About
Free daily trends for every top-level domain
RootFetch counts how many domains are registered under each top-level domain, tracks which are growing or shrinking, and flags sudden jumps.
What you can use it for
Spot which TLDs are gaining or losing ground, compare growth across TLDs of any size, watch the daily pulse of the biggest ones, and download the full history.
Unusual jumps
Scammers register domains by the thousand in cheap TLDs, use them for a few days of phishing or spam, and move on. Those bursts show up as sudden jumps in a TLD's zone file, often before the domains land on blocklists. A spike can also be a harmless price promotion, so treat it as a lead, not a verdict.
Where the numbers come from
ICANN's Centralized Zone Data Service gives approved users daily copies of TLD zone files. Every day an automated job downloads a rolling set of them, counts the domains and throws the raw files away. Only the counts are published.
What is a TLD?
A top-level domain (TLD), also called a domain extension, is the last part of a domain name: the .com in example.com or the .xyz in example.xyz. Each TLD's registry publishes a zone file listing every registered domain, which is what RootFetch counts.
"On abuse lists"
These TLDs are named among the most abused in recent reports by Interisle Consulting Group:
- .bond: Interisle report, June 2026
- .cfd: Interisle Phishing Landscape 2025
- .help: Interisle Phishing Landscape 2025
- .info: Interisle report, June 2026
- .top: Interisle report, June 2026
- .vip: Interisle report, June 2026
- .win: Interisle Phishing Landscape 2025
- .xin: Interisle Phishing Landscape 2025
- .xyz: Interisle report, June 2026
Being on the list says nothing about any single domain. Most domains in these TLDs are legitimate.
Source
The code and the full data history are on GitHub.