Executive Summary
In November 2025, newly registered domains showed a concentration around the United States and a few high-volume outliers. Registrar activity remained dominated by GMO, GoDaddy, and Namecheap, while secondary players (Spaceship, Dynadot) weakened materially versus October. Data usability is highly asymmetric: registrar fields are largely available and reliable for analytics, while contact details are mostly redacted, limiting identity-centric insights. Overall, the report indi
Monthly Insights Radar - Newly Registered Domain Analytics for NOV 2025
Monthly Insights Radar - Newly Registered Domain Analytics for NOV 2025
Published: December 30, 2025
Last Updated: Dec 30, 2025
Executive Summary
In November 2025, newly registered domains showed a concentration around the United States and a few high-volume outliers. Registrar activity remained dominated by GMO, GoDaddy, and Namecheap, while secondary players (Spaceship, Dynadot) weakened materially versus October. Data usability is highly asymmetric: registrar fields are largely available and reliable for analytics, while contact details are mostly redacted, limiting identity-centric insights. Overall, the report indicates a gTLD-heavy registration mix and strong mid-month surges.
Key highlights
Country concentration: United States leads the top-country mix at 36.6%; Iceland (23.5%) nearly matches Others (24.1%), indicating a major non-US driver.
China anomaly: one early-month spike (~16k–18k/day) is a clear outlier; the remainder normalizes to ~3k–6k/day.
US demand volatility: US daily volume ranges roughly ~21k to ~45k, with a dominant mid-month peak and multiple periodic dips.
Registrar leadership (Oct → Nov):GMO +8.1% (1,131,877 → 1,223,009) while GoDaddy −4.5% and Namecheap −9.4%.
Largest registrar declines:Spaceship −25.3% and Dynadot −20.8% month-over-month among top registrars.
Top-list churn (registrars):Added in Nov: Chengdu West Dimension, Metaregistrar, Qingyu He; Dropped: PublicDomainRegistry, Network Solutions, Alibaba Cloud/HiChina.
Data coverage reality:Contact details are 96.8% redacted (only 3.23% cleaned), while registrar details are 81.9% cleaned, making registrar-based reporting far more dependable than contact-based analysis.
TLD-wise analysis
Top 20 TLDs - Full Period
The TLD landscape this period is heavily concentrated at the top, led by .com with a sizable gap to the next tier.
Comparison with October 2025
Newly added in November (entered Top-20):
.it → 1,497,813 (new entry, ranked #2)
Removed in November (dropped out of Top-20):
.in → was 72,054 in October (ranked #20), not in November Top-20
.com stayed #1, but declined by 172,601 (-5.2%) in November.
.bond was the clear winner in October, jumping ~163% - suggests promotional activity or renewed interest in low-cost gTLDs.
Some country and niche TLDs fell sharply (e.g., .ru, .cn), indicating either one-off bulk registrations in October or a market correction in October.
Share of Top 5 TLDs - Pie View
The top five TLDs account for ~73.2% of all newly registered domains in the month of October; “Others” make up the remaining ~27%.
.com is the clear market leader, accounting for 35.6% of all newly registered domains in this snapshot - more than any other single slice and roughly 2.1× the share of .it.
Long-tail remains significant: the “Others” bucket represents 26.8%, indicating that beyond the top 5 TLDs there is still a substantial volume distributed across many smaller/less frequent TLDs.
.it is the strongest non-.com performer at 16.8%, positioning it as the dominant challenger and a major driver of volume among country/alternative extensions.
Daily Dynamics - Top 5 TLDs
.com
Stable operating band most days (~110k–125k): Outside of periodic troughs, .com remains consistently high, reflecting steady baseline demand.
Regular “weekly-style” dips: Sharp drops appear around Nov 2, 9, 16, 23, and 30, bottoming roughly ~70k–85k, then quickly recovering - consistent with weekend/processing-cycle effects.
Mid-month peak: Highest point is around ~125k–126k (roughly Nov 12–14), after which levels normalize back to the 110k–120k range.
Month-end softness: After a late-month recovery (~118k–120k), the series declines again toward the end, closing with a visible drop on Nov 30 (mid-80k range).
.it
Concentrated activity window: Near-zero from the start of the month until roughly Nov 6, then a burst of heavy activity through about Nov 16, followed by flat near-zero from ~Nov 17 to month-end.
Large-scale spikes (six-figure days): Jumps rapidly to roughly ~130k–180k in the first burst week, culminating in a major peak near ~265k around Nov 12.
Fast decay after the peak: After the high, the curve trends downward across the following days (roughly ~180k → ~160k → ~130k → ~55k).
Operational implication: The “on/off” behavior suggests batch posting, delayed reporting, or a one-time campaign-driven surge, rather than normal daily demand.
.xyz
Low early month baseline (single-digit to thousands): Most of the first half sits around ~4k–10k, with a brief early spike to roughly ~32k (around Nov 4–5).
Mid-month step-up: Around Nov 17–19, the series plateaus near ~45k–47k, indicating a structural lift versus earlier days.
Late-month acceleration into a major peak: From roughly Nov 23 onward, registrations climb sharply (≈ ~38k → ~48k → ~72k → ~90k) to a peak near ~100k–101k around Nov 28.
Sharp correction at the end: Immediately after the peak, the line drops hard (down to the ~35k range) and closes near ~12k on Nov 30, signaling the surge was temporary.
.bond
Highly bursty pattern with many near-zero days: Several stretches sit at ~0, indicating registrations arrive in batches rather than evenly day-to-day.
Two dominant spikes (~82–83k): One occurs in the first week (around Nov 5–6) and another in the third week (around Nov 22–23), each followed by an immediate drop back to low/near-zero levels.
Secondary surges: A mid-month pop reaches roughly ~45k (around Nov 13–14), and another late-month spike hits ~47k (around Nov 26).
End-of-month lift: The series finishes with a rebound to about ~40k on Nov 29–30, after multiple low/zero days.
.info
Early volatility with a low baseline: Starts with a trough near ~6–7k (around Nov 2), then quickly rebounds into the teens and low-20ks.
Strong mid-month plateau: From roughly Nov 11–15, daily registrations cluster around ~22k–26k, showing sustained strength versus the month’s earlier levels.
Monthly high around ~28k: A clear peak occurs around Nov 19–20, followed by a sharp pullback.
Late-month decline and partial recovery: Drops to about ~9k around Nov 23, rebounds to ~18k around Nov 25–26, then fades again before a small end-month bounce.
Country-wise analysis
Top 20 Countries - Full Period
New registrations are highly concentrated, with the United States far ahead of the pack.
United States: 1,365,082 → 968,307 → -396,775 (-29.1%)
Hong Kong: 55,183 → 39,888 → -15,295 (-27.7%)
Iceland: 792,444 → 621,674 → -170,770 (-21.5%)
Leaderboard (absolute counts):
What this says
Total (Top-20) fell from 3,152,420 (Oct) to 2,645,105 (Nov) → -507,315 (-16.1%).
The drop is largely explained by the top two countries:
United States:-396,775 (-29.1%)
Iceland:-170,770 (-21.5%)
At the same time, the distribution became less concentrated: US+Iceland share of the Top-20 fell from 68.4% (Oct) to 60.1% (Nov).
Share of Top 5 Countries - Pie View
Top five countries together contribute ~76% of all newly registered domains this period.
Implication: Brand protection, threat monitoring, and registrar partnerships should prioritize these five geographies, while keeping anomaly detection on the “Others” bucket for sudden regional bursts.
Daily Dynamics - Top 5 Countries
United States
Largest scale and highest volatility among these charts: The month ranges roughly from ~21k (lows) to ~44k (peak), with multiple sharp reversals.
Repeated deep troughs: Clear drops occur around Nov 2 and Nov 9–10 (both near ~21k), plus another dip around Nov 15–16 (~23k) - suggesting periodic reporting/behavior cycles.
Mid-month breakout event: A pronounced spike around Nov 18–19 reaches approximately ~44k, followed by a multi-day decline back toward the low-30k range.
Late-month stabilization: After dipping near ~24k–26k around Nov 23–24, the series rebounds to ~33k–34k and then gradually tapers, closing near ~29k–31k.
Iceland
High-volume market with wide swings: Daily totals oscillate roughly between ~15k and ~26k, indicating meaningful volatility relative to its baseline.
Multiple strong peaks: Prominent highs occur early and mid-month (near ~25k–26k), with another sharp late-month jump around Nov 24–25 (again ~25k).
Recurring troughs around ~15k–16k: Deep dips appear around Nov 9–10, Nov 16, and Nov 23, consistent with a cyclical pattern rather than random noise.
Sharp drop into month-end: After the late-month spike and brief stabilization around ~20k, the series finishes near ~15k on Nov 30, one of the lowest points in the month.
Lithuania
Mid-range market with pronounced cycles: Values generally run ~5.0k–6.8k, but with clear troughs and spikes that move the line materially week to week.
Early dip, then recovery: After an early slide toward ~5k, the series drops to a notable low around Nov 9–10 (~3.3k), then rebounds back above ~5.5k.
Strongest surge mid/late-month: The highest point lands around Nov 19–20 (~7.4k), followed by a pullback into the ~5k range.
Late-month resilience: After dipping around Nov 23 (~4.9k), volumes recover to ~6.4k–6.8k for several days before easing to ~5.5k at month-end.
China
One extreme early-month spike dominates the shape: Around Nov 2–3, registrations jump to roughly ~16k–18k, far above the rest of the month.
Post-spike normalization: After the surge, volumes revert to a relatively tight operating range of ~3k–5k for most remaining days.
Intermittent mid-month bumps: Several small peaks reach ~5.5k–6k (mid-month and late-month), but they are short-lived and quickly revert.
Month ends subdued: The final point drops back toward the lower end of the band (roughly ~3k), reinforcing that the early spike was not sustained.
Canada
Stable core band with periodic dips: Most days sit around 3.4k–3.7k, with recurring pullbacks into the ~2.4k–2.9k range (notably around Nov 2 and Nov 9–10).
Peaks are consistent and repeatable: Multiple local highs cluster near ~3.7k (early month, mid-month, and again around Nov 20–22), suggesting steady demand rather than one-off bursts.
Mid/late-month soft spots: Clear troughs appear around Nov 9–10 (~2.35k) and again around Nov 23–24 (~2.7k) before recovering.
Ends lower than the typical band: The last few days drift down from low-3k to roughly ~2.6k on Nov 30, indicating a softer close versus the mid-month highs.
Registrar-wise Analysis
Top 20 Registrars - Full Period
New registrations are highly concentrated among a small set of registrars, with two clear leaders.
Comparison with October 2025
Newly added in November (entered Top-20):
Chengdu West Dimension Digital Technology Co., Ltd:112,745
Total volume (Top-20) decreased from 6,296,815 (Oct) to 6,085,165 (Nov) → -211,650 (-3.36%).
Leadership strengthened at the top: GMO increased while GoDaddy declined, widening GMO’s lead over GoDaddy from 26,555 (Oct) to 167,932 (Nov).
Share of Top 5 Registrars - Pie View
Within the top five registrars, the mix for this period is:
Implication: While GoDaddy and Namecheap lead, the aggregate of non-top-5 registrars (“Others”) is still the single largest slice, so monitoring must extend beyond the leaders.
Daily Dynamics - Top 5 Registrars
GMO Internet Group (Onamae)
Extremely spiky, “batch-like” behavior: The line repeatedly swings from near-zero to tens of thousands in short intervals, implying bursts rather than steady daily volume.
Multiple major peaks clustered late-month: The biggest surges appear around Nov 22 (~100k+) and Nov 26–27 (~115k–120k), with elevated levels persisting briefly before dropping.
Mid-month interruptions are pronounced: Several near-zero points around Nov 15–16 break the continuity, reinforcing the impression of irregular processing or episodic release cycles.
Ends elevated versus early month: While early November includes near-zero days, the final week remains largely in a much higher range (often ~40k–90k+), even as it cools into month-end.
GoDaddy.com, LLC
Stable baseline with one major mid-month breakout: Most of the month sits around ~20k–30k/day, except for a sharp spike around Nov 18–19 (peaking ~45k).
Clear “shock and normalization” pattern: Immediately after the mid-month peak, counts step down across several days (mid-30k → low-30k → low-20k), indicating a rapid normalization rather than a new plateau.
Two low points stand out: The most visible troughs occur around Nov 10 (~18–19k) and Nov 24 (~20k), both followed by recovery.
Late-month steadier but slightly softer: The last week stabilizes around ~26k–29k/day before easing toward ~23k at the end.
Namecheap, Inc
Upward momentum concentrated in the second half: Early/mid-month sits mostly in the ~14k–22k/day zone, then climbs strongly around Nov 18–22 (~23k–27k).
Distinct trough and sharp rebound: A meaningful low appears around Nov 10 (~10–11k), followed by a fast rebound back into the high-teens/low-20s within a few days.
Late-month peak followed by cooling: The highest point appears in the Nov 25–26 window (~28k), then volume tapers into month-end.
Month-end drop is noticeable: Despite a strong last-week run, the line falls to about ~17k on the final day, signaling a short-term pullback.
Spaceship, Inc
Early-month surge dominates the chart: After starting near ~14k–15k, Spaceship spikes sharply to ~25k and reaches its month high near ~30k (around Nov 6–7).
Structural downshift after the peak: Following the early spike, registrations compress into a lower band (mostly ~12k–18k), with fewer high excursions.
Mid-month trough then a long low plateau: The clearest low is around Nov 16 (~9–10k), after which the series stays relatively flat around ~10k–11k for several days.
Late-month volatility returns but peaks are smaller: The last week includes rebounds (mid-teens and a jump near ~18k), but none approach the early-month ~30k high; it ends around ~15k.
Dynadot Inc
High volatility with a clear mid-month surge: Early November oscillates mostly in the ~6k–9k/day band, followed by a sharp breakout around Nov 20 (~17k/day peak) before reverting.
Two distinct trough windows: A notable dip occurs around Nov 1–2 (~5.5k) and again around Nov 15–16 (~5k), indicating short-lived slowdowns rather than a sustained decline.
Late-month recovery but not a full return to peak: After dropping again around Nov 23 (~6–7k), registrations rebuild into the ~10k–12k/day range toward the last week.
Month-end softening: Despite the late-month rebound, the series finishes lower (around ~8k), suggesting demand cooled after the late-month highs.
Cleaned vs Redacted - Data Quality Snapshot
Registrar Details
Cleaned:8,777,800 (81.9%) - registrar data is mostly present and usable.
Redacted:1,940,360 (18.1%).
Takeaway: Registrar fields are reliable for analysis.
What it shows
Interpretation: registrar metadata is comparatively reliable and broadly available, an excellent backbone dimension for reporting and trend analysis.
Practical implication: registrar-based analytics (share, growth, churn, anomaly detection) should be far less biased by redaction than address/contact-based analytics.
Why it matters
Great foundation for concentration analysis, spike attribution, and enforcement routing.
Enables robust pivoting (Registrar → TLD → Country) to explain anomalies and target actions.
Where to use it
Security Copilot & Phishing Agent: show registrar + NRD age by default; surface contact/address only when present & permitted.
Brand protection: registrar hotspots, fast-flux patterns, and address/contact reuse for impersonation campaigns.
Abuse operations: registrar data for takedown routing and SLA tracking; address/contact (if present) for evidence strength.
Analytics: KPI on NRDs by registrar, % with contact/address present, median first-seen age, to measure control effectiveness over time.
Action
Build registrar-level baselines and anomaly alerts; on spike days, drill into the registrar’s TLD/country mix.
Use registrar signals early in risk scoring and takedown playbooks.
Address Details
Total records:10,718,160.
Redacted:7,696,783 (71.8%) - more than 70% of the addresses are hidden.
Cleaned:3,021,377 (28.2%) - three in ten have useful address data.
Takeaway: Address fields are often masked, but a large chunk is still usable.
What it shows
Interpretation: address data is partially available, but privacy/redaction still impacts the majority of address-level enrichment.
Practical implication: address-based segmentation will work best when combined with non-address signals (registrar, TLD, country, nameserver patterns) to avoid bias from redaction-heavy subsets.
Why it matters
Solid coverage for geo-segmentation, risk scoring by country/region, and regional enforcement workflows.
Enables address-based clustering when emails/phones are missing.
Risk scoring feature: “WHOIS address present?” (+weight) and address reuse count (signals mass registrations).
Contact Details
Total:10,718,160 records evaluated for contact fields.
Near-total redaction:10,372,000 (96.8%) contact records are redacted.
Minimal cleaned coverage: only 346,160 (3.23%) have cleaned contact details.
Takeaway: Expect very limited direct contact info.
What it shows
Interpretation: contact fields are the most privacy-protected of the datasets shown (consistent with GDPR/privacy proxy usage).
Practical implication: contact-centric workflows (lead-gen, outreach datasets, identity resolution) will have limited coverage and should rely more on domain behavior + infrastructure metadata.
Why it matters
Direct outreach and owner attribution are rarely possible at registration time.
Prioritize infrastructure & behavior features in classifiers.
Track the cleaned-contact share as a pipeline health metric; any uplift materially improves enrichment ROI.
Maintain registrar-specific expectations - some providers are consistently stricter.
Newly / Newly Cleaned - Daily Trend
Two series with very different scales:“Newly” runs roughly ~210k to ~560k/day, while “Newly_Cleaned” stays near the chart floor most days.
Newly peaks mid-month (highest point around the ~550k+ mark), followed by a decline and then moderate oscillation.
Cleaned shows “batch spikes” (notably early-month and mid-month), jumping tens of thousands on select days, then reverting back to low baseline.
Interpretation: cleaning/enrichment likely runs in periodic batches or lags ingestion, rather than tracking daily registrations proportionally.
Practical implication: if you publish “cleaned” metrics daily, call out the pipeline cadence explicitly. Otherwise, audiences may misread batch spikes as real market demand changes.
gTLDs vs ccTLDs
gTLDs dominate:7,723,135 (72.1%) are gTLD registrations.
ccTLDs are sizable:2,995,025 (27.9%) are ccTLD registrations, roughly ~1 in 4.
Why it matters
Interpretation: the dataset is strongly gTLD-weighted, but ccTLD activity remains strategically significant (regional policy + local adoption effects).
Practical implication: if your audience cares about local-market signals, ccTLD slicing can surface trends that are muted in the gTLD majority.
Action prompts
Keep separate alert thresholds for gTLD and ccTLD baselines.
On spike days, pivot by country ↔ TLD ↔ registrar to isolate the driver.
A product lead with deep expertise in cybersecurity, adept at analyzing cyber threat data to enhance product resilience against emerging security threats.
