at the top, led by .com with a sizable gap to the next tier.
Comparison with JULY 2025
.com cooled slightly: 3,288,280 in Aug vs 3,325,728 in Jul (-37,448; -1.1%). Its share of the top-20 total also fell (≈49.1% → 43.7%), signaling diversification.
Country TLDs surged in August: .de (877,414) appeared at #2, with .au (208,782) and .eu (160,080) also entering. Within the overlapping set, .cn doubled (+101.7%). As a group, ccTLDs’ share of the top-20 jumped from ~9% in July to ~23% in August.
Biggest faller: .top nearly halved (-212,779; -46.8%). .es also slid hard (-29.7%).
New in August’s top-20: .de (877,414), .au (208,782), .eu (160,080), .pro (93,747).
Dropped out vs July: .co (139,875), .mobi (126,237), .uk (115,843), .br (67,863).
Notable rank moves (overlapping TLDs)
Up: .cn rose from #19 → #14; strong volume expansion.
Down: .es fell from #9 → #17; .top from #3 → #5.
Leaderboard (absolute counts):
What this says:
.com remains the default choice for global and commercial use cases.
Strong country and regional signals: .de, .au and .eu stood out this month, suggesting localized promotions/policy effects or bulk acquisitions when compared with other Country level TLDs.
The middle tier of gTLDs (.xyz, .shop, .top, .online) should be included in all of your brand and abuse detection workflows - not just .com. These extensions carry meaningful volume, so attackers and bulk registrants use them. If your scope only covers .com (or a tiny TLD set), you’ll miss a large share of relevant registrations and abuse.
Share of Top 5 TLDs - Pie View
The top five TLDs account for ~70% of all newly registered domains in the month of July; “Others” make up the remaining ~30%.
Implication: A small set of extensions dominates activity. Coverage, alerting, and brand-protection rules should prioritize these five, while still watching for bursts in the “Others” bucket (which can hide sharp, short-lived campaigns).
Daily Dynamics - Top 5 TLDs
.com
High and stable volumes across the month (~90–125k/day),
Two spike has been observed on 1st and 26th of Aug, 203K and 180K respectively, followed by immediate return to the baseline.
The late-period drop looks cyclical (weekend/time-zone effects) rather than structural.
.de
Stable volumes across the month (15-20K)
Two spike have been observed on 6th and 15th of Aug, followed by immediate return to the base line.
.xyz
Stable volumes across the month (20-40K)
A spike has been observed over the period 13th of Aug to 15th of Aug, this spikes shows a marketing campaign.
.shop
Stable volumes across the month (4-12K)
Single dump mid-period against a low baseline.
No anomalies detected; the pattern holds steady during weekdays, with dips occurring over the weekend.
.top
Stable volumes across the month (6-9K)
Sharp dump on 3rd and 4th of Aug, quickly retracing to baseline.
Registration remains in the zig-zag pattern nothing that tells us any sort of consistency.
Country-wise analysis
Top 20 Countries - Full Period
New registrations are highly concentrated, with the United States far ahead of the pack.
Comparison with JULY 2025
Overall volume (top-20 countries shown) shrank sharply. Sum of the displayed top-20 fell from 3.92M (Jul) → 2.81M (Aug), a -28.3% drop.
Top 3 reordered:US → Iceland → China in Aug (was US → China → Iceland in Jul).
United States down in absolute terms but up in share. US registrations declined -438,989 (-24.4%), yet its share of the top-20 grew (others fell faster).
China collapsed.-441,141 (-72.7%), dropping from #2 to #3 and giving the #2 spot to Iceland.
Biggest risers: Hong Kong (+25.3%), India (+5.8%), Iceland (+1.0%), Brazil (+0.7%).
New August entrants: Austria (34,355), British Virgin Islands (29,165), Philippines (20,636).
Dropped since July: Sweden (110,650), Australia (29,049), Malaysia (24,380).
India jumped to #4 (from #8), Brazil to #5 (from #7). Canada slid to #6 (from #4).
Japan plunged from #9 to #15; Hong Kong climbed from #13 to #9.
France, Netherlands, Germany all improved rank despite lower volumes because several peers fell more.
Leaderboard (absolute counts):
What this says
The US alone accounts for nearly half of all observed registrations this period.
Iceland and China form a strong second tier; both show episodic surges that can move the daily totals materially.
The long tail remains meaningful - multiple European and APAC markets contribute steady volume.
Share of Top 5 Countries - Pie View
Top five countries together contribute ~80% of all newly registered domains this period.
Implication: Brand protection, threat monitoring, and registrar partnerships should prioritize these five geographies, while keeping anomaly detection on the “Others” bucket for sudden regional bursts.
Daily Dynamics — Top 5 Countries
United States
Pattern: High, fairly stable baseline (~30–50k/day) punctuated by a sharp trough (single-digit thousands) and a brief spike to ~110k, then normalization.
Read: Likely tied to calendar effects (weekend/holiday) and a one-off bulk action or promotion.
Action: Keep US-focused alerts with rolling baselines.
Iceland
Pattern:Volatile series with multiple peaks (≈32k and ≈34k) and deep troughs (low thousands).
Read: zig zag with promo-driven flows, bulk portfolio moves, or registry policy timing.
Action: Monitor for sudden order-of-magnitude changes; treat spikes as signals to review specific registrars.
China
Pattern:Volatile series with multiple peaks (≈16k and ≈19k) and deep troughs (low thousands).
Read: Smaller market with campaign-style bursts; totals can swing on a few large buyers.
Action: Monitor for sudden order-of-magnitude changes; treat spikes as signals to review specific registrars.
India
Pattern: Low-to-moderate baseline (2–4k/day) with a multiple spikes (~6k, 7K and 10K) and a one near-zero dips.
Read: Smaller market dynamics; spikes can reflect single-actor campaigns or registry events.
Action: Keep rules sensitive to relative changes rather than absolute counts.
Canada
Pattern: Steady baseline around 3–5k/day with late-period spikes (~15k)
Read: Likely coordinated registrar activity or price incentives mid/late period.
Action: Add short-term surge alerts; correlate with .ca and major Canadian registrars.
Registrar-wise Analysis
Top 20 Registrars - Full Period
New registrations are highly concentrated among a small set of registrars, with two clear leaders.
Spaceship surged #6 → #4 (457,383; +65.4%, fastest among majors).
Dynadot fell #3 → #5 (-8.6%).
Hostinger held strong growth (+7.6%) but slid #5 → #6 because others grew faster.
No new entrants or exits in the top-20; it’s a pure reorder.
Leaderboard (absolute counts):
What this says
GoDaddy and Namecheap dominate the period; together they represent a very large share of all activity.
A competitive second tier (Dynadot, Onamae, spaceship) accounts for a significant chunk and often drives day-to-day volatility.
The long tail remains meaningful for detection - several mid-size registrars contribute six-figure totals.
Share of Top 5 Registrars - Pie View
Within the top five registrars, the mix for this period is:
Implication: While GoDaddy and Namecheap lead, the aggregate of non-top-5 registrars (“Others”) is still the single largest slice, so monitoring must extend beyond the leaders.
Daily Dynamics - Top 5 Registrars
GoDaddy.com, LLC
Generally stable between ~25k–35k most days.
Early high near ~58k then normalization
Sharp trough (~7–8k) around Aug 24 followed by a quick rebound (~47k on Aug 26, ~44k on Aug 28).
Caption: Mostly steady with one late-month dip and swift recovery.
Namecheap, Inc
Downward trend from ~36k at start to single-digit thousands by month end.
Mid-month bounce (~27–29k around Aug 18–19), then a steep slide after Aug 22 (often <10k).
Caption: Early strength, mid-month bump, then pronounced late-month taper.
GMO Internet Group (Onamae)
Highly spiky distribution with very large bursts around Aug 9–15 (peaks near ~90k, + several days 40–75k).
Several near-zero/low days, then smaller late-month pops (~20–40k).
Caption: Irregular traffic with a few massive campaign-like spikes; otherwise low baseline.
Spaceship, Inc
Moderate growth through mid-month from ~10–16k to ~17–22k.
Peak around late Aug (~25–26k), followed by a pullback to ~10–15k.
Caption: Gradual build to a late-month peak, then cooling.
Dynadot Inc
Daily volume ranges ~3k–12k.
Multiple mid-month surges (≈Aug 12, Aug 15 and Aug 17) reaching ~11–12k.
Late-month cool-down to ~3–6k/day after Aug 23.
Caption: Volatile mid-month spikes followed by a steady late-month decline.
Cleaned vs Redacted - Data Quality Snapshot
Registrar Details
Total records:8,554,122
Cleaned:7,124,787 (~83.3%)
Redacted:1,429,335 (~16.7%)
What it shows
83.3% cleaned (7,124,787) vs 16.7% redacted (1,429,335): registrar fields are widely available and reliable.
Lean on registrar, IANA ID, status codes, and creation/expiry dates for coverage-rich enrichment.
Great for trend analysis (NRDs per registrar), policy enforcement, and escalation pathways (registrar abuse desks).
Why it matters
Great foundation for concentration analysis, spike attribution, and enforcement routing.
Enables robust pivoting (Registrar → TLD → Country) to explain anomalies and target actions.
Where to use it
Security Copilot & Phishing Agent: show registrar + NRD age by default; surface contact/address only when present & permitted.
Brand protection: registrar hotspots, fast-flux patterns, and address/contact reuse for impersonation campaigns.
Abuse operations: registrar data for takedown routing and SLA tracking; address/contact (if present) for evidence strength.
Analytics: KPI on NRDs by registrar, % with contact/address present, median first-seen age—to measure control effectiveness over time.
Action
Build registrar-level baselines and anomaly alerts; on spike days, drill into the registrar’s TLD/country mix.
Use registrar signals early in risk scoring and takedown playbooks.
Address Details
Total records:8,554,122
Cleaned:1,948,575 (22.8%)
Redacted:6,605,547 (77.2%)
What it shows
77.2% redacted (6,605,547) vs 22.8% cleaned (1,948,575): most postal addresses are withheld in newly registered domains.
Expect low coverage for geo/person-level attribution from WHOIS address alone; treat any address hit as high-value but sparse.
Use cleaned addresses mainly for entity clustering (same org/address across many domains), abuse repeat-offender detection, and escalations that need a physical trail.
Why it matters
Solid coverage for geo-segmentation, risk scoring by country/region, and regional enforcement workflows.
Enables address-based clustering when emails/phones are missing.
Prioritize infrastructure & behavior features in classifiers.
Track the cleaned-contact share as a pipeline health metric; any uplift materially improves enrichment ROI.
Maintain registrar-specific expectations - some providers are consistently stricter.
Newly / Newly Cleaned - Daily Trend
Newly shows high volatility with a pronounced mid-period spike (single-day surge) and several dips thereafter.
Newly_Cleaned remains uniform through out the period.
How to read this
Spikes often correlate with promotions, bulk portfolio activity, or calendar effects; dips can reflect weekend/holiday cycles or feed lag.
Action prompts
Use 7–14 day rolling averages for stability; set anomaly alerts relative to each series’ baseline.
Investigate the spike day: identify registrars/TLDs contributing the surge and apply playbooks (rate limits, enhanced review).
gTLDs vs ccTLDs
gTLDs capture about 3 out of 4 new registrations (75%), leaving ccTLDs at 25%.
Why it matters
Brand protection, NRD blocking, and abuse monitoring should default to gTLD coverage, with .com and other high-volume gTLDs at the top of the list.
ccTLDs still represent 1 in 5 new domains - large enough to warrant targeted watchlists, especially for markets with promotional bursts.
Action prompts
Keep separate alert thresholds for gTLD and ccTLD baselines.
On spike days, pivot by country ↔ TLD ↔ registrar to isolate the driver.
Key Takeaways
Scale & visibility: We observed 8.55M newly registered domains.
The August spike in .de, plus gains in .cn, .in, and .ru, suggests stronger local/region-specific demand, promotions, or registrar campaigns. If you’re prioritizing monitoring or outreach, Germany and China look especially active.
A major pullback from China and Japan defined August, while Iceland remained strong and India/Hong Kong grew.
TLD mix:gTLDs dominate (75%) vs ccTLDs (25%). .com is the clear anchor (3.2M+), followed by .de and .xyz; .au and .eu show episodic surges.
Middle-tier gTLDs matter:.xyz, .shop, .top, .online carry meaningful volume and appear in spikes - keep them in scope for detection and brand monitoring.
Country concentration: The United States alone contributes nearly half (~1.30M). Iceland (~493k) and China (~167k) form a strong second tier; Canada and India round out the top five. Smaller markets show campaign-style bursts.
Registrar concentration: Two leaders - GoDaddy (~1.22M) and Namecheap (~931K) - drive a large share. Onamae (GMO), Spaceship and Dynadot form a volatile second tier. The “Others” cohort is still larger than any single registrar - don’t ignore it.
Temporal dynamics: Daily volumes show zig-zag patterns with one-day spikes (notably for .de, .au, .eu, Onamae, and others) and occasional troughs. Use 7/14-day rolling baselines to separate signal from noise.
Where spikes originate: Spikes often localize to specific registrar-TLD-country combinations (e.g., promo windows, portfolio moves). Pivoting across these three axes explains most anomalies.
Risk surface: High volume + high contact details redaction = greater reliance on infrastructure-level detection (hosting clusters, nameservers, certificate reuse) and graph/linkage rather than registrant PII.
