Executive Summary
Over the last month, Sep 2025, we observed 8,450,367 newly registered domains. Nearly 94% of these records have cleaned registrar information, while 41% include cleaned address details. Additionally, gTLDs continue to outpace ccTLDs. Country, registrar, and TLD leaderboards show a highly concentrated head with a long competitive tail.
Key highlights
* Total newly registered: 8,450,367
* TLD mix: gTLDs 82% (6,954,877) vs ccTLDs 18% (1,495,490)
* Top country: United States
Over the last month, Sep 2025, we observed 8,450,367 newly registered domains. Nearly 94% of these records have cleaned registrar information, while 41% include cleaned address details. Additionally, gTLDs continue to outpace ccTLDs. Country, registrar, and TLD leaderboards show a highly concentrated head with a long competitive tail.
Key highlights
Total newly registered: 8,450,367
TLD mix: gTLDs 82% (6,954,877) vs ccTLDs 18% (1,495,490)
Top country: United States (1,338,726)
Top registrar: GoDaddy.com, LLC (1,144,640)
Top TLD: .com (3,118,738)
TLD-wise analysis
Top 20 TLDs - Full Period
The TLD landscape this period is heavily concentrated at the top, led by .com with a sizable gap to the next tier.
Comparison with JULY 2025
.com cooled but still king:3,118,738 in SEP vs 3,288,280 in AUG → -169,542 (-5.16%). Market still revolves around .com, just with a lighter throttle this month.
Budget gTLD goes big: .xyz:913,776 in SEP vs 644,284 in AUG → +269,492 (+41.83%).
Mid-tier wobble:.shop -16.49%, .online -10.53%, .top -8.14%, demand cooled across several promo-sensitive gTLDs.
Country code whiplash:.de came off its AUG spike hard (-86.27%) while .cn also slid (-36.82%). August looked like a one-time surge for these TLDs, resetting to normal in SEP.
New in September’s top-20:
.uk - back on the board: 96,351
.autos - niche with torque: 79,148
.br - Brazil punches in: 77,508 - regional momentum.
.co - startup classic returns: 73,264
Dropped out vs August: .au, .eu, .es, .pro - pushed out by the September reshuffle as other TLDs gained share.
Notable rank moves (overlapping TLDs)
Up: .xyz rose from #3 → #2; strong volume expansion.
Down: .de fell from #2 → #20+
Leaderboard (absolute counts):
What this says:
Market share still centered on .com, but August was an especially strong month for .com (3.29M); September eased off (~3.12M), producing the largest absolute monthly drop among major TLDs.
.xyz was the clear winner in September, jumping ~42% — suggests promotional activity or renewed interest in low-cost gTLDs.
Some country and niche TLDs fell sharply (e.g., .de, .cn, .cc), indicating either one-off bulk registrations in August or a market correction in September.
Many TLDs were stable (small percent changes ± a few percent) indicating steady ongoing demand.
Share of Top 5 TLDs - Pie View
The top five TLDs account for ~72% of all newly registered domains in the month of July; “Others” make up the remaining ~28%.
Implication: A small set of extensions dominates activity. Coverage, alerting, and brand-protection rules should prioritize these five, while still watching for bursts in the “Others” bucket (which can hide sharp, short-lived campaigns).
Daily Dynamics - Top 5 TLDs
.com
Follows a weekly pattern: high on weekdays (≈115k–130k), low on weekends (≈68k–82k).
Biggest day is near the end (about 130k).
Overall: steady and strong all month.
.xyz
Starts low (a few thousand), then climbs fast mid-month to ~40k–46k.
Brief dip, then higher highs: ~65k → ~55k → ~58k → peak near 90k at month end.
One sharp drop (around 7k) looks like a short pause, not a trend.
Overall: fast growth and strong finish.
.top
Very up and down: tops around 9k–11k, lows around 5k–6k.
Several quick swings in the middle of the month.
Finishes with a strong day (~10k+).
Overall: watch for sudden jumps.
.shop
Early month is bumpy (5k–10k), then a mid-month dip (~3.5k–5k).
Big jump near the end to ~13k+, then cools to ~8k–8.5k.
Overall: spikes around sale/promo times.
.org
Regular ups and downs each week: highs around 7.5k–8.8k, lows around 4.7k–5.2k.
Quick bounce-back after each low.
Near the end it hits close to 9k, then settles around 7k+.
Overall: predictable and steady.
Country-wise analysis
Top 20 Countries - Full Period
New registrations are highly concentrated, with the United States far ahead of the pack.
Comparison with JULY 2025
United States:AUG 1,357,261 → SEP 1,338,726 ( -1.37%) - still #1, small dip.
British Virgin Islands:29,165 → 90,722 (+211.06%) - huge lift.
Netherlands:48,567 → 138,500 (+185.17%) - major rise.
Top 3 reordered:US → Iceland → Netherland in Sep (was US → Iceland → China in Aug).
Biggest fallers
China:165,755 → 96,088 (-42.03%) - sharp drop.
India:97,001 → 82,778 (-14.66%).
Germany:44,043 → 41,380 (-6.05%).
Cambodia:29,193 → 27,870 (-4.53%).
Japan:26,033 → 24,712 (-5.07%).
New in SEP Top-20 (not in AUG Top-20)
Poland:24,356
Australia:20,229
South Korea:17,819
Dropped out of the Top-20 (in AUG, not in SEP)
Austria (AUG 34,355)
Czech Republic (AUG 23,760)
Philippines (AUG 20,636)
Leaderboard (absolute counts):
What this says
The U.S. stays far ahead with only a small month-to-month dip.
Iceland, Netherlands, and British Virgin Islands see the biggest jumps.
China and India slow down in SEP.
A few new countries enter the Top-20 (Poland, Australia, South Korea) while Austria, Czech Republic, and Philippines drop out.
Share of Top 5 Countries - Pie View
Top five countries together contribute ~77% of all newly registered domains this period.
Implication: Brand protection, threat monitoring, and registrar partnerships should prioritize these five geographies, while keeping anomaly detection on the “Others” bucket for sudden regional bursts.
Daily Dynamics — Top 5 Countries
United States
Runs in a wide band of 35k - 56k most days.
Clear weekday/weekend pattern: dips to low-30k, then quick rebounds.
Two bigger peaks stand out - one early and one near the end (~65 - 67k).
Short drop after the late peak, then a good last-day lift (~50k).
Overall: high, steady volume with regular weekly waves.
Iceland
Starts high (~28 - 31k), then pulls back to the low-20k range.
Mid-month shows a sharp drop (near 12-14k), but it bounces fast.
From there, it holds 23-27k most days with a few quick swings.
Late month has several strong days near 27-28k, then a small dip and firm close.
Overall: high volume, quick drops, and strong recoveries.
Netherland
Early days ramp up from under 2k to ~8-8.5k quickly.
After a mid-month dip (~1.7k), it climbs back to 4-6k.
Late month keeps a steady 5-6k rhythm with small bumps.
No huge spikes at the end - just a clean, steady finish.
Overall: early surge, mid dip, stable close.
Canada
Moves in a steady range most of the month: 3k-4.6k.
You can see regular weekly dips followed by quick recoveries.
A strong jump appears mid-month (around 4.6k), then eases.
Late month shows two good lifts and then a solid close above 4k.
Overall: stable pattern with routine ups and downs.ts.
Brazil
The month starts with a big spike (around 11-12k), then drops fast.
After that, most days sit between 1.5k and 4k.
There’s another short spike mid-month (around 8k+), then it slides back.
Late in the month, it climbs to 3-3.6k, dips, and ends with a small rise.
Overall: few sharp peaks, many low days - very up and down.
Registrar-wise Analysis
Top 20 Registrars - Full Period
New registrations are highly concentrated among a small set of registrars, with two clear leaders.
Comparison with JULY 2025
GoDaddy.com, LLC:AUG 1,220,522 → SEP 1,144,640 (−75,882, ≈−6.2%). Still #1 by a wide gap.
GoDaddy stays #1, but its new registrations were lower in SEP.
Onamae and Spaceship are the big movers up - both grew a lot.
Hostinger and Tucows fell the most month over month.
The middle of the pack shuffled: some registrars entered the list (e.g., Unstoppable Domains, registrar.eu, Sav), while a few dropped out.
Overall, market is still concentrated at the top, but share is shifting among the next tier.
Share of Top 5 Registrars - Pie View
Within the top five registrars, the mix for this period is:
Implication: While GoDaddy and Namecheap lead, the aggregate of non-top-5 registrars (“Others”) is still the single largest slice, so monitoring must extend beyond the leaders.
One large spike near the end around ~52k-53k, then a quick drop and a solid close (~33k).
Overall: high daily volume with predictable weekly swings.
Namecheap, Inc
Daily range is mostly ~4k-11k.
One big mid-month jump to ~17k-18k, then it comes back to normal levels.
End of month shows several good days (around 9k-11k) and finishes strong (~10k).
Overall: steady mid-tier volume with one clear spike.
GMO Internet Group (Onamae)
Starts low, then jumps hard mid-month to ~48-56k for a couple days.
Brief reset to near zero on one day, then climbs again.
Late month has the strongest days: ~80k-82k, then cools to ~53k-70k.
Pattern: big promo-style waves with very high late-month peaks.
Spaceship, Inc
Early days sit around 12k-16k.
From mid-month onward, it steps up into ~18k-26k, with a couple of top days near 26k-27k.
Late month eases to ~12k-16k, then a small lift at the very end (~15k).
Overall: strong mid-to-high daily numbers with several solid peaks.
Dynadot Inc
Most days sit around 3k-6k new domains.
Two big spikes: early month (~11k) and mid-month (~19-20k).
After each spike, numbers drop back quickly to the usual range.
End of month is steady around 4k-6k.
Overall: few short bursts, otherwise medium, steady flow.
Cleaned vs Redacted - Data Quality Snapshot
Registrar Details
Cleaned:7,938,151 (93.9%) - registrar data is mostly present and usable.
Redacted:512,216 (6.06%).
Takeaway: Registrar fields are reliable for analysis.
What it shows
Lean on registrar, IANA ID, status codes, and creation/expiry dates for coverage-rich enrichment.
Great for trend analysis (NRDs per registrar), policy enforcement, and escalation pathways (registrar abuse desks).
Why it matters
Great foundation for concentration analysis, spike attribution, and enforcement routing.
Enables robust pivoting (Registrar → TLD → Country) to explain anomalies and target actions.
Where to use it
Security Copilot & Phishing Agent: show registrar + NRD age by default; surface contact/address only when present & permitted.
Brand protection: registrar hotspots, fast-flux patterns, and address/contact reuse for impersonation campaigns.
Abuse operations: registrar data for takedown routing and SLA tracking; address/contact (if present) for evidence strength.
Analytics: KPI on NRDs by registrar, % with contact/address present, median first-seen age—to measure control effectiveness over time.
Action
Build registrar-level baselines and anomaly alerts; on spike days, drill into the registrar’s TLD/country mix.
Use registrar signals early in risk scoring and takedown playbooks.
Address Details
Total records:8,450,367.
Redacted:4,974,596 (58.9%) - more than half of addresses are hidden.
Cleaned:3,475,771 (41.1%) - four in ten have useful address data.
Takeaway: Address fields are often masked, but a large chunk is still usable.
What it shows
Expect low coverage for geo/person-level attribution from WHOIS address alone; treat any address hit as high-value but sparse.
Use cleaned addresses mainly for entity clustering (same org/address across many domains), abuse repeat-offender detection, and escalations that need a physical trail.
Why it matters
Solid coverage for geo-segmentation, risk scoring by country/region, and regional enforcement workflows.
Enables address-based clustering when emails/phones are missing.
A product lead with deep expertise in cybersecurity, adept at analyzing cyber threat data to enhance product resilience against emerging security threats.
