Our research team analyzed 23.4+ million domains registered between 1 January and 31 March 2025 from the Newly Registered Domains (NRDs) Data Feed. We found that the number of NRDs slightly decreased by 3.9% compared with the previous quarter. We also looked closer into 2.1+ million domains tagged as indicators of compromise (IoCs) in Q1 2025, along with 790.0+ million mail exchange (MX) server and 1.5+ billion name server (NS) resolutions for the past 365 days based on our passive DNS database file for April 2025.

Our domain activity trends analysis allowed us uncover the following:

• The top-level domain (TLD) type distribution of the Q1 2025 NRDs
• The most popular generic TLD (gTLD) and country-code TLD (ccTLD) extensions for the NRDs and IoCs
• The most popular NRD registrars
• The top MX and NS fully qualified domain names (FQDNs), their root domains, and their providers

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report: Q1 2025 here.

New Domain Registration Patterns

The number of NRDs decreased from 24.4+ million in Q4 2024 to 23.4+ million in Q1 2025. Also, the Q1 2025 volume of gTLDs was 3.3 times that of the ccTLDs. Apart from those trends, let us tackle what other domain activities transpired in the previous quarter.

Our latest global domain activity analysis marked a 3.9% decrease in the total NRD registration compared with Q4 2024. The gTLD domain registration volume decreased by 1.1% while the ccTLD domain registration declined by a more significant 12.6%.

Based on our Q1 2025 ranking of the most popular gTLDs and ccTLDs, the same players pretty much made the list. The .com gTLD remained in first place while the other gTLD extensions like .xyz, .top, and .shop lagged far behind. Among the ccTLDs, only .de made it to the top 10.

GoDaddy held on to the top NRD registrar spot, accounting for 14.9% of the total number. Namecheap ranked second with a 10.4% share, followed by Dynadot with 5.0%.

Global DNS Activity: .cc ccTLD Still Sports NRD Volume-Population Size Incongruence

Each quarter, we analyze the top 10 ccTLDs of the NRDs and how each stacks up in terms of the corresponding country’s population and online penetration status.

In Q1 2025, the Cocos (Keeling) Islands’ .cc ccTLD continued to register an NRD volume-to-population size incongruence. In particular, .cc accounted for 221,075 NRDs despite having only 593 residents and an online penetration rate of 76.1%. That translated to an NRD per capita of 489.9, considering only the digitally connected population.

The .cc ccTLD was among the topnotchers for most of 2024 (Q1, Q2, and Q4) in terms of sporting an NRD volume-to-population size incongruence. That trend continues to hold true in Q1 2025.

Confirmed Malicious Domains: TLD Topnotchers

We also took a much closer look at our Threat Intelligence Data Feeds, specifically on the 2.1+ million malicious domains tagged as IoCs in Q1 2025.

Threat actors continued to favor using .com domains over others, with the gTLD accounting for 16.8% of the total IoC volume. Note that seven other gTLD extensions, namely, .org, .net, .biz, .bazar, .info, .blackfriday, and .hosting also made the top 10.

Two ccTLDs, .ru and .cn, also figured in the top 10 list.

Global Domain Activity Report: Q1 2025 provides high-level insights into domain registrations and DNS activity worldwide. The report sheds light on domain and DNS record preferences and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.