November 2025: Domain Activity Highlights

WhoisXML API analyzed 8.7+ million domains registered between 1 and 30 November 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends. This number dropped 8.7% from 9.6+ million last month.

We also determined the top TLD extensions used by 31.9+ billion domains from our DNS database’s A record full file dated 6 November 2025, indicating a 17.5% drop from October’s 38.7+ billion domains.

Next, we studied the top TLDs of 1.0+ million domains, down from 1.1+ million in October, detected as indicators of compromise (IoCs) this month.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

You can download an extended sample of the data obtained from this analysis from our website.

Zooming in on the November 2025 NRDs

TLD Distribution

Out of the 8.7+ million domains registered in November 2025, 85.8%, up from 83.2% last month, used generic TLD (gTLD) extensions. The remaining 14.2%, down from 16.8%, meanwhile, used country-code TLD (ccTLD) extensions.

The .com TLD remained the most popular extension used by 33.5% of the total number of newly registered domains (NRDs), indicating a decrease from 35.4% in October. The other most used TLDs on the top 5 followed with a significant gap as in the previous month. The remaining four topnotchers were all gTLDs, namely, .xyz with a 9.3% share, .bond with 6.4%, .info with 5.4%, and .top with 4.5%. Note, too, that last month’s .shop and .cn were overtaken by .bond and .info this month.

We then analyzed the November TLDs further to identify the most popular gTLDs and ccTLDs among the new domain registrations.

Out of 626 gTLDs, .com remained the most used, accounting for a 39.0% share, down from 42.5% in October. The rest of the top 5 lagged far behind. In fact, the four other gTLDs only clocked in a 29.8% share in total. The four remaining gTLDs were .xyz with a 10.8% share, .bond with 7.4%, .info with 6.3%, and .top with 5.2%. Last month’s third placer .shop dropped out of the top 5, replaced by .bond.

Meanwhile, .cn continued to top the list of 203 ccTLD extensions with a 15.5%, down from 20.7% in October. The .uk ccTLD placed second with a 10.3% share, followed by .ru with 9.5%, .cc with 7.7%, and .in with 5.9%. Fifth-ranking .br fell off the list, overtaken by .in.

Registrar Distribution

The GMO Internet Group outranked last month’s top 1 GoDaddy among this month’s 2,570 registrars with a 14.6% share, up from 12.3% in October. The rest of the topnotchers were GoDaddy with a 10.9% share, Namecheap with 9.2%, Dynadot with 5.1%, and Spaceship with 4.8%.

WHOIS Data Redaction

As in October, fewer NRDs had unredacted WHOIS records this month, 47.1% to be exact, up from 45.7%. A total of 52.9%, down from 54.3% in October, meanwhile, had redacted WHOIS details.

A Closer Look at the November 2025 DNS Records

Top TLDs of the A Record Domains

Next, we analyzed 31.9+ billion domains from our DNS database’s A record full file dated 6 November 2025. Note that the file includes DNS resolutions from the past 365 days. We found out that 41.8%, slightly up from 41.3% last month, used the .com gTLD. The rest of the top 5 comprised two other gTLDs (i.e., .net with a 9.2% share and .org with 8.6%) and two ccTLDs (i.e., .ru with a 4.0% share and .de with 2.4%).

Cybersecurity through the DNS Lens

Top TLDs of the November 2025 Domain IoCs

We analyzed 1.0+ million domains tagged as IoCs for various threats detected in November. Our analysis revealed that .com remained the most popular TLD with a 17.0% share, down from 18.2% in October. The remaining top TLDs were all gTLDs as well, namely, .org with a 15.4% share, .net with 14.7%, .biz with 10.1%, and .bazar with 7.2%.

Threat Reports

Below are the threat reports we published in November 2025.

• Chasing After RacoonO365 IoCs Using DNS and Domain Intelligence: Cloudflare and Microsoft jointly disrupted RaccoonO365, a phishing-as-a-service (PhaaS) operation that enabled cybercriminals to steal 5,000+ user credentials worldwide in September 2025. Despite the takedown, however, traces of the operation’s infrastructure remained scattered across the Internet. Find out what they are in this report.

• Burrowing into the Beamglea Campaign DNS Infrastructure: Researchers uncovered 175 malicious npm packages related to the widespread Beamglea phishing campaign. The threat actors targeted 135+ industrial, technology, and energy companies worldwide. Worse? As of 9 October 2025, the packages have been downloaded 26,000+ times. We analyzed the IoCs and unearthed pertinent findings in this report.

• COLDRIVER’s MAYBEROBOT in the DNS Spotlight: The Google Threat Intelligence Group (GTIG) analyzed the evolution of Russia-affiliated threat group COLDRIVER’s homegrown malware NOROBOT. They discovered that the tool has been redesigned into YESROBOT and now into MAYBEROBOT. They also identified 14 IoCs that we dug deeper into. Get the lowdown in this report.

• Going DNS Deep Diving into GhostCall and GhostHire: BlueNoroff struck again. This time, however, they launched two interrelated campaigns—GhostCall and GhostHire. The actors went after tech company execs, venture capitalists, and Web3 developers, stealing personal information and other well-kept secrets. We analyzed the 39 IoCs Securelist identified and uncovered several DNS truths. Read this report for more information.

You can find more reports created in the past months here.

Feel free to contact us for more information about the products and capabilities used to analyze domain registration events or support other use cases.