This week in domain intelligence:
- A critical flaw in the software behind a large part of the web was patched mid-week; the address built on its nickname was in place a week ahead on the disclosing side, while names from dozens of unrelated registrants followed within two days.
- A template of investment-firm names registered in blocks grew large enough to lift a top-twenty keyword in the hot table while leading the emerging table.
- The surge in one alternative extension through a single registrar continued at a slightly smaller size, peaking early in the week and thinning from Friday.
- A three-letter name led the week’s reported sales among those with a named platform; the week’s highest reported price carried no platform.
- The largest registry operator reported a record quarter for new registrations and gave a launch window for a long-pending extension.
Domain Registration Intelligence
Weekly Registration Overview
New registrations for October 19-25, 2026, compared with October 12-18. Data available as of October 27. Source: DomainKits NRDS.
| TLD | Oct 19-25 total | Daily avg | Oct 12-18 total | Daily avg | Daily avg change |
|---|---|---|---|---|---|
| .com | 1,093,167 | 156,167 | 1,057,061 | 151,009 | +5,158 |
| .org | 57,312 | 8,187 | 60,390 | 8,627 | -440 |
| .net | 52,221 | 7,460 | 55,521 | 7,932 | -472 |
| .app | 36,692 | 5,242 | 37,686 | 5,384 | -142 |
| .dev | 10,570 | 1,510 | 11,166 | 1,595 | -85 |
| .xyz | 547,115 | 78,159 | 592,014 | 84,573 | -6,414 |
Onamae.com again accounted for most .xyz registrations: 503,236 of the week’s 547,028 registration records, down from 552,967 of 591,965 the week before. Of its registrations, 465,638 used Afternic’s nameservers.
The burst peaked at 132,404 names on Tuesday, then fell to 39,646 on Friday and 8,975 on Saturday, with none recorded on Sunday. Tuesday’s sample included two-word names such as scanendowments, rottencatalyst, fanstechnology and registerchoice, all registered for one year. No public explanation for the burst has been found.
Hot Keywords
Weekly counts from September 28 to October 25, 2026. Pure-letter .com registrations only. Among the twenty highest-volume keywords, the table shows the two largest weekly gainers and three largest decliners by percentage. Source: DomainKits Trends.
| Keyword | Sep 28-Oct 4 | Oct 5-11 | Oct 12-18 | Oct 19-25 | W-o-W |
|---|---|---|---|---|---|
| capital | 1,887 | 1,899 | 2,998 | 4,994 | +66.6% |
| media | 2,752 | 2,788 | 2,684 | 3,098 | +15.4% |
| lab | 3,055 | 3,256 | 3,412 | 3,196 | -6.3% |
| services | 3,601 | 3,735 | 3,711 | 3,481 | -6.2% |
| solutions | 3,507 | 3,488 | 3,644 | 3,445 | -5.5% |
“media” recovered from last week’s decline and finished above all three earlier weeks. The rise in “capital” came from the investment-firm naming pattern below.
Emerging .com Keywords
The table lists the five largest emerging keywords. Each had at least 100 registrations this week and a count at least double its average for the previous three weeks. Pure-letter .com registrations only, deduplicated by domain; the overlap rule is in Method Notes. Source: DomainKits NRDS.
| Keyword | Prior 3-week avg | Report week | vs. avg | Peak day share |
|---|---|---|---|---|
| capital | 2,261 | 4,994 | +121% | 36% |
| equity | 397 | 1,888 | +376% | 33% |
| funding | 491 | 1,196 | +144% | 38% |
| artie | 4 | 655 | +16,275% | 63% |
| acquisition | 130 | 491 | +278% | 34% |
Investment-firm and funding names
“capital”, “equity” and “acquisition” share one template: two nature, place or material words plus an investment-firm suffix (everholtprivateequity, falconpointcapitalgroup, birchcliffacquisitions). Dynadot registered 7,244 names ending in one of seventeen such suffixes this week against 1,060 the week before, in batches on October 20, 23 and 24, and Spaceship added 1,974 on October 19. “funding” is a separate merchant-funding set (cashflowfundingaccess, toplinefundingnetwork): INWX 446 names and Porkbun 257, of which 203 on October 25.
PHP registrations around the disclosure
php2shell is the nickname of two critical flaws in PHP; the PHP project shipped fixes on October 21, a day earlier than scheduled after the identifiers leaked (PHP security advisory; PHP Foundation). php2shell.com was registered on October 14, a week before the fixes shipped. The page at that address is Wiz Research‘s advisory on php2shell, so the notice was in place by the time the disclosure spread. Before that date the record holds no other name containing the nickname.
The public reaction came after the release. “php” appeared in 105 pure-letter .com names in the week, against a prior three-week average of 28, clearing both emerging thresholds: 30 on October 21, the day the fixes shipped, and 35 the next day.
The names registered from October 21 suggest several responses to the disclosure:
- Checkers: phpversionchecker and scanmyphp.
- Patching and repair: patchyourphp, urgencephp and phptaisaku.
- Migration: getoffphp, websitewithoutphp and websitezonderphp.
- Incident response: phpbreach and phpremediation.
The nickname itself appeared in 52 names across the dataset’s extensions, all registered between October 21 and 23, among them php2shell.org, php2shellcheck.com, php2shellexploit.com and php2shell-scanner.com. The 105 “php” names used 71 distinct nameserver sets, and no registrar handled more than 16. One name on a corporate registrar a week early, then dozens of unrelated registrants within two days: the record separates the parties who prepared the disclosure from those who reacted to it.
Follow-up from last week
Last week’s debt-related batches slowed: “debt” fell from 931 names to 638, “lien” from 629 to 354 and “resolve” from 228 to 148. Batches of “debt” names using Porkbun’s default nameservers continued on four days, ranging from 99 to 227 names a day.
Registration data reflects observed patterns in newly registered domain names and does not constitute investment advice. Individual registrant intent cannot be confirmed from registration data alone.
Domain Trading Intelligence
Selected Sales
The five highest-priced sales publicly reported during October 19-25 with a named platform and a registry record consistent with the report. Sales published in a platform’s weekly batch list belong to the previous week and are not ranked. Dates are the dates the sales were reported. Sources and selection rules are in Method Notes.
| Domain | Price | Platform | Reported date |
|---|---|---|---|
| ete.com | $250,000 | Afternic | Oct 20 |
| dimension.io | $150,000 | Atom | Oct 20 |
| deeplogic.ai | $40,000 | Atom | Oct 21 |
| preorders.com | $40,000 | Atom | Oct 22 |
| brainwatch.com | $25,000 | Afternic | Oct 22 |
deeplogic.ai and preorders.com tied at the third row. Three sales tied at the fifth row; alphabetical order puts brainwatch.com in the table, ahead of exarch.ai (Spaceship, October 21) and speech.si (Spaceship, October 23).
ete.com was created in 1999 and dimension.io in 2013; neither buyer has been publicly disclosed. Daytona.com had the week’s highest reported price at $500,000. No platform was named in its sale report, so it is excluded from the ranking.
Industry News
Verisign reports record registrations and a .web launch timetable. Verisign processed 13.1 million new .com and .net registrations in the third quarter, up from 10.6 million a year earlier, according to its October 22 results. The two zones ended the quarter at 182.5 million names, a net increase of 3.36 million. Revenue rose to $443 million from $419.1 million (Verisign release).
The company plans to open .web’s trademark sunrise in mid-December. A limited registration period would follow from mid-January 2027, allowing most .com registrants to register the matching .web name. General availability would come afterward; pricing has yet to be set (Domain Name Wire, October 22; Web Hosting Today, October 23).
Premium Domain Intelligence
Selected .com expirations detected from October 19 to 25 by DomainKits Changes Monitor.
Notable Expirations
The oldest domains, by original creation date, among this week’s five- to ten-letter expirations still using expiry-hold nameservers on October 27. A .com expiration date automatically advances by a year at the registry, so the date alone does not confirm renewal.
| Domain | Length | Original creation year | Registrar | Detected |
|---|---|---|---|---|
| forrest.com | 7L | 1995 | Tucows | Oct 20 |
| netanswer.com | 9L | 1997 | Register.com | Oct 19 |
| greaton.com | 7L | 1997 | HiChina | Oct 23 |
The three remain on their registrars’ expiry-hold nameservers. None has redemption or pending-delete status at the registry, and registrants can typically still renew at this stage.
Names Followed From Earlier Issues
- neq.com. The expiration date moved to 2029 and the nameservers returned to the registrar’s hosting set on October 20: renewed.
Weekly Insight
The largest keyword spikes came from concentrated registration batches. Dynadot and Spaceship handled thousands of names built from the same investment-firm template. The smaller PHP spike was spread across registrars and coincided with a public security disclosure, with names referring to checkers, repairs and migration. By count the template dwarfs the event; by registrant spread, only the event reads as a reaction to something outside the registrars. The record also dates the two sides of that event: one address a week before the release, dozens in the two days after. Search the week’s names in DomainKits NRDS.
Method Notes
- Counts. Daily trend series for the overview; keyword counts word-based, pure-letter .com, deduplicated, markets folded into capital.
- Sales. Named platform plus a consistent registry record change; weekly batch lists cover the prior week, not ranked.
- Dates. Expirations detected October 19-25; registry records checked October 27; php2shell counts are substring matches.
Data Sources: Sales: collected public reports; the selected table identifies the platform named in each report. Registration and trend data: DomainKits. Domain changes: DomainKits Changes. For reference only, not investment advice.
Published by: ABTdomain