WhoisXML API Report Estimates 6.7 Million Q1 Domains Were Likely Registered for Malicious Use
Summary
WhoisXML API analyzed 26.5 million domains registered in Q1 2026, estimating 6.7 million were likely created for malicious purposes. Registrations fell 7.4% quarter over quarter, while malicious domains among the top five TLDs fell 3.3%.
Key points
- The report analyzed more than 26.5 million newly registered domains (NRDs) from January 1 to March 31, 2026, down 7.4% from Q4 2025.
- WhoisXML API assessed more than 6.7 million Q1 registrations as likely created with malicious intent; more than 3.8 million of those were among the top five TLDs.
- The top five gTLDs accounted for more than 13.9 million NRDs, while the top five ccTLDs accounted for more than 2.2 million.
- Site owners using the top five MX domains rose 12.8% to more than 1.3 billion; those using the top five NS domains rose 20.2% to more than 1.2 billion.
- The report studied more than 3.3 million confirmed malicious domains. Counts among the top five TLDs fell 3.3% quarter over quarter, from more than 2.1 million to more than 2.0 million.
- The analysis draws on newly registered domain data, DNS databases, and threat-intelligence feeds.
Article Details
- Publisher
- WhoisXML API
- Report Period
- Q1 2026 (2026-01-01 to 2026-03-31)
- Scope
- Global newly registered domain, DNS usage, and malicious-domain trends.
- Sample Size
- 26.5+ million newly registered domains; 2.7+ billion MX domains; 5.0+ billion NS domains; and 3.3+ million confirmed malicious domains.
- Key Statistics
- 26.5+ million newly registered domains were analyzed for Q1 2026, 7.4% fewer than the 28.6+ million recorded in Q4 2025.
- About 6.7+ million Q1 2026 newly registered domains were assessed as likely registered with malicious intent from the outset.
- 3.3+ million confirmed malicious domains were studied for TLD trends.
- Confirmed malicious domains among the top 5 TLDs fell 3.3% quarter over quarter, from 2.1+ million to 2.0+ million.
- Site owners using the top 5 MX domains increased 12.8% to 1.3+ billion; those using the top 5 NS domains increased 20.2% to 1.2+ billion.