June 2026: Domain Activity Highlights

WhoisXML API analyzed 9.2+ million domains registered between 1 and 30 June 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number declined by 12.2% from 10.5+ million NRDs last month.

We also determined the top TLD extensions used by 2.0+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in June 2026. This number decreased by 31.2% from the previous month.

Next, we studied the top TLD extensions of 1.07+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which dropped by 1.1% from 1.08+ million in May.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

Zooming in on the June 2026 NRDs

TLD Distribution

Out of the 9.2+ million domains registered in June 2026, 79.7%, down from 81.0% last month, used gTLD extensions. The remaining 20.3%, up from 19.0%, meanwhile, used ccTLD extensions.

In June 2026, .shop ousted .org from the top 5 gTLDs list, with its registration volume rising from 278,987 to 312,573.

The .org drop, meanwhile, could be tied to registration activity changes following the Public Interest Registry’s wholesale price increase, which took effect on 1 June 2026.

Here is a MoM comparison with ranking changes for the top 5 TLD extensions of the June 2026 NRDs.

JUNE 2026 TOP TLD	JUNE 2026 TLD VOLUME	MAY 2026 TLD VOLUME	RANKING CHANGE FROM MAY TO JUNE 2026
.com	3,242,280	4,198,195	→ (Unchanged)
.xyz	798,501	284,832	↑ from 4 to 2
.cn	446,766	294,183	→ (Unchanged)
.top	445,993	574,589	↓ from 2 to 4
.shop	312,573	278,987	↑ from 6 to 5

Overall, the top 5 NRD TLD volume decreased by 6.9% from 5.6+ million in May to 5.2+ million in June 2026.

We then analyzed the June 2026 TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.

The top 5 gTLDs for June 2026 were the same as those identified in May, although their rankings changed. Both the .xyz and .shop gTLDs rose in ranking.

The .xyz increase could be due to its registry running a June 2026 anniversary sale for its 12th birthday, offering a year’s use of the gTLD for US$1.

Here is a MoM comparison and ranking changes for the top 5 gTLD extensions used by this month’s NRDs.

JUNE 2026 TOP gTLD	JUNE 2026 gTLD VOLUME	MAY 2026 gTLD VOLUME	RANKING CHANGE FROM MAY TO JUNE 2026
.com	3,242,280	4,198,195	→ (Unchanged)
.xyz	798,501	284,832	↑ from 3 to 2
.top	445,993	574,589	↓ from 2 to 3
.shop	312,573	278,987	↑ from 5 to 4
.org	217,481	280,111	↓ from 4 to 5

Overall, the top 5 NRD gTLD volume declined by 10.7% from 5.6+ million in May to 5.0+ million in June 2026.

On the ccTLD front, .br entered the top 5 despite a slight volume decline, while .co dropped out after a much sharper decrease. Note that the .cn volume rose from 294,183 in May to 446,766 in June, up about 51.9%. Its share of the top 5 ccTLDs also grew from 32.5% to 45.4%, so it became much more dominant within the ccTLD list.

Here is a MoM comparison with ranking changes for the top 5 ccTLD extensions of the June 2026 NRDs.

JUNE 2026 TOP ccTLD	JUNE 2026 ccTLD VOLUME	MAY 2026 ccTLD VOLUME	RANKING CHANGE FROM MAY TO JUNE 2026
.cn	446,766	294,183	→ (Unchanged)
.uk	151,816	161,423	→ (Unchanged)
.cc	135,219	157,647	→ (Unchanged)
.br	132,204	136,015	↑ from 6 to 4
.ru	118,423	142,094	→ (Unchanged)

Overall, the top 5 NRD ccTLD volume rose by 8.8% from 904,678 in May to 984,428 in June 2026.

Registrar Distribution

This month’s top 5 registrar list had a new entrant—GMO Internet Group. It specifically rose from holding eighth place last month to fourth this June after registrations increased by 124.0%.Hostinger Operations, meanwhile, dropped  out.

Here is a MoM comparison with ranking changes for the top 5 NRD registrars.

JUNE 2026 TOP REGISTRAR	JUNE 2026 REGISTRAR VOLUME	MAY 2026 REGISTRAR VOLUME	RANKING CHANGE FROM MAY TO JUNE 2026
GoDaddy	1,110,470	1,389,769	→ (Unchanged)
Namecheap	917,533	1,096,064	→ (Unchanged)
Dynadot	810,428	951,917	→ (Unchanged)
GMO Internet Group	767,357	342,584	↑ from 8 to 4
Spaceship	551,640	605,750	↓ from 4 to 5

Overall, the top 5 NRD registrar volume declined by 7.3% from 4.4+ million in May to 4.1+ million in June 2026.

A Closer Look at the Domains Likely Registered with Malicious Intent in June 2026

TLD Distribution

Next, we sought to take a closer look at the domains likely registered with malicious intent in June 2026. We determined that 2.0+ million such domains appeared on the First Watch Malicious Domains Data Feed, down by 31.2% from 2.9+ million last month.

Overall, 21.7% of the June 2026 NRDs were likely registered with malicious intent. And while the top 5 TLDs of these domains did not change from last month, we did identify ranking shifts particularly for the third to fifth placers.

Here is a MoM comparison with ranking changes for the top 5 TLDs of the domains likely registered with malicious intent.

JUNE 2026 TOP FIRST WATCH TLD	JUNE 2026 FIRST WATCH TLD VOLUME	MAY 2026 FIRST WATCH TLD VOLUME	RANKING CHANGE FROM MAY TO JUNE 2026
.com	483,115	814,571	→ (Unchanged)
.top	234,982	400,794	→ (Unchanged)
.cn	213,401	149,116	↑ from 4 to 3
.xyz	188,374	129,859	↑ from 5 to 4
.lol	124,069	183,431	↓ from 3 to 5

Overall, the top 5 First Watch TLD volume declined by 25.9% from 1.6+ million in May to 1.2+ million in June 2026.

How Many NRDs Were Registered with Malicious Intent?

We also sought to find out how many June 2026 NRDs were registered with malicious intent. Among the First Watch domains sporting the top 5 NRD TLDs, 21.7% were likely registered with malicious intent.

Cybersecurity through the DNS Lens

TLD Distribution

The top 5 TLDs of the confirmed malicious domains detected in June 2026 stayed the same even in terms of ranking compared with May.

Here is a MoM comparison with ranking changes for the top 5 TLDs of the confirmed malicious domains.

JUNE 2026 TOP DOMAIN IoC TLD	JUNE 2026 DOMAIN IoC TLD VOLUME	MAY 2026 DOMAIN IoC TLD VOLUME	RANKING CHANGE FROM MAY TO JUNE 2026
.com	188,694	193,340	→ (Unchanged)
.org	164,404	169,093	→ (Unchanged)
.net	155,041	160,304	→ (Unchanged)
.biz	108,398	111,603	→ (Unchanged)
.info	56,734	53,972	→ (Unchanged)

Overall, the number of confirmed malicious domains sporting the top 5 TLDs decreased by 2.2% from 688,312 in May to 673,271 this month.

Threat Reports

Take a quick look at the threat reports we published in June 2026 below.

• DNS Deep Dive: Pushpaganda Network IoCs: This report analyzed Pushpaganda, a campaign combining ad fraud, social engineering, and scareware via push notifications. WhoisXML API expanded the public list of IoCs using DNS intelligence to bring to light connected domains, IP addresses, historical DNS links, and other artifacts that can help defenders track infrastructure reuse and investigate related abuse activity online.
• DNS Deep Diving into FakeWallet Crypto Stealer: This report investigated FakeWallet, a crypto-stealing campaign involving phishing apps impersonating popular wallets. WhoisXML API analyzed a published list of IoCs and enriched our findings with DNS, WHOIS, and infrastructure data to identify connected artifacts, possible registrant patterns, malicious indicators, and additional web properties that may warrant closer monitoring by defenders globally.
• A DNS Investigation of Shadow-Earth-053: This report examined Shadow-Earth-053, a China-aligned cyberespionage campaign targeting governments and critical infrastructure. WhoisXML API used DNS and domain intelligence to expand the published list of IoCs, uncovering related domains, IP addresses, historical DNS resolutions, and infrastructure relationships that may help investigators assess their organizations’ exposure and follow attacker-controlled assets across targeted environments.
• TA416 European Government Espionage Campaigns: DNS Deep Dive: This report focused on TA416 campaigns against European government and diplomatic targets, with later expansion into Middle Eastern entities. WhoisXML API narrowed and enriched the original IoC list, then used DNS intelligence to uncover connected artifacts, possible infrastructure reuse, and context around domains and IP addresses tied to the campaign.
• GHOST STADIUM Takes Advantage of FIFA 2026: DNS Deep Dive: This report expanded Group-IB’s GHOST STADIUM findings around FIFA 2026 ticket phishing. WhoisXML API investigated the campaign’s domain and DNS footprint to uncover additional infrastructure connections, registration patterns, and related artifacts that can help defenders monitor cloned FIFA-themed websites, credential theft, and payment fraud risks before events peak significantly worldwide.
• 68,745 Domains Riding the 2026 FIFA World Cup: This report profiled 68,745 domains referencing the 2026 FIFA World Cup across creation dates, registrars, registrant email addresses, name servers, and naming intent. WhoisXML API highlighted registration trends and categories like ticketing, streaming, merchandise, betting, travel, and brand impersonation to support event-driven threat monitoring and investigation at scale globally.
• macOS ClickFix Campaign Delivers AMOS and Other Infostealers: A DNS Deep Dive: This report examined a macOS ClickFix campaign that delivered AMOS and other infostealers through malicious commands hosted on blogs and user-driven content platforms. WhoisXML API analyzed 138 IoCs after filtering, then used DNS intelligence to uncover connected domains, IP addresses, infrastructure links, and artifacts for further investigation by defenders worldwide.

You can find more reports created in the past months here.

Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.