September 28, 2026
27 min read
.xyz accounted for 98% of the domain market's net growth in August 2026, and nobody said why. Our Newly Observed Hostnames feed saw 3.27 million new .xyz names between June and September, 2.7 million more than the spring pace. In our September sample, 84% came through one Japanese registrar, and almost all of those went straight to Afternic, GoDaddy's domain marketplace. They were generated by gluing a keyword such as gpu, taxi or manga to dictionary words. The same pattern ran in 2025, and the August 2025 batch was 88% deleted a year later. Two in three resolving .xyz names now point at an Afternic for-sale page. The flood also blunts a common security signal: in every wave month, a new .xyz name was less likely than a new name elsewhere to be reported for phishing. For registries, registrars, domain investors, security teams and anyone who uses domain counts as a signal.
September 27, 2026
28 min read
In July we told SOC teams to gate new-domain watchlists on activation: a live mail server, not a parking nameserver. We tested that advice on 29.2 million registered domains our Newly Observed Hostnames feed first saw between May and July 2026, against every later OpenPhish and URLhaus listing. A live MX did not predict a listing; parking predicted its absence; self-hosted mail was the one mail signal that did; and 84% of listings came within days, before any monthly crawl looked. Our feed saw 58.5% of OpenPhish's registered phishing domains by listing day, but only 1.3% of its free-hosting sites. For SOC teams, threat-intelligence analysts, and brand-protection researchers.
July 24, 2026
31 min read
We mapped a week of Google Trends spikes (US + Canada) against our Newly Observed Hostnames feed. A brand-new AI model was followed by a clean launch-day lookalike wave; a breach at a household-name AI company saw no measurable wave at all; and a two-hour Instagram outage saw none either — its phishing lives on free-hosting subdomains a registration feed never sees. Of 195 event-matched lookalikes, 94% resolve but only 30% are provisioned for email. Corrected September 27, 2026. For SOC teams, brand-protection researchers, and threat-intelligence analysts.
June 25, 2026
20 min read
We crossed two full-corpus DNS censuses of the same May 2026 crawl — the MX layer that names who runs each domain's mail, and the SPF/DMARC/MTA-STS/BIMI layer that says whether that mail is authenticated. Across 149.8 million mail-capable apex domains, email-authentication posture turns out to be inherited from the provider, not chosen by the owner: security gateways and Microsoft 365 run the credible anti-spoofing stack on 17–19% of their domains, while the four largest registrar-bundled hosts — IONOS, Hostinger, Namecheap, OVH — run it on under 1.2%, and the largest email category on the Internet stops spoofing on just 3.5% of its 46.7 million domains. The 9% that actually resist spoofing are not spread across the Internet; they cluster behind a handful of operators.
June 24, 2026
15 min read
A follow-up to our .ai gold-rush analysis. We measured what a million .ai domains actually do — using our June 2026 typed-DNS crawl of 1,013,951 registrable roots across A, MX, NS, and TXT records. 94.3% resolve, but only 48.5% show any real-use signal and 20.4% carry a SaaS verification token; meanwhile ~9% sit on for-sale nameservers, startup adoption keeps climbing (YC cohorts ~23%→32%), and .ai is measurably one of the cleanest fast-growing TLDs for abuse.
May 29, 2026
18 min read
We queried the email-authentication TXT layer directly — _dmarc, _mta-sts, default._bimi, and apex SPF — across a May 2026 DNS crawl, using MX records as the denominator. Of 150,020,997 mail-capable apex domains, 71.3% publish SPF, 34.1% publish DMARC, but only 11.7% enforce DMARC and just 9.0% run the minimum credible SPF-plus-enforced-DMARC stack. Two-thirds of DMARC records sit at p=none. MTA-STS reaches 0.144% and BIMI 0.084%. And 45.7% of all DMARC reports flow to a single registrar's default configuration. This is the state of email authentication, measured from the records themselves.