June 2025: Domain Activity Highlights

WhoisXML API analyzed 9.8+ million domains registered between 1 and 30 June 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 51.7+ billion domains from our DNS database’s A record full file dated 5 June 2025.

Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this June.

Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

You can download an extended sample of the data obtained from this analysis from our website.

Zooming in on the June 2025 NRDs

TLD Distribution

A majority of the 9.8+ million domains registered in June 2025, 80.8% to be exact, used generic TLD (gTLD) extensions, while the remaining 19.2% used country-code TLD (ccTLD) extensions.

The .com TLD remained the most popular extension used by 41.8% of the total number of newly registered domains (NRDs), up from 37.6% in May. The other most used TLDs on the top 5 followed with a significant gap as in the previous month. Three other gTLDs, namely, .top with a 5.8% share, .xyz with 5.0%, and .net with 2.8% made the roster. The .cn ccTLD with a 2.6% share completed the list.

We then analyzed the June TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.

Out of 708 gTLDs, .com remained the most used, accounting for a 51.7% share, up from 47.4% in May. The rest of the top 5 lagged far behind. In fact, the four other gTLDs only clocked in a 19.8% share in total. The four remaining gTLDs were .top with a 7.1% share, .xyz with 6.1%, .net with 3.5%, and .shop with 3.1%.

Meanwhile, .cn continued to top the list of 258 ccTLD extensions with a 13.3% share, up from 9.9% in May. The .uk ccTLD followed with a 7.7% share. Then came .ru with a 7.1% share, .de with 6.4%, and .cc with 5.4%.

Registrar Distribution

GoDaddy continued to reign supreme among the registrars with an 11.6% share, down from 14.7% in May. Namecheap took the second spot with a 9.1% share. The rest of the topnotchers were Dynadot with a 4.4% share, the GMO Internet Group with 3.5%, and NameSilo with 2.7%.

WHOIS Data Redaction

Unlike in previous months, more NRDs had unredacted WHOIS records in June, 54.0% to be exact. Only 46.0%, meanwhile, had redacted WHOIS records.

A Closer Look at the June 2025 DNS Records

Top TLDs of the A Record Domains

Next, we analyzed 51.7+ billion domains from our DNS database’s A record full file dated 5 June 2025, which included DNS resolutions from the past 365 days. We found that 44.9% used the .com gTLD, up from 43.5% in May. The rest of the top 5 comprised two other gTLDs (i.e., .net with a 9.9% share and .org with 6.8%) and two ccTLDs (i.e., .de with a 3.6% share and .ru with 3.3%).

Cybersecurity through the DNS Lens

Top TLDs of the June 2025 Domain IoCs

As usual, we analyzed 1.0+ million domains tagged as IoCs for various threats detected in June. Our analysis revealed that .com remained the most popular TLD with a 17.7% share, down from 23.3% in May. The remaining top TLDs were all gTLDs as well, namely, .org with a 15.8% share, .net with 15.1%, .biz with 10.4%, and .info with 4.9%.

Threat Reports

Below are the threat reports we published in June 2025.

• New MITRE ATT&CK Groups for 2025: A DNS Deep Dive: The MITRE Corporation updated its ATT&CK page, listing seven new groups it monitors for malicious activity via the Updates - April 20251 advisory. They listed IoCs, which WhoisXML API dove deep into. We uncovered 5,080 connected artifacts that have not yet been publicized.

• A DNS Deep Dive into the LabHost PhaaS Infrastructure: The Federal Bureau of Investigation (FBI) warned the public about the LabHost phishing-as-a-service (PhaaS) campaign that threatened the security of users worldwide. They published a massive list of related IoCs that WhoisXML API analyzed in great depth. WhoisXML API uncovered thousands of possibly connected artifacts and other pertinent findings.

• A DNS Examination of the Phishing Campaign Targeting Japanese Brokerage Firms: Yahoo! News Japan reported about tons of cases of securities account hijacking in May 2025. A report on the possible tool used to phish the stock owners identified seven domains as IoCs. WhoisXML API used this data, along with other information from various reports on similar phishing campaigns, to identify 55,321 connected artifacts and other important information.

• Shining the DNS Spotlight on Lumma Stealer: On 19 May 2025, the U.S. Department of Justice seized 114 domains connected to a major information-stealing campaign utilizing Lumma Stealer. The Cybersecurity and Infrastructure Security Agency (CISA) published the list of IoCs on the same date. WhoisXML API analyzed the IoCs in great depth to uncover 538 new artifacts and other critical insights.

• Framing the AkiraBot Framework Under the DNS Lens: SentinelLABS recently discovered the AkiraBot framework that threat actors crafted to spam website chats and contact forms to users. They identified 34 domains as AkiraBot IoCs. WhoisXML API expanded the list through a DNS deep dive and, in the process, uncovered 55 new artifacts.

You can find more reports created in the past months here.

Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.