Monthly Insights Radar - Newly Registered Domain Analytics for July 2025

Executive Summary

Over the last month, July 2025, we observed 8,671,636 newly registered domains. Nearly 90% of these records have cleaned registrar information, while 50% include cleaned address details. Additionally, gTLDs continue to outpace ccTLDs. Country, registrar, and TLD leaderboards show a highly concentrated head with a long competitive tail.

Key highlights

• Total newly registered: 8,671,636
• TLD mix: gTLDs 80.5% (6,977,808) vs ccTLDs 19.51% (1,693,828)
• Top country: United States (1,796,250)
• Top registrar: GoDaddy.com, LLC (1,087,700)
• Top TLD: .com (3,325,728)

TLD-wise analysis

Top 20 TLDs - Full Period

The TLD landscape this period is heavily concentrated at the top, led by .com with a sizable gap to the next tier.

Leaderboard (absolute counts):

What this says:

• .com remains the default choice for global and commercial use cases.
• Strong country and regional signals: .es, .co and .ru stood out this month, suggesting localized promotions/policy effects or bulk acquisitions when compared with other Country level TLDs.
• The middle tier of gTLDs (.xyz, .shop, .top, .online) should be included in all of your brand and abuse detection workflows - not just .com. These extensions carry meaningful volume, so attackers and bulk registrants use them. If your scope only covers .com (or a tiny TLD set), you’ll miss a large share of relevant registrations and abuse.

Share of Top 5 TLDs - Pie View

The top five TLDs account for ~73% of all newly registered domains in the month of July; “Others” make up the remaining ~27%.

Implication: A small set of extensions dominates activity. Coverage, alerting, and brand-protection rules should prioritize these five, while still watching for bursts in the “Others” bucket (which can hide sharp, short-lived campaigns).

Daily Dynamics - Top 5 TLDs

.com

• High and stable volumes across the month (~110–135k/day),
• One spike has been observed on 23rd of July (320K) followed by immediate return to the baseline.
• The late-period drop looks cyclical (weekend/time-zone effects) rather than structural.

.xyz

• Stable volumes across the month (15-22K)
• One spike has been observed on 23rd of July, followed by immediate return to the base line.

.top

• Stable volumes across the month (10-20K)
• Few days has been observed with no newly registered domains for .top
• One spike has been observed on 8th of July, followed by immediate return to the base line.

.shop

• Stable volumes across the month (4-12K)
• Single dump mid-period against a low baseline.
• Registration remains in the zig-zag pattern nothing that tells us any sort of consistency.

.online

• Stable volumes across the month (5-8K)
• Sharp jump on 23rd of July, quickly retracing to baseline.
• No anomalies detected; the pattern holds steady during weekdays, with dips occurring over the weekend.

Country-wise analysis

Top 20 Countries - Full Period

New registrations are highly concentrated, with the United States far ahead of the pack.

Leaderboard (absolute counts):

What this says

• The US alone accounts for nearly half of all observed registrations this period.
• China and Iceland form a strong second tier; both show episodic surges that can move the daily totals materially.
• The long tail remains meaningful - multiple European and APAC markets contribute steady volume.

Share of Top 5 Countries - Pie View

Top five countries together contribute ~80% of all newly registered domains this period.

Implication: Brand protection, threat monitoring, and registrar partnerships should prioritize these five geographies, while keeping anomaly detection on the “Others” bucket for sudden regional bursts.

Daily Dynamics — Top 5 Countries

United States

• Pattern: High, fairly stable baseline (~60–70k/day) punctuated by a sharp trough (single-digit thousands) and a brief spike to ~130k, then normalization.
• Read: Likely tied to calendar effects (weekend/holiday) and a one-off bulk action or promotion.
• Action: Keep US-focused alerts with rolling baselines.

China

• Pattern: Volatile series with multiple peaks (≈53k and ≈38k) and deep troughs (low thousands).
• Read: Consistent with promo-driven flows, bulk portfolio moves, or registry policy timing.

Iceland

• Pattern: Gradual down-shift from early-period highs, punctuated by brief rebounds; one sharp dip near the floor then recovery.
• Read: Smaller market with campaign-style bursts; totals can swing on a few large buyers.
• Action: Monitor for sudden order-of-magnitude changes; treat spikes as signals to review specific registrars.

Canada

• Pattern: Steady baseline around 3–5k/day with late-period spikes (~11k and ~14k), plus isolated dips.
• Read: Likely coordinated registrar activity or price incentives mid/late period.
• Action: Add short-term surge alerts; correlate with .ca and major Canadian registrars.

Sweden

• Pattern: Low-to-moderate baseline (2–5k/day) with a single tall spike (~11–12k) and a few near-zero dips.
• Read: Smaller market dynamics; spikes can reflect single-actor campaigns or registry events.
• Action: Keep rules sensitive to relative changes rather than absolute counts.

Registrar-wise Analysis

Top 20 Registrars - Full Period

New registrations are highly concentrated among a small set of registrars, with two clear leaders.

Leaderboard (absolute counts):

What this says

• GoDaddy and Namecheap dominate the period; together they represent a very large share of all activity.
• A competitive second tier (Dynadot, Onamae, Hostinger) accounts for a significant chunk and often drives day-to-day volatility.
• The long tail remains meaningful for detection - several mid-size registrars contribute six-figure totals.

Share of Top 5 Registrars - Pie View

Within the top five registrars, the mix for this period is:

Implication: While GoDaddy and Namecheap lead, the aggregate of non-top-5 registrars (“Others”) is still the single largest slice, so monitoring must extend beyond the leaders.

Daily Dynamics - Top 5 Registrars

GoDaddy.com, LLC

• Pattern: Stable baseline (~20–35k/day) with a brief trough near zero and a single sharp spike (~75k), then normalization.
• Read: Likely short-term promo or bulk import. Keep baseline-relative anomaly alerts to catch these surges.

Namecheap, Inc

• Pattern: Mid-teens to low-20k/day most of the period; one pronounced spike (~55k) followed by quick reversion; brief trough near the period’s middle.
• Read: Classic campaign signature. Track Namecheap-associated TLDs on spike days for clustering.

Dynadot Inc

• Pattern: Generally noisy (4–8k/day), with twin mid/late-period peaks (~9–10k) and a sharp one-day dip toward zero.
• Read: Episodic bulk actions. Use rolling 7/14-day baselines to avoid false positives.

GMO Internet Group (Onamae)

• Pattern: Low baseline punctuated by huge one-day spikes (≈60k and ≈160k), then rapid cooldown.
• Read: High-impact promotions or portfolio moves. Treat as a leading indicator for sudden TLD- or country-specific bursts.

Hostinger Operations, UAB

• Pattern: Steady 10–14k/day with a single tall spike (~28k) and short dips (~1–5k).
• Read: Campaign-driven bursts on top of a stable run-rate. Keep registrar-specific surge rules in place.

Cleaned vs Redacted - Data Quality Snapshot

Registrar Details

• Total records: 8,671,636
• Cleaned: 8,067,000 (~93.0%)
• Redacted: 604,636 (~6.97%)

What it shows

Registrar metadata is widely available and stable across records - by far the most complete attribute set.

Why it matters

• Great foundation for concentration analysis, spike attribution, and enforcement routing.
• Enables robust pivoting (Registrar → TLD → Country) to explain anomalies and target actions.

Action

• Build registrar-level baselines and anomaly alerts; on spike days, drill into the registrar’s TLD/country mix.
• Use registrar signals early in risk scoring and takedown playbooks.

Address Details

• Total records: 8,671,636
• Cleaned: 4,489,092 (51.8%)
• Redacted: 4,182,544 (48.2%)

What it shows

Over half of new domains now include usable address fields after cleaning-street/city/state/postal/country. This is the most available PII block compared to contacts.

Why it matters

• Solid coverage for geo-segmentation, risk scoring by country/region, and regional enforcement workflows.
• Enables address-based clustering when emails/phones are missing.

Action

• Lean on address fields for linkage and geo KPIs.
• Keep normalization strict (abbreviations, diacritics, postcode formats) to maximize match rates.

Contact Details

• Total records: 8,671,636
• Cleaned: 350,160 (4.04%)
• Redacted: 8,321,476 (96.0%)

What it shows

Contact-level PII (name, email, phone) is heavily redacted for the vast majority of new registrations.

Why it matters

• Direct outreach and owner attribution are rarely possible at registration time.
• Detection must emphasize non-PII signals: registrar/TLD, nameservers, hosting/SSL, passive DNS, CT logs.

Action

• Prioritize infrastructure & behavior features in classifiers.
• Track the cleaned-contact share as a pipeline health metric; any uplift materially improves enrichment ROI.
• Maintain registrar-specific expectations—some providers are consistently stricter.

Newly / Newly Cleaned - Daily Trend

• Newly shows high volatility with a pronounced mid-period spike (single-day surge) and several dips thereafter.
• Newly_Cleaned remains uniform through out the period.

How to read this

• Spikes often correlate with promotions, bulk portfolio activity, or calendar effects; dips can reflect weekend/holiday cycles or feed lag.

Action prompts

• Use 7–14 day rolling averages for stability; set anomaly alerts relative to each series’ baseline.
• Investigate the spike day: identify registrars/TLDs contributing the surge and apply playbooks (rate limits, enhanced review).

gTLDs vs ccTLDs

gTLDs capture about 4 out of 5 new registrations (80.5%), leaving ccTLDs at 19.5%.

Why it matters

• Brand protection, NRD blocking, and abuse monitoring should default to gTLD coverage, with .com and other high-volume gTLDs at the top of the list.
• ccTLDs still represent 1 in 5 new domains - large enough to warrant targeted watchlists, especially for markets with promotional bursts.

Action prompts

• Keep separate alert thresholds for gTLD and ccTLD baselines.
• On spike days, pivot by country ↔ TLD ↔ registrar to isolate the driver.

Key Takeaways

• Scale & visibility: We observed 8.67M newly registered domains.
• TLD mix: gTLDs dominate (80.5%) vs ccTLDs (9.51%). .com is the clear anchor (770k+), followed by .de and .xyz; .au and .eu show episodic surges.
• Middle-tier gTLDs matter: .xyz, .shop, .top, .online carry meaningful volume and appear in spikes - keep them in scope for detection and brand monitoring.
• Country concentration: The United States alone contributes nearly half (~1.80M). China (~607k) and Iceland (~489k) form a strong second tier; Canada and Sweden round out the top five. Smaller markets show campaign-style bursts.
• Registrar concentration: Two leaders—GoDaddy (~1.09M) and Namecheap (~0.94M)—drive a large share. Dynadot, Onamae (GMO), Hostinger form a volatile second tier. The “Others” cohort is still larger than any single registrar - don’t ignore it.
• Temporal dynamics: Daily volumes show zig-zag patterns with one-day spikes (notably for .de, .au, .eu, Onamae, and others) and occasional troughs. Use 7/14-day rolling baselines to separate signal from noise.
• Where spikes originate: Spikes often localize to specific registrar-TLD-country combinations (e.g., promo windows, portfolio moves). Pivoting across these three axes explains most anomalies.
• Risk surface: High volume + high contact details redaction = greater reliance on infrastructure-level detection (hosting clusters, nameservers, certificate reuse) and graph/linkage rather than registrant PII.