Two in Three Resolving .xyz Names Are Listed for Sale: The Machine-Generated Registration Waves Behind 2026's Surge

In August 2026 the domain market grew by 443,616 names, and 435,091 of them were .xyz. ABTdomain, which tracks registrations across top-level domains, put .xyz at 98% of the month's net gain and noted three signals of bulk resale activity: "One registrar handled 86.2% of the volume, 83.8% of the names went to marketplace nameservers on day one, and 89.6% were pure-letter strings" (ABTdomain, August 2026). In September the surge continued at about 60,000 a day (ABTdomain, Sep 14–20).

Those are counts. They do not say which registrar, which marketplace, what the names look like, whether this has happened before, what becomes of the names, or what the flood does to one of security's cheapest signals: a domain's age. Speculative registration is an old business, and .xyz has a history of it: the registry's early growth came from free and very low-priced promotions (The Rise of .xyz). What is new in 2026 is the scale and the machinery. Hundreds of thousands of names a week, listed for sale before anyone has typed them into a browser.

We traced the surge with our Newly Observed Hostnames feed, which records the first time any registered domain is seen. We counted every new .xyz name since December 2024 (10.2 million) and compared the pattern with every other top-level domain. We took random samples of each month's new names and checked their registrar (RDAP), nameservers, addresses and mail today. We followed .xyz through 29 monthly web crawls since April 2023 and checked everything against the OpenPhish and URLhaus phishing and malware feeds.

Between June 1 and September 27, 2026 our feed saw 3.27 million new .xyz names, 2.68 million more than the January–May pace would have produced. 84% of September's new names came through one registrar, GMO Internet's Onamae.com. Of those listed on Afternic, GoDaddy's domain marketplace, 1,668 of 1,669 were Onamae registrations. The names are built mechanically, a keyword glued to dictionary words in both orders. The same pattern appeared in waves in August 2025 and October–December 2025, and the August 2025 batch is consistent with a simple business model: list the names for sale for a year, then let the unsold ones lapse. Today 4.86 million of 7.30 million resolving .xyz names (66.6%) point at an Afternic for-sale page. Almost none of it is phishing: 5 of 1.96 million new front-door names have ever appeared in a public feed.

That erodes the information value of a domain's age, one of security's cheapest signals, and the effect reaches well beyond the domain business. In all eight wave months since August 2025, a new .xyz name was less likely than a new name in any other top-level domain to be listed as phishing within a week. In six of the seven other months it was as likely or more. In September 2026, about one in eleven newly observed domains, in any top-level domain, was a .xyz name listed for sale on Afternic.

The Data

Our count matches the registry-based count. In July 2026 our feed first saw 757,494 new .xyz names. ABTdomain counted 757,817 .xyz registrations for the same month. The feed observes names rather than registrations, and it usually sees a name within days. In August it undercounts: the feed had an outage from August 21 to 27, 2026, and those days are flagged in every chart.

Methodology

New name. A registered domain (ICANN public suffix list) seen by our feed for the first time. The feed's first months include older names seen for the first time, so we do not read .xyz trends from before April 2025.

Wave week. A week in which at least 75% of new .xyz names consist of letters only. The normal range in 2026 is 50–64%. ABTdomain reported 89.6% pure-letter names in August.

Recipe keyword. A string that appears at the start and at the end of many new names in the September wave, at least eight times more often than in an equal-size sample of .xyz names first seen January–August 2026. We found 44 such keywords, after removing fragments of longer ones.

Afternic for-sale page. A name that resolves to the addresses GoDaddy uses for Afternic marketplace listings, or uses Afternic's nameservers (ns5/ns6.afternic.com). GoDaddy front door is the wider set of GoDaddy lander addresses: Afternic listings plus parked and default pages. It is the class our parking series tracks.

Fate classes (live DNS, September 28, 2026):

• For sale on Afternic: Afternic nameservers.
• In registrar expiry: nameservers moved to a registrar's expired-domain service, such as onamae-expired.com.
• Other parking: another parking or for-sale nameserver.
• Live elsewhere: resolving on any other operator.
• Deleted: the registry answers NXDOMAIN. For a recently lapsed name, this means the registrar has deleted it and it sits in the registry's redemption period, not yet available to register. In a 100-name registry (RDAP) check of the August 2025 sample on September 28, 2026, 80 of the 85 NXDOMAIN names were in that state and 5 had been released.

Listed within a week. A new name whose registered domain first appears in the OpenPhish public feed between one day before and seven days after our feed first saw it. For this comparison we use OpenPhish alone, because its history is continuous; our URLhaus record starts in June 2026. We start in July 2025, after OpenPhish moved to its current twice-daily updates, and stop at names first seen on September 20, 2026, the last date with a full week of feed history.

Rate ratio. The share of new .xyz names listed within a week, divided by the same share for new names in every other top-level domain in the same month. 1× means no difference. Because both sides come from the same month, changes in the feed's overall volume cancel out.

Known limitations.

• We do not know who the registrants are. RDAP does not show them. We describe a channel (registrar, nameservers, naming recipe), not a person. Several customers could use the same channel.
• We do not know what was paid. The registrar's price page blocks automated access, and we did not verify any promotion. Whether the cycle pays is the main open question of this study; see "Open question: does the cycle pay?" below.
• The samples are random but finite. At 2,000 names, registrar and nameserver shares carry about ±2 percentage points of sampling error; the 150-name RDAP subsamples about ±7.
• The crawl's coverage of .xyz grew over the series. Read the front-door share, not the absolute height of the bars, before 2025.
• Feed listing is not the same as abuse. OpenPhish lists web phishing, misses some of it, and cannot see email-only abuse. Our outcome is "listed", not "malicious". Monthly listing counts for .xyz are small (12 to 86), so single campaigns move single months; we report confidence intervals and pooled figures.
• Russian-territorial top-level domains are excluded from every cross-TLD figure.

The Scorecard

Three Waves, Each Larger Than the Last

Download: xyz-flood-weekly.csv · weeks starting Monday; noh_outage_days marks the days our feed was down, which make those weeks undercounts.

The surge did not start in August, and it is not the first.

• Our feed shows a ramp from June 2026. .xyz went from about 5,000 new names a day in the spring to 41,000 a day in September.
• The same signature appeared in August 2025 (80% letters only) and October–December 2025 (79–87%), with the single largest week at 506,000 new names at the start of October 2025.
• Between the waves, .xyz fell back to its normal mix, around 55% letters only. That is what one would expect if the waves are discrete bulk campaigns, not organic demand.

.xyz is the outlier. Against a January–May baseline, the whole market's new names rose 31% in June–September, some of it seasonal and some of it feed growth.

Download: xyz-flood-tlds.csv · NOH outage days excluded from both windows.

The Recipe: A Keyword Glued to a Dictionary Word

Download: xyz-flood-recipe.csv · 1,018,390 new .xyz names first seen September 6–23, 2026; baseline = equal-size random sample of .xyz names seen January–August 2026; overlapping keywords (robo and robotaxi, stock and stocks) are flagged.

The September names are not chosen one by one.

• Each recipe keyword appears as both a prefix and a suffix, in roughly equal numbers. "taxi" leads 11,992 new names and ends 17,873; "gpu" leads 12,030 and ends 8,506. That symmetry is what a generator that pairs every keyword with every word in both orders produces.
• Inside a keyword family, the second word walks through a dictionary in alphabetical order, including misspelled and truncated entries. The run goes workcicero, workciceter, workciel, workciency, workcigar, workciitzens, and so on.
• 44 keywords explain 37.4% of the September wave and 2.1% of earlier .xyz names.
• The rest of the wave follows the same letters-only, compound-word shape with other keyword sets. Each wave appears to use its own list: the September keywords explain only 3–6% of the 2025 waves.

The vocabulary is a snapshot of 2026 hype. AI infrastructure (gpu, compute, dataset, mcp, quantum, vision, deep), autonomous vehicles (robotaxi, taxi, auto), finance and crypto slang (stock, degen, oracle, vesting, mempool, testnet, keccak, sharding), plus manga, trip, map, rank, airlines and bargains. None of it is brand-squatting: we found no brand names in the keyword list. The pattern is consistent with a bet that some fraction of generic AI-flavored compounds will sell before the renewal date.

One Registrar, One Marketplace

All three samples are names our feed saw for the first time in that month, drawn at random. Nameserver and deletion shares cover the full sample. For March and June, registrar shares come from a 150-name RDAP subsample (135 and 144 answered; the rest no longer exist) because the registry's RDAP service throttled us; for September, 1,998 of 2,000 answered. At n = 150 the registrar shares carry about ±7 percentage points of sampling error.

The channel is precise. A note on roles first: GMO Internet (Onamae.com) and GoDaddy (Afternic) are the service providers this channel runs through. Nothing in our data suggests either company orchestrates the registrations; we are describing how some of their customers use them.

• A name is registered at Onamae.com, the retail brand of Japan's GMO Internet. Its nameservers point to Afternic from day one, so it resolves to the two GoDaddy addresses that serve Afternic listings.
• It publishes a null MX record: it will never receive mail.
• Onamae's 84.4% share of the September sample is consistent with ABTdomain's August finding that one registrar, which it did not name, handled 86.2% of .xyz volume.
• Our feed first saw the Afternic-listed names a median of one day after their registry creation date, and 90% within three days. The names are live and listed as soon as they exist.

The registrar is also where the names go to die. When an Onamae registration expires, its nameservers move to onamae-expired.com, GMO's expired-domain page. That makes the end of each batch visible in DNS.

The Warehouse: Seven in Ten .xyz Names on One Front Door

Download: xyz-flood-frontdoor.csv · resolving registered .xyz names per crawl; front door = GoDaddy lander addresses, of which the Afternic listing page is the bulk.

Resolving .xyz now reads like a catalogue, and the timing is consistent with the waves. In December 2024, 30.5% of resolving .xyz names pointed at GoDaddy's front door. By September 2026 it was 69.9%, and 4.86 million of those 5.10 million were Afternic listings specifically: two in three of every resolving .xyz name. The jumps line up with the waves: +7.5 points between July and August 2025, +20.1 points between August and December 2025, +3.0 points between August and September 2026. Because the crawl's coverage grew over the same period, we read the share, not the absolute counts. Other sellers list on Afternic too, so not every listing comes from a wave.

Most of that inventory is new.

That is the difference between an organic month and a wave month. It is also why the share of .xyz names on a lander rose from 30% to 70% in our parking series.

A Year on the Shelf, Then Deletion

The August 2025 batch shows the full life cycle. We drew a random sample of 600 from the 445,130 letters-only .xyz names first seen that month, looked up the same 600 names in every monthly crawl since, and checked them in live DNS and the registry's RDAP service on September 28, 2026. RDAP shows most were registered in the second half of July 2025 (median July 22); our feed first saw them in August.

Download: xyz-flood-lifecycle.csv · the same 600 names in every column; crawl columns classify each name by the address it resolved to, the last column by live DNS; shares in percent. About 6% of names did not resolve in each crawl even while the batch was on sale (crawl misses or names without DNS).

Of every 100 names in the sample:

• 80 were on an Afternic listing at the first crawl, about two months after most were registered, and 81 to 83 in each of the next ten crawls. About 94 resolved throughout.
• 63 were on GMO's expired-domain page in the August 2026 crawl, a year after registration. 18 were still listed.
• 16 were on other parking on September 18, 2026, 14 of them on one service, and 73 no longer resolved. We identify that service as ParkLogic by its nameservers: 97% of the .xyz names on those addresses that had a nameserver record in the same crawl used parklogic.com.
• 88 had been deleted by the registrar and dropped out of DNS by September 28, 2026. Most of them are still in the registry's redemption period. About 7 are live somewhere else, and 3 are still listed.

A year after registration, most of the batch was not renewed. The names moved to the registrar's expiry page between the July and August 2026 crawls, and some passed briefly through another parking service. RDAP dates the deletions: the registrar deleted most of them around September 1, 2026 (median), about six weeks after they expired. With the registry's standard 30-day redemption period and 5-day pending-delete window, most of the batch should become available to register again in October 2026.

The later batches are on the same path.

Download: xyz-flood-fates.csv · 600 letters-only names sampled per month of first observation; live DNS on September 28, 2026; shares in percent.

The October 2025 batch is going through the same step now: 30% of its sampled names already sit on onamae-expired.com. The December 2025 batch should reach the same step around the turn of the year.

The data fit a one-year holding pattern. We cannot see the registrants' reasoning, but the sequence is consistent:

1. Hundreds of thousands of machine-generated names are registered through a single registrar.
2. All of them are listed on the largest marketplace from day one.
3. The unsold names are not renewed and are deleted at the first renewal.

Our sample says 88% of the August 2025 batch was deleted. We do not know how many sold, but a name that sells usually moves to the buyer's nameservers: 6.7% of that batch is now live elsewhere.

Open question: does the cycle pay? This is the largest thing we do not know, and DNS cannot answer it. Breaking even depends on four numbers:

• First-year cost per name. Unknown. We could not see Onamae's price or verify any promotion or volume discount.
• Share of names sold. At most 6.7% of the August 2025 sample, the share now live elsewhere, and not every one of those is a sale.
• Sale price, net of the marketplace's commission. Not visible in DNS.
• Renewal cost. Apparently avoided: the unsold names were dropped rather than renewed.

The arithmetic is simple even if the inputs are not. If 6.7% of a batch sold, each sale would have to return about 15 times the first-year cost of a name for the batch to break even. If 1% sold, about 100 times. Whether the first-year price makes a million-name batch rational is something the registry, the registrar and the marketplace can see in their own books, and outside observers cannot.

What it means for counts. If the pattern holds, the 2026 waves will produce the same cliff between June and September 2027: about 2.7 million names, most of them deleted within a few months. The timing estimate uses first-observation dates, which trail registration by a median of one day for these names. Anyone reading .xyz registration totals as demand (for AI names, for new TLDs, for the domain market) will see a boom in 2026 and a bust in 2027. The evidence is consistent with both being a bulk inventory cycle rather than a change in demand; we cannot tell whether one registrant or several are behind it.

The cost of the cycle falls on others:

• For the registry and ICANN, bulk waves inflate the numbers used to judge a top-level domain's health.
• For anyone using registration data as a market signal, they swamp it. In August, .xyz was 98% of the market's net growth, and in our September sample 84% of new .xyz names came through one channel.
• For people who want a name, millions of plausible compounds sit behind a marketplace price tag for a year before they are released again.
• For security teams, the waves bury the signal they rely on most. That is the next section.

Domain Age Is Losing Its Value as a Security Signal

Security tools lean on two cheap facts about a domain: how new it is, and which top-level domain it sits in. DNS filters, mail gateways and threat-intelligence feeds give newly registered domains extra scrutiny, and many weight top-level domains by their abuse history. The .xyz waves change what both facts mean. Our feed sees names rather than registrations, but for the wave names the two are a median of one day apart.

The inventory itself is inert. Of the 1,958,735 names first seen June–mid-September 2026 that resolved to GoDaddy's front door on September 18, five have ever appeared in OpenPhish or URLhaus. That is 0.03 per 10,000, against 0.9 per 10,000 for the other resolving new .xyz names of the same months. Every Afternic-listed name in our sample publishes a null MX, so none can receive mail. This is consistent with what we found across 29 million new domains: parked names are almost never listed.

Does the inventory dilute the signal? For every month since July 2025, we counted how many newly observed names were listed in OpenPhish within a week of first sighting, for .xyz and for every other top-level domain.

Download: xyz-flood-signal.csv · rate ratio = share of new .xyz names listed in OpenPhish within a week ÷ the same share for new names in all other top-level domains, same month; exact 95% confidence intervals; September 2026 covers names first seen through September 20.

The ratio fell below 1× in every wave month.

• In every wave month, a new .xyz name was less likely than a new name elsewhere to be listed within a week: 0.07× to 0.85×. In six of the seven other months it was as likely or more: 1.06× to 9.86×.
• The more of the new-name pool .xyz took, the lower its rate. October 2025 and September 2026, when .xyz was 11% of all new names, sit at 0.07× and 0.50×. Across the 15 months the rank correlation between the two is −0.73 (permutation p = 0.001).
• The phishing did not grow with the names. New .xyz names listed within a week: 1.8 a day in January–May 2026, 1.2 a day from June 1 to September 20, while the number of new .xyz names per day rose more than fivefold.
• The letters-only names that make up the waves were listed at 0.10 per 10,000 in wave months, a tenth of the rate for new names in other top-level domains.

Two things move the ratio, and only one of them is the waves. .xyz phishing arrives in campaigns. In January–March 2026, a run of numeric and letter-and-digit .xyz names (200 of that quarter's 207 listings) pushed the ratio to 3–10×. Without those three months, the other months pool to 0.84× (0.68–1.03): statistically indistinguishable from other top-level domains, and still more than twice the wave months' 0.38×. So the data do not show the waves turning a risky namespace safe. They are consistent with the waves diluting .xyz's listing rate well below the average, while a single campaign can push it well above. The split holds with a 3-day or a 30-day listing window (2.15× against 0.39×; 1.78× against 0.52×) and when single days are classed as wave or not instead of whole months (1.56× against 0.32×).

What a "new .xyz" flag is worth. In January–May 2026, one in every 2,800 new .xyz names was listed in OpenPhish within a week of first sighting. From June 1 to September 20 it was one in 22,400, so a check on new .xyz names had to look at eight times as many names to find one listing. Part of that fall is the feed itself: new names in other top-level domains were listed less often in the summer too. Measured against them, a new .xyz name went from 2.6 times as likely to be listed (2.31–2.96) to half as likely (0.44–0.62), a fivefold fall. Set aside the January–March campaign and compare April–May alone, and the fall is from 1.08× (0.83–1.39) to 0.52×: about twofold.

For a new-domain queue, the flood is volume without signal. From September 1 to 27, 2026, .xyz was 10.7% of all newly observed names, and 83.6% of our September sample sat on Afternic's nameservers. About one in eleven newly observed domains, in any top-level domain, was one channel's for-sale inventory. A queue that treats every new name alike spends that share of its attention on names that cannot receive mail and are almost never listed. A fixed top-level-domain score is wrong in one direction or the other: new .xyz was ten times the average in February 2026 and a fourteenth of it in October 2025.

What still carries information is a name's DNS on day one. Our feed first saw the Afternic-listed names a median of one day after creation, already on Afternic's nameservers with a null MX. In our 29-million-domain study, excluding parked and for-sale names was the one DNS rule that shrank a new-domain queue, by about a fifth, while keeping 98% of later listings. The .xyz waves make that filter worth more. Inside .xyz, the shape of the name helps too: 85% of the new .xyz names listed within a week contained a digit or a hyphen, while 80% of all new .xyz names contained neither.

What We Can and Cannot Infer

What's at Stake

• "Newly registered" is losing information. Security tools treat a new domain as risky and weight some top-level domains as riskier than others. In every wave month since August 2025, a new .xyz name was less likely than a new name elsewhere to be listed as phishing; outside the waves it was usually as likely or more. When one channel's for-sale inventory is one in eleven of all newly observed domains, a name's age says less, and its marketplace nameservers and null MX say more.
• Registration statistics are becoming inventory statistics. One registrar-to-marketplace channel produced most of .xyz's growth in 2025 and 2026. Monthly totals that do not separate bulk speculative registrations from end-user registrations misread the market.
• A 2027 deletion cliff is likely. Roughly 2.7 million excess 2026 names will reach their first renewal between June and September 2027. The August 2025 batch suggests most will be deleted: 88% of its sample had been deleted by September 28. Those names are still in the registry's redemption period and should be released in October 2026, so whether drop-catchers or anyone else want them is not yet known.
• AI vocabulary is being pre-empted. Names built from gpu, mcp, llm, dataset and agent compounds are being warehoused in bulk. A startup looking for a two-word .xyz name in 2026 will often find it already listed for sale on Afternic by a bulk registrant.

What Would Help

1. Security teams and newly-registered-domain feeds: split out marketplace inventory. Names on marketplace nameservers with a null MX are visible from their first day, cannot receive mail and are almost never listed as phishing. Tag them in the feed, score them separately, and let new-domain alerts focus on the rest. Recompute any top-level-domain weight every month: .xyz's relative listing rate ran from 0.07× to 9.86× within one year, so a fixed score is wrong in one direction or the other.

2. Registries: publish bulk-registration shares with monthly totals. The .xyz registry can see what we inferred: the share of new registrations from each registrar that goes straight to marketplace nameservers. Publishing it would stop bulk inventory cycles being read as demand, and would tell security teams when a wave is under way.

3. Analysts: separate letters-only, compound-word and marketplace-nameserver registrations. Three cheap signals identified every wave in our data: the letters-only share, the marketplace-nameserver share at first sight, and the leading registrar's share. Monthly market reports that already count registrations can add them.

4. Marketplaces: label bulk inventory. A buyer looking at a listing such as neuralpayshub.xyz cannot tell whether it is one owner's considered pick or entry 400,000 in a generated list. A "bulk portfolio" flag on listings would make the market more honest.

5. Everyone watching expiring names: the releases start now. Most of the August 2025 batch should return to the available pool in October 2026. If the pattern holds, the October–December 2025 batches follow in early 2027, and the 2026 batches, larger than any earlier wave, in the second half of 2027. Anyone monitoring expiring names or new registrations should expect each release and filter it by the same recipe signatures.

Analysis by DomainsProject, an Internet measurement and intelligence organization. New names: our Newly Observed Hostnames feed, December 24, 2024 – September 27, 2026 (outage August 21–27, 2026). Registrar and DNS: random samples checked against registry RDAP and live DNS on September 28, 2026. History: 29 monthly web crawls, April 2023 – September 18, 2026, classified with the front-door registry from The Parking Lot. Listings: OpenPhish public-feed history and URLhaus; the security-signal comparison uses OpenPhish listings within a week of first sighting, for names first seen July 1, 2025 – September 20, 2026. Independent registration counts from ABTdomain. We describe a registration channel and a naming recipe, not the identity or intentions of any registrant. Russian-territorial top-level domains are excluded. See the dataset page and statistics.