Daily zone census

142,405 domains were born on Friday, August 28, 2026

142,405
domains appeared
113,889
domains left the zone
21.0%
had a live website by day's end
633
flagged high or critical

On Friday, August 28, 2026 the census compared 1,052 zone files holding 75,872,138 domains against the day before. 142,405 names were new (0.188% of the universe), 113,889 were gone, net +28,516. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 2

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website29,845 21.0%
  • Parked or for sale3,838 2.7%
  • Registered, no site yet32,051 22.5%
  • Nothing there at all42,633 29.9%
  • Couldn't tell34,038 23.9%

What the 29,845 live sites are about

Unclassified9,041 · 30.3%
Gambling & casino4,440 · 14.9%
E-commerce & retail3,165 · 10.6%
Hosting & domains2,652 · 8.9%
Streaming Piracy1,158 · 3.9%
Blogs & personal983 · 3.3%
SaaS & tech926 · 3.1%
Gaming710 · 2.4%
Adult552 · 1.8%
Food & restaurants543 · 1.8%
Corporate services499 · 1.7%
Construction Trades498 · 1.7%

Where the new names landed

TLDBornGoneFlagged /1k
.top13,90914,3391.9
.casa12,2921,0601.1
.shop11,25410,7690.4
.online9,35210,1013.4
.org9,0326,3981.4
.xyz8,37220,3424.3
.site7,5524,6601.2
.store4,7785,4704.2
.info4,5276,4920.9
.app4,4131,2652.3
.asia3,7266850.5
.click3,4761,7516.9
.cam2,9771131.3
.vip2,9471,8291.7
.pro2,5701,6952.3
.lol2,0071,4076.5
.live1,8451,11310.3
.cfd1,8321,3204.4
.sbs1,7581,74810.2
.space1,4381,1412.8
.icu1,2891,8208.5
.fun1,2028375.0
.work1,1481600.9
.garden1,02570.0
.biz1,0138456.9

Top 25 of 504 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-08-28.

Who is parking them

Dan2,262
Atom284
NameBright113
Sav107
Sedo55
Domeneshop35
Afternic4
Efty1
Epik1
Fabulous1

What the live sites are built with

WordPress3,517
Vercel2,501
Shopify236
Wix172
Squarespace95
Next.js44
Joomla19
Webflow11
Drupal10
GitHub Pages6

Writing system of the live sites

latin25,392
han2,264
cyrillic1,111
thai423
arabic296
hangul133
bengali86
hiragana53

How old the departed names were

1–2 years39,309
2–5 years4,642
6–30 days1,620
1–3 months552
over 5 years3,190
3–12 months2,280
0–5 days (add-grace return)1,183
~1 year (first renewal lapse)11,266

Risk signals

Every one of the 315,423 births was scored on its name, its nameservers and registrar, and the page it served. 9,201 scored at all; 36 critical, 597 high, 1,621 medium, 6,947 low. The top 300 were screenshotted and shown to a model, which called 150 of them phishing, scam or abuse and 100 benign.

TLDs with the most flagged births per 1,000

.team18.7 · 2 of 107
.help15.4 · 6 of 390
.ink11.3 · 4 of 353
.live10.3 · 19 of 1,845
.sbs10.2 · 18 of 1,758
.icu8.5 · 12 of 1,289
.wiki8.5 · 3 of 355
.mom7.7 · 3 of 388
.pics7.1 · 2 of 282
.click6.9 · 25 of 3,476

Signals that fired most

brand in page title, not in the name1,081
TLD with a high abuse rate944
brand name at a retail registrar725
brand in the name607
form on a brand-styled page441
brand name at a watch-list registrar287
punycode name254
brand name behind Cloudflare251
identical page on many newborns136
lure words (login, verify, secure…)135
one-letter brand typo132
nameserver domain born the same day100

Brands most often echoed in new names

whatsapp60
icloud56
amazon37
google29
binance24
vanguard24
telegram23
hulu18
tmobile18
ebay17
tiktok17
gmail15

Registrars of flagged names

NameCheap, Inc.190
Dynadot Inc159
HOSTINGER operations, UAB159
Spaceship, Inc.154
GMO Internet Group, Inc. d/b/a Onamae.com109
GoDaddy.com, LLC107
NameSilo, LLC83
NICENIC INTERNATIONAL GROUP CO., LIMITED70
Porkbun LLC63
Cloudflare, Inc.63

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalrobinhoodmisfits.xyzscore 91echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.+3 more

Model opinion: looks like a scam, confidence 82%. An opinion, not a finding.

Criticalartificialrobinhood.xyzscore 85echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratexyzbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB+2 more

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalebayapp.bestscore 83echoes ebay· active website
brand in the nameebaybrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+2 more

Model opinion: looks like abuse (target: eBay), confidence 80%. An opinion, not a finding.

Criticalsantanderplatform.bizscore 83echoes santander· active website
brand in the namesantanderbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Inc+2 more

Model opinion: looks like phishing (target: Santander), confidence 72%. An opinion, not a finding.

Criticalwhatsappai-invest.bizscore 83echoes whatsapp· active website
brand in the namewhatsappbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Inc+2 more

Model opinion: looks like a scam (target: WhatsApp), confidence 88%. An opinion, not a finding.

Criticalinstagram18plus.topscore 80echoes instagram· active website
brand in the nameinstagrambrand plus digitsinstagram18plusTLD with a high abuse ratetopbrand name behind Cloudflarecloudflare.com+2 more

Model opinion: looks like phishing (target: Google Play / Instagram (Meta)), confidence 80%. An opinion, not a finding.

Criticalwordpress-ecommerce2.xyzscore 78echoes wordpress· active website
brand in the namewordpressbrand plus digitswordpress-ecommerce2TLD with a high abuse ratexyzbrand name at a retail registrarHOSTINGER operations, UAB+2 more

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalearnwithlinkedin.cloudscore 77echoes linkedin· active website
brand in the namelinkedinbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABbrand name and brand-styled pagelinkedin+1 more

Model opinion: looks like phishing (target: LinkedIn), confidence 78%. An opinion, not a finding.

Criticalrobloxmodapk.orgscore 77echoes roblox· active website
brand in the namerobloxbrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Incbrand name and brand-styled pageroblox+1 more

Model opinion: looks like abuse (target: Roblox), confidence 90%. An opinion, not a finding.

Criticalrobinhood-drop.xyzscore 76echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarWeb Commerce Communications Limited dba +2 more

Model opinion: looks like phishing (target: Robinhood), confidence 76%. An opinion, not a finding.

Criticaltiktokshop-grupo.clickscore 76echoes tiktok· active website
brand in the nametiktokTLD with a high abuse rateclickbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot, LLC+2 more

Model opinion: looks like phishing (target: TikTok Shop), confidence 68%. An opinion, not a finding.

Criticalcommunityvoterbinance.funscore 74echoes binance· active website
brand in the namebinanceTLD with a high abuse ratefunbrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Inc+1 more

Model opinion: looks like phishing (target: Binance), confidence 94%. An opinion, not a finding.

Criticalstripeconnecttesting1.storescore 73echoes stripe· active website
brand in the namestripebrand plus digitsstripeconnecttesting1brand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.+2 more

Model opinion: looks benign, confidence 74%. An opinion, not a finding.

Criticaltelegramwallet.storescore 70echoes telegram· active website
brand in the nametelegramlure words (login, verify, secure…)walletbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.

Model opinion: looks like abuse (target: Telegram), confidence 62%. An opinion, not a finding.

Criticalapexgold.cyouscore 68· active website
TLD with a high abuse ratecyoupage impersonates a brandBinancebrand in page title, not in the namebinanceform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Binance), confidence 93%. An opinion, not a finding.

See all 633 high and critical rows for 2026-08-28

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.