WhoisXML API
DOMAIN THREAT REPORT
1 July 2026
Domain intelligence · July 2026

237 domains reference Venezuela’s earthquake, most filed within 48 hours

A small, high‑confidence set of current domain registrations that clearly reference the Venezuela earthquake, likely a fraction of the wider registration activity the event has driven, profiled across creation dates, registrars, registrant emails, name servers and naming intent. A magnitude‑7.2 foreshock and magnitude‑7.5 mainshock struck north‑central Venezuela on 24 June 2026; 44% of these domains were filed on 25 June alone, the day after. Updated on 1 July: a differential capture adds the complete days of 29 and 30 June, 25 further registrations that bring the set to 237, up from 212 in the 29 June baseline. Full data access is available to verified organizations through our research and media collaborations program.

Domains in set
237
referencing the Venezuela earthquake
New since 29 June
+25
212 on 29 June → 237 now
No individual mailbox
93%
privacy services or no listed registrant contact
Largest registrar
22%
Namecheap leads; no operator dominates

The surge after the quake

Registrations per day

New registrations by creation date, charted from three days before the 24 June earthquake. Those three days show no registrations; the wave begins only after it and peaks the next day, with new names still being registered in the days since.

0
21 Jun
 
0
22 Jun
 
0
23 Jun
 
3
24 Jun
▲ quake, 24 Jun
105
25 Jun
 
60
26 Jun
 
29
27 Jun
 
15
28 Jun
 
1 Jul capture
15
29 Jun
 
10
30 Jun
 
Since the 29 June snapshot of 212 domains, the 1 July capture adds the now‑complete days of 29 and 30 June — 25 further registrations, bringing the set to 237.

The terms studied

Substring coverage

The set was assembled from names containing Venezuela markers (venezuela, vzla, plus affected places such as Caracas and La Guaira) alongside earthquake and aid vocabulary. Roughly a quarter pair a country marker directly with a quake term such as terremoto or sismo (51 domains).

venezuela
187
e.g. acopioayudasvenezuela.com, acopiosvenezuela.com
vzla
43
e.g. acopiovzla.com, ayudaavzla.com
terremoto
36
e.g. afectadosporelterremotovenezuela.com, ayudamedicaterremotovenezuela.com
sismo
18
e.g. ayudasismovenezuela.com, datasismosvzla.com
ayuda
73
e.g. acopioayudasvenezuela.com, ayuda-venezuela.com
sos
39
e.g. buscandote-sosvenezuela.org, recursosvenezuela.com
acopio
17
e.g. acopioayudasvenezuela.com, acopiosvenezuela.com
donacion
5
e.g. donacionesporvenezuela.com, donacionesvenezuela.com
This is a conservative floor, not a census. Coverage widens with further transliterations and regional spellings, related relief and donation vocabulary, fuzzy and typo variants, and a historical‑WHOIS view of names registered and dropped over time — all natural pivot points for further investigation.

Who is behind the registrations

Registrant & infrastructure

93% of the set exposes no individual registrant mailbox, so shared-email clustering finds almost nothing. Registrations spread across 31 registrars with the largest holding 22%, and no single operator dominates — a pattern consistent with many independent registrants acting at once rather than one coordinated job.

3 domains
Registrar
DreamHost
Pattern
same SLD across three TLDs
sismosvenezuela.com
sismosvenezuela.net
sismosvenezuela.online

The only registrant mailbox recurring across more than one domain in the set.

31 registrars · 20 TLDs
Top NS
Cloudflare, GoDaddy, Vercel, Namecheappopular consumer stacks
Largest single registrar share: 22%
Registrations that list a direct mailbox: 17

The infrastructure is the ordinary mix of consumer registrars, not a shared-account fingerprint.

237
domains in set
93%
no individual mailbox
31
distinct registrars
1
recurring registrant (3 domains)
With per‑domain privacy forwarding on most records and a broad spread of consumer registrars, the data points to a wide, distributed wave of separate registrations rather than a single bulk job. The 17 records that list a direct mailbox — one contact recurring across three of them — could be the natural pivot points for further investigation.

Infrastructure breakdown

Where the names live

How the registrations distribute across registrars, name-server providers and top-level domains.

Registrars top 10

Namecheap
51
Name.com
46
GoDaddy
31
Cloudflare
28
Hostinger
25
IONOS
10
Spaceship
8
Porkbun
5
Key-Systems
3
PDR Ltd. d/b/a PublicDomainRegistry.com
3

Name-server providers top 10

Cloudflare
52
Namecheap
35
GoDaddy
35
Vercel
29
Hostinger (parking)
24
Name.com
12
IONOS
8
NS1
7
Spaceship
6
squarespacedns.com
5

TLDs top 12

.com
118
.org
49
.lat
10
.help
8
.site
7
.online
7
.app
7
.info
7
.net
6
.xyz
5
.live
2
.click
2

What the names suggest

Apparent intent

Themes from keywords in the domain names. Aid, donation and rescue language dominates, alongside missing-person and emergency vocabulary. Themes overlap and describe apparent intent only.

Aid & donations
122
acopioayudasvenezuela.com, acopiosvenezuela.com, acopiovenezuela.com
Earthquake / seismic
61
afectadosporelterremotovenezuela.com, ayudamedicaterremotovenezuela.com, ayudasismovenezuela.com
SOS & rescue
55
alrescatevenezuela.com, buscandote-sosvenezuela.org, recursosvenezuela.com
Year-tagged 2026
14
ayudavenezuela2026.com, ayudavzla2026.lat, buscavzlaterremoto2026.org
Missing & affected
12
afectadosporelterremotovenezuela.com, ayudaencontrarvenezuela.com, buscandote-sosvenezuela.org
Medical & health
7
ayudamedicaterremotovenezuela.com, ayudamedicavenezuela.com, infosaludsismovzla2026.com
Emergency & crisis
6
crisisayudavenezuela.com, emergenciavenezuela.com, emergenciavenezuela.digital
Info, maps & tracking
4
directorioterremotovenezuela.org, listaterremotovenezuela.com, mapadeayudavzla.com
Shelter
3
refugiodonacionesvenezuela.com, refugiosvenezuela.com, refugiovenezuela.com
Field example · third-party page
Screenshot of a third-party earthquake-response web page
A live page referencing the earthquake, shown for illustration: an emergency banner, prominent casualty figures, and a crypto-only (USDT) donation flow. The figures shown are the page’s own and are not verified here, and its inclusion is not a determination about the site.

Analyst note

Commentary
WhoisXML API researcher
 These 237 domains are the high‑confidence matches, names that clearly point to the earthquake and likely a small share of what the event has driven. Most were filed in the first two days, with more arriving since. Many already resolve to live pages, donation drives and boards listing the missing, while others sit empty for now. A lot of it looks like real organizations and volunteers moving fast, but a wave like this, with more names likely behind it, is hard to vet. Some of the live pages are crypto-only, soliciting Bitcoin ‘for the victims’ with nothing to indicate the funds reach anyone. What separates the credible from the rest is confirming who runs a site, and whether a named missing person also appears on the established platforms and not only on a domain registered this week. 
Alexandre FrançoisDNS Threat Researcher and Research & Media Collaborations Director, WhoisXML API

Domain explorer

Sample · 50 of 237 domains

A representative 50‑domain sample with registrant emails masked. It preserves the TLD mix of the full set and covers every naming theme. Search and filter, click an email to pivot, and export the filtered view.

Request full access

This explorer shows a 50‑record sample; all figures above are computed from the full 237‑domain set. Verified organizations can request the complete records, deeper WHOIS detail, historical data, and ongoing monitoring of these and related strings.

Request full access
Representative sample of 50 · emails masked · as of 1 July 2026
DomainCreatedRegistrarName serverCountryRegistrant emailThemes

About this report

Methodology & disclosures

This report draws on WhoisXML API’s domain and DNS intelligence, covering current domain registrations whose names reference the June 2026 Venezuela earthquake, together with their registration details. It combines two captures — a baseline taken 29 June and a differential taken 1 July 2026 — merged so each domain appears once, with registrar, name servers and expiry taken from the later capture and the creation date pinned to the earliest. The seed terms combined Venezuela markers with generic earthquake and seismic words (“earthquake”, “terremoto”, “sismo”); across both captures the pull returned 286 distinct domains, of which 241 reference Venezuela. 3 of those predate the earthquake — pre-existing domains that merely match the terms — and are excluded as out of window, leaving the 237 registered between 24 and 30 June as the basis of every figure here; 212 of these, registered through 28 June, made up the 29 June baseline. The remaining 45 match only the generic terms and, on review, reference earthquakes in other countries (Thailand, the Philippines, Chile, Italy, California) or earthquake-insurance services; at least 23 are such substring coincidences and are excluded. All figures are computed from the full 237-domain set; the explorer shows a representative 50-domain sample with registrant emails masked, and registrar names were normalized to merge variants of the same company. Registrant countries for privacy-proxied domains reflect the proxy service’s address (for example Iceland for one widely used service), not the registrant’s. Naming themes are derived from keywords and describe apparent intent only; inclusion in this report does not confirm affiliation with, or infringement of, any trademark, nor establish any connection to wrongdoing, and some domains may be legitimate relief, journalism, research, advocacy or commentary projects.