September 28, 2026
27 min read
.xyz accounted for 98% of the domain market's net growth in August 2026, and nobody said why. Our Newly Observed Hostnames feed saw 3.27 million new .xyz names between June and September, 2.7 million more than the spring pace. In our September sample, 84% came through one Japanese registrar, and almost all of those went straight to Afternic, GoDaddy's domain marketplace. They were generated by gluing a keyword such as gpu, taxi or manga to dictionary words. The same pattern ran in 2025, and the August 2025 batch was 88% deleted a year later. Two in three resolving .xyz names now point at an Afternic for-sale page. The flood also blunts a common security signal: in every wave month, a new .xyz name was less likely than a new name elsewhere to be reported for phishing. For registries, registrars, domain investors, security teams and anyone who uses domain counts as a signal.
September 27, 2026
28 min read
In July we told SOC teams to gate new-domain watchlists on activation: a live mail server, not a parking nameserver. We tested that advice on 29.2 million registered domains our Newly Observed Hostnames feed first saw between May and July 2026, against every later OpenPhish and URLhaus listing. A live MX did not predict a listing; parking predicted its absence; self-hosted mail was the one mail signal that did; and 84% of listings came within days, before any monthly crawl looked. Our feed saw 58.5% of OpenPhish's registered phishing domains by listing day, but only 1.3% of its free-hosting sites. For SOC teams, threat-intelligence analysts, and brand-protection researchers.
July 24, 2026
31 min read
We mapped a week of Google Trends spikes (US + Canada) against our Newly Observed Hostnames feed. A brand-new AI model was followed by a clean launch-day lookalike wave; a breach at a household-name AI company saw no measurable wave at all; and a two-hour Instagram outage saw none either — its phishing lives on free-hosting subdomains a registration feed never sees. Of 195 event-matched lookalikes, 94% resolve but only 30% are provisioned for email. Corrected September 27, 2026. For SOC teams, brand-protection researchers, and threat-intelligence analysts.
July 03, 2026
20 min read
We logged 1,348,706 requests across two production web properties for 174 days and classified every user-agent. AI crawlers now generate 7.2% of all observed traffic — more than Googlebot, Bingbot, DuckDuckBot, Baiduspider, and PetalBot combined. OpenAI alone accounts for 38% of the AI crawl, 69% of AI requests still feed training pipelines, and a robots.txt honeypot shows 99% of AI-crawler violations trace to a single bot. For publishers, infrastructure teams, and anyone deciding what to do about the new tenants of the crawl economy.