Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
WhoisXML API analyzed 10.2+ million domains registered between 1 and 30 April 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number rose by 14.1% from 8.9+ million NRDs last month.
We also determined the top TLD extensions used by 2.7+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in April 2026. This number rose by 30.8% from the previous month.
Next, we studied the top TLD extensions of 1.11+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which decreased by 2.0% from 1.13+ million in March.
Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.
Zooming in on the April 2026 NRDs
TLD Distribution
Out of the 10.2+ million domains registered in April 2026, 80.8%, up from 80.2% last month, used gTLD extensions. The remaining 19.2%, down from 19.8%, meanwhile, used ccTLD extensions.
In April 2026, the .org and .xyz TLDs ousted two of last month’s TLD topnotchers, .cn and .lol.
The .org rise may partly reflect early registration and renewal activity ahead of Public Interest Registry’s scheduled wholesale price increase from US$9.93 to US$11.00 per domain per year on 1 June 2026, as reported by Domain Name Wire.
The .xyz increase, on the other hand, may be aligned with continued demand for newer and lower-cost alternatives to .com, alongside sustained registrar promotions of the TLD across startup, creator, and experimental web projects.
Here is a MoM comparison with ranking changes for the top 5 TLD extensions of the April 2026 NRDs.
| APRIL 2026 TOP TLD | APRIL 2026 TLD VOLUME | MARCH 2026 TLD VOLUME | RANKING CHANGE FROM MARCH TO APRIL 2026 |
| .com | 4,148,350 | 3,792,947 | → (Unchanged) |
| .top | 554,439 | 277,990 | ↑ from 3 to 2 |
| .shop | 287,685 | 381,377 | ↓ from 2 to 3 |
| .org | 279,014 | 235,982 | ↑ from 6 to 4 |
| .xyz | 249,313 | 218,222 | ↑ from 8 to 5 |
Overall, the top 5 NRD TLD volume rose by 11.8% from 4.9+ million in March to 5.5+ million in April 2026.
We then analyzed the April 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.
The top 5 TLDs for April 2026 were also the top 5 gTLDs. Compared with last month’s top gTLDs, however, .lol dropped out of the top 5 with .org moving to its former spot (i.e., fourth place). This month’s top 5 TLD was .xyz.
Here is a MoM comparison and ranking changes for the top 5 gTLD extensions used by this month’s NRDs.
| APRIL 2026 TOP gTLD | APRIL 2026 gTLD VOLUME | MARCH 2026 gTLD VOLUME | RANKING CHANGE FROM MARCH TO APRIL 2026 |
| .com | 4,148,350 | 3,792,947 | → (Unchanged) |
| .top | 554,439 | 277,990 | ↑ from 3 to 2 |
| .shop | 287,685 | 381,377 | ↓ from 2 to 3 |
| .org | 279,014 | 235,982 | ↑ from 5 to 4 |
| .xyz | 249,313 | 218,222 | ↑ from 7 to 5 |
Overall, the top 5 NRD gTLD volume rose by 12.0% from 4.9+ million in March to 5.5+ million in April 2026.
For the .ccTLD space, .cn remained the most utilized ccTLD this month. However, .us evicted .br from the top 5.
The sharp rise in .us registrations may reflect registrar promotions, campaign-driven bulk registrations, or increased interest in U.S.-focused web properties during the period. The .us namespace maintains strong geographic association with the U.S. through its Nexus requirements and local branding appeal.
Here is a MoM comparison with ranking changes for the top 5 ccTLD extensions of the April 2026 NRDs.
| APRIL 2026 TOP ccTLD | APRIL 2026 ccTLD VOLUME | MARCH 2026 ccTLD VOLUME | RANKING CHANGE FROM MARCH TO APRIL 2026 |
| .cn | 242,710 | 247,839 | → (Unchanged) |
| .uk | 165,506 | 162,629 | → (Unchanged) |
| .ru | 161,462 | 158,680 | → (Unchanged) |
| .us | 148,368 | 27,893 | ↑ from 16 to 4 |
| .cc | 141,948 | 116,604 | → (Unchanged) |
Overall, the top 5 NRD ccTLD volume rose by 6.8% from 805,357 in March to 859,994 in April 2026.
Registrar Distribution
This month’s top 5 registrar list had one new entrant—Hostinger Operations placed fifth, while former third placer GMO Internet Group dropped out.
Hostinger Operations’ rise in ranking may be aligned with its continued positioning around streamlined website creation and bundled hosting workflows. In April 2026, the registrar continued promoting Hostinger Horizons, an AI-powered website and web app builder that enables users to create sites from prompts. Integrated website-building and hosting bundles can contribute to higher domain registration volumes because domain purchase is often part of the same onboarding flow.
Here is a MoM comparison with ranking changes for the top 5 NRD registrars.
| APRIL 2026 TOP REGISTRAR | APRIL 2026 REGISTRAR VOLUME | MARCH 2026 REGISTRAR VOLUME | RANKING CHANGE FROM MARCH TO APRIL 2026 |
| GoDaddy | 1,449,009 | 1,145,314 | → (Unchanged) |
| Namecheap | 1,130,313 | 918,436 | → (Unchanged) |
| Dynadot | 690,446 | 437,457 | ↑ from 4 to 3 |
| Spaceship | 652,378 | 402,343 | ↑ from 5 to 4 |
| Hostinger Operations | 451,563 | 364,134 | ↑ from 6 to 5 |
Overall, the top 5 NRD registrar volume rose by 29.2% from 3.3+ million in March to 4.3+ million in April 2026.
A Closer Look at the Domains Registered with Malicious Intent in April 2026
TLD Distribution
Next up, we sought to take a closer look at the domains likely registered with malicious intent from the get-go in April 2026. We determined that 2.7+ million domains in all appeared on the First Watch Malicious Domains Data Feed, up by 30.8% from 2.1+ million last month.
Overall, 27.0% of the April 2026 NRDs were likely registered with malicious intent. In addition, .info entered the top 5. Former fourth placer .cn, meanwhile, dropped out of the list.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains likely registered with malicious intent.
| APRIL 2026 TOP FIRST WATCH TLD | APRIL 2026 FIRST WATCH TLD VOLUME | MARCH 2026 FIRST WATCH TLD VOLUME | RANKING CHANGE FROM MARCH TO APRIL 2026 |
| .com | 804,151 | 761,404 | → (Unchanged) |
| .top | 370,072 | 204,140 | → (Unchanged) |
| .lol | 169,254 | 192,435 | → (Unchanged) |
| .xyz | 149,150 | 132,085 | ↑ from 5 to 4 |
| .info | 143,425 | 92,479 | ↑ from 7 to 5 |
Overall, the top 5 First Watch TLD volume rose by 14.6% from 1.4+ million in March to 1.6+ million in April 2026.
How Many NRDs Were Registered with Malicious Intent?
We also sought to find out how many of the April 2026 NRDs were registered with malicious intent. Our findings showed that 25.0% of the NRDs under the top 5 TLDs were likely registered with malicious intent.
Cybersecurity through the DNS Lens
TLD Distribution
The top 5 TLDs of the confirmed malicious domains found in April 2026 were the same as those identified in March, down to their ranking.
Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains registered with malicious intent.
| APRIL 2026 TOP DOMAIN IoC TLD | APRIL 2026 DOMAIN IoC TLD VOLUME | MARCH 2026 DOMAIN IoC TLD VOLUME | RANKING CHANGE FROM MARCH TO APRIL 2026 |
| .com | 189,019 | 192,787 | → (Unchanged) |
| .org | 165,056 | 168,891 | → (Unchanged) |
| .net | 155,150 | 160,284 | → (Unchanged) |
| .biz | 108,655 | 111,781 | → (Unchanged) |
| .bazar | 77,649 | 78,618 | → (Unchanged) |
Overall, the number of confirmed malicious domains sporting the top 5 TLDs decreased by 2.4% from 712,361 in March to 695,529 this month.
Threat Reports
Take a quick look at the threat reports we published in April 2026 below.
- Unearthing DNS Facts about UAT-8099: Cisco Talos determined that a UAT-8099 campaign targeted vulnerable Microsoft IIS servers across Asia using web shells, PowerShell scripts, GotoHTTP, and BadIIS variants. WhoisXML API analyzed 27 network IoCs using DNS and domain intelligence to uncover additional infrastructure connections in greater depth.
- ForceMemo in the DNS Spotlight: ForceMemo attacks compromised GitHub repositories and injected malware into widely used Python projects, affecting hundreds of repositories since March 2026. We analyzed 20 IoCs aided by our proprietary tools to uncover related DNS and infrastructure artifacts at scale.
- DNS Analysis of the Keenadu Backdoor Network: Keenadu, a backdoor found in some Android firmware, can act as a multistage loader for remote control, search hijacking, and app monetization. WhoisXML API analyzed 29 network IoCs with the help of our extensive array of domain and DNS intelligence tools to identify additional artifacts tied to the backdoor’s network.
- A DNS Exploration of Operation Olalampo: MuddyWater’s Operation Olalampo targeted organizations and individuals mainly across MENA using geopolitical tensions, new malware variants, and Telegram bots for C&C. We analyzed seven IoCs to uncover additional DNS and domain connections.
You can find more reports created in the past months here.
Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.