Over the last month, July 2025, we observed 8,671,636 newly registered domains. Nearly 90% of these records have cleaned registrar information, while 50% include cleaned address details. Additionally, gTLDs continue to outpace ccTLDs. Country, registrar, and TLD leaderboards show a highly concentrated head with a long competitive tail.
Key highlights
Total newly registered: 8,671,636
TLD mix: gTLDs 80.5% (6,977,808) vs ccTLDs 19.51% (1,693,828)
Top country: United States (1,796,250)
Top registrar: GoDaddy.com, LLC (1,087,700)
Top TLD: .com (3,325,728)
TLD-wise analysis
Top 20 TLDs - Full Period
The TLD landscape this period is heavily concentrated at the top, led by .com with a sizable gap to the next tier.
Leaderboard (absolute counts):
What this says:
.com remains the default choice for global and commercial use cases.
Strong country and regional signals: .es, .co and .ru stood out this month, suggesting localized promotions/policy effects or bulk acquisitions when compared with other Country level TLDs.
The middle tier of gTLDs (.xyz, .shop, .top, .online) should be included in all of your brand and abuse detection workflows - not just .com. These extensions carry meaningful volume, so attackers and bulk registrants use them. If your scope only covers .com (or a tiny TLD set), you’ll miss a large share of relevant registrations and abuse.
Share of Top 5 TLDs - Pie View
The top five TLDs account for ~73% of all newly registered domains in the month of July; “Others” make up the remaining ~27%.
Implication: A small set of extensions dominates activity. Coverage, alerting, and brand-protection rules should prioritize these five, while still watching for bursts in the “Others” bucket (which can hide sharp, short-lived campaigns).
Daily Dynamics - Top 5 TLDs
.com
High and stable volumes across the month (~110–135k/day),
One spike has been observed on 23rd of July (320K) followed by immediate return to the baseline.
The late-period drop looks cyclical (weekend/time-zone effects) rather than structural.
.xyz
Stable volumes across the month (15-22K)
One spike has been observed on 23rd of July, followed by immediate return to the base line.
.top
Stable volumes across the month (10-20K)
Few days has been observed with no newly registered domains for .top
One spike has been observed on 8th of July, followed by immediate return to the base line.
.shop
Stable volumes across the month (4-12K)
Single dump mid-period against a low baseline.
Registration remains in the zig-zag pattern nothing that tells us any sort of consistency.
.online
Stable volumes across the month (5-8K)
Sharp jump on 23rd of July, quickly retracing to baseline.
No anomalies detected; the pattern holds steady during weekdays, with dips occurring over the weekend.
Country-wise analysis
Top 20 Countries - Full Period
New registrations are highly concentrated, with the United States far ahead of the pack.
Leaderboard (absolute counts):
What this says
The US alone accounts for nearly half of all observed registrations this period.
China and Iceland form a strong second tier; both show episodic surges that can move the daily totals materially.
The long tail remains meaningful - multiple European and APAC markets contribute steady volume.
Share of Top 5 Countries - Pie View
Top five countries together contribute ~80% of all newly registered domains this period.
Implication: Brand protection, threat monitoring, and registrar partnerships should prioritize these five geographies, while keeping anomaly detection on the “Others” bucket for sudden regional bursts.
Daily Dynamics — Top 5 Countries
United States
Pattern: High, fairly stable baseline (~60–70k/day) punctuated by a sharp trough (single-digit thousands) and a brief spike to ~130k, then normalization.
Read: Likely tied to calendar effects (weekend/holiday) and a one-off bulk action or promotion.
Action: Keep US-focused alerts with rolling baselines.
China
Pattern:Volatile series with multiple peaks (≈53k and ≈38k) and deep troughs (low thousands).
Read: Consistent with promo-driven flows, bulk portfolio moves, or registry policy timing.
Iceland
Pattern: Gradual down-shift from early-period highs, punctuated by brief rebounds; one sharp dip near the floor then recovery.
Read: Smaller market with campaign-style bursts; totals can swing on a few large buyers.
Action: Monitor for sudden order-of-magnitude changes; treat spikes as signals to review specific registrars.
Canada
Pattern: Steady baseline around 3–5k/day with late-period spikes (~11k and ~14k), plus isolated dips.
Read: Likely coordinated registrar activity or price incentives mid/late period.
Action: Add short-term surge alerts; correlate with .ca and major Canadian registrars.
Sweden
Pattern: Low-to-moderate baseline (2–5k/day) with a single tall spike (~11–12k) and a few near-zero dips.
Read: Smaller market dynamics; spikes can reflect single-actor campaigns or registry events.
Action: Keep rules sensitive to relative changes rather than absolute counts.
Registrar-wise Analysis
Top 20 Registrars - Full Period
New registrations are highly concentrated among a small set of registrars, with two clear leaders.
Leaderboard (absolute counts):
What this says
GoDaddy and Namecheap dominate the period; together they represent a very large share of all activity.
A competitive second tier (Dynadot, Onamae, Hostinger) accounts for a significant chunk and often drives day-to-day volatility.
The long tail remains meaningful for detection - several mid-size registrars contribute six-figure totals.
Share of Top 5 Registrars - Pie View
Within the top five registrars, the mix for this period is:
Implication: While GoDaddy and Namecheap lead, the aggregate of non-top-5 registrars (“Others”) is still the single largest slice, so monitoring must extend beyond the leaders.
Daily Dynamics - Top 5 Registrars
GoDaddy.com, LLC
Pattern: Stable baseline (~20–35k/day) with a brief trough near zero and a single sharp spike (~75k), then normalization.
Read: Likely short-term promo or bulk import. Keep baseline-relative anomaly alerts to catch these surges.
Namecheap, Inc
Pattern: Mid-teens to low-20k/day most of the period; one pronounced spike (~55k) followed by quick reversion; brief trough near the period’s middle.
Read: Classic campaign signature. Track Namecheap-associated TLDs on spike days for clustering.
Dynadot Inc
Pattern: Generally noisy (4–8k/day), with twin mid/late-period peaks (~9–10k) and a sharp one-day dip toward zero.
Read: Episodic bulk actions. Use rolling 7/14-day baselines to avoid false positives.
GMO Internet Group (Onamae)
Pattern: Low baseline punctuated by huge one-day spikes (≈60k and ≈160k), then rapid cooldown.
Read: High-impact promotions or portfolio moves. Treat as a leading indicator for sudden TLD- or country-specific bursts.
Hostinger Operations, UAB
Pattern: Steady 10–14k/day with a single tall spike (~28k) and short dips (~1–5k).
Read: Campaign-driven bursts on top of a stable run-rate. Keep registrar-specific surge rules in place.
Cleaned vs Redacted - Data Quality Snapshot
Registrar Details
Total records:8,671,636
Cleaned:8,067,000 (~93.0%)
Redacted:604,636 (~6.97%)
What it shows
Registrar metadata is widely available and stable across records - by far the most complete attribute set.
Why it matters
Great foundation for concentration analysis, spike attribution, and enforcement routing.
Enables robust pivoting (Registrar → TLD → Country) to explain anomalies and target actions.
Action
Build registrar-level baselines and anomaly alerts; on spike days, drill into the registrar’s TLD/country mix.
Use registrar signals early in risk scoring and takedown playbooks.
Address Details
Total records:8,671,636
Cleaned:4,489,092 (51.8%)
Redacted:4,182,544 (48.2%)
What it shows
Over half of new domains now include usable address fields after cleaning-street/city/state/postal/country. This is the most available PII block compared to contacts.
Why it matters
Solid coverage for geo-segmentation, risk scoring by country/region, and regional enforcement workflows.
Enables address-based clustering when emails/phones are missing.
Action
Lean on address fields for linkage and geo KPIs.
Keep normalization strict (abbreviations, diacritics, postcode formats) to maximize match rates.
Contact Details
Total records:8,671,636
Cleaned:350,160 (4.04%)
Redacted:8,321,476 (96.0%)
What it shows
Contact-level PII (name, email, phone) is heavily redacted for the vast majority of new registrations.
Why it matters
Direct outreach and owner attribution are rarely possible at registration time.
Prioritize infrastructure & behavior features in classifiers.
Track the cleaned-contact share as a pipeline health metric; any uplift materially improves enrichment ROI.
Maintain registrar-specific expectations—some providers are consistently stricter.
Newly / Newly Cleaned - Daily Trend
Newly shows high volatility with a pronounced mid-period spike (single-day surge) and several dips thereafter.
Newly_Cleaned remains uniform through out the period.
How to read this
Spikes often correlate with promotions, bulk portfolio activity, or calendar effects; dips can reflect weekend/holiday cycles or feed lag.
Action prompts
Use 7–14 day rolling averages for stability; set anomaly alerts relative to each series’ baseline.
Investigate the spike day: identify registrars/TLDs contributing the surge and apply playbooks (rate limits, enhanced review).
gTLDs vs ccTLDs
gTLDs capture about 4 out of 5 new registrations (80.5%), leaving ccTLDs at 19.5%.
Why it matters
Brand protection, NRD blocking, and abuse monitoring should default to gTLD coverage, with .com and other high-volume gTLDs at the top of the list.
ccTLDs still represent 1 in 5 new domains - large enough to warrant targeted watchlists, especially for markets with promotional bursts.
Action prompts
Keep separate alert thresholds for gTLD and ccTLD baselines.
On spike days, pivot by country ↔ TLD ↔ registrar to isolate the driver.
Key Takeaways
Scale & visibility: We observed 8.67M newly registered domains.
TLD mix:gTLDs dominate (80.5%) vs ccTLDs (9.51%). .com is the clear anchor (770k+), followed by .de and .xyz; .au and .eu show episodic surges.
Middle-tier gTLDs matter:.xyz, .shop, .top, .online carry meaningful volume and appear in spikes - keep them in scope for detection and brand monitoring.
Country concentration: The United States alone contributes nearly half (~1.80M). China (~607k) and Iceland (~489k) form a strong second tier; Canada and Sweden round out the top five. Smaller markets show campaign-style bursts.
Registrar concentration: Two leaders—GoDaddy (~1.09M) and Namecheap (~0.94M)—drive a large share. Dynadot, Onamae (GMO), Hostinger form a volatile second tier. The “Others” cohort is still larger than any single registrar - don’t ignore it.
Temporal dynamics: Daily volumes show zig-zag patterns with one-day spikes (notably for .de, .au, .eu, Onamae, and others) and occasional troughs. Use 7/14-day rolling baselines to separate signal from noise.
Where spikes originate: Spikes often localize to specific registrar-TLD-country combinations (e.g., promo windows, portfolio moves). Pivoting across these three axes explains most anomalies.
Risk surface: High volume + high contact details redaction = greater reliance on infrastructure-level detection (hosting clusters, nameservers, certificate reuse) and graph/linkage rather than registrant PII.
