More than 12 years have passed since its application, but the domain extension .web will finally launch in December 2026. Many brand holders will ask whether they should ignore this new extension or take some kind of action to prevent cyber risks. In this blog post, we will provide an overview into the launch to help you understand your options.
First, let’s look at how new global top-level domains (gTLDs) have been registered over the last 10 years. Below are several snapshots showing the most registered new gTLDs overall, most registered new gTLDs by enterprise, and the most common extensions used for fraud.
Most registered new gTLDs globally
Around the world, the top 20 new gTLDs are generally intuitive. Words like “shop” or “store” may indicate to the end-user what type of website they may be visiting just from the extension alone.
What this data also shows is that new gTLDs are most popular where the barriers to registering are low, such as with .xyz, which has no restrictions (no credentials, proof of a business, or residency required), and is generally less expensive and available than the most popular extension, .com.
Most registered new gTLDs by enterprises
For enterprises, the most popular new gTLDs are a mix of the intuitive terms mentioned above, but some of them may be defensive registrations—meaning the company register them mainly to prevent third parties from doing so. For example, large enterprises have protected themselves against technology-related new gTLDs, such as .app and .online.
Some may be surprised by .sucks as a top five registration. This is likely a tactic to prevent third parties from using their brand name in connection with a website that may tarnish their image.
How .web fits into the new gTLD outlook
Finally, the most common domain used for fraud is .com, which is run by Verisign, the registry operator also managing the .web extension. You can also see that .xyz is already the fifth most common domain extension in fraud. At this time, we are unable to see whether .web will have mass registrations; however, we want to outline several factors that point to the likelihood of widespread adoption:
- The word “web” is naturally understood for most people, like “online” and “app.”
- This TLD is unrestricted—registration requires no business papers, credentials, or proof of residency.
- The legacy TLDs, such as .com, have seen high adoption, leaving little room for newcomers to register with those extensions unless they are willing to pay a premium price.
Since we expect .web to be significantly popular, large enterprises should review their current domain portfolios, as well as their current positioning, branding, and security considerations. In a recent analysis of the most popular extensions used for fraud, we found that nearly half of the fraud campaigns we examined used .com extensions, with .net and .xyz as two notable gTLDs.
Organizations should weigh the risks of .web domains imitating legitimate brands—not just for intellectual property (IP) infringement, but also for fraudulent phishing schemes used on customers, employees, and other stakeholders.
Notable timing for registrations
Below are the launch dates, but we highly recommend that you start reviewing your domain portfolio to understand whether you want to register a .web during the Sunrise Period, Priority Access Program Period, or General Availability.
The launch dates are:
- Sunrise Period: December 10, 2026–January 11, 2027
- Priority Access Program Period: January 12–April 5, 2027
- General Availability Period: April 6, 2027
One notable change with this launch is that Verisign will allow a limited Priority Access Period during which you will be able to register any .web that corresponds with a .com that you currently own. What we have seen with other launches is that after these legacy periods in the .uk and .au launches, third parties registered between 5% and 7% of domains during the General Availability Period.
If you would like help in better understanding how .web affects your organization, please contact us. If you are a CSC client, please contact your Account Team.
