Daily zone census

147,411 domains were born on Saturday, August 29, 2026

147,411

domains appeared

111,598

domains left the zone

19.5%

had a live website by day's end

705

flagged high or critical

On Saturday, August 29, 2026 the census compared 1,052 zone files holding 75,907,520 domains against the day before. 147,411 names were new (0.194% of the universe), 111,598 were gone, net +35,813. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 2

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

Active website28,802 19.5%
Parked or for sale3,205 2.2%
Registered, no site yet30,225 20.5%
Nothing there at all34,274 23.3%
Couldn't tell50,905 34.5%

What the 28,802 live sites are about

Unclassified7,229 · 25.1%

Hosting & domains5,171 · 18.0%

Gambling & casino4,616 · 16.0%

E-commerce & retail2,505 · 8.7%

SaaS & tech992 · 3.4%

Gaming627 · 2.2%

Corporate services603 · 2.1%

Adult571 · 2.0%

Blogs & personal551 · 1.9%

Construction Trades492 · 1.7%

AI software471 · 1.6%

Real estate462 · 1.6%

Where the new names landed

TLD	Born	Gone	Flagged /1k
.vip	27,295	2,797	0.3
.top	11,897	13,000	4.6
.asia	11,896	608	0.2
.online	9,109	7,542	2.2
.org	8,711	7,004	2.3
.shop	7,991	13,565	2.8
.site	6,213	4,679	3.5
.xyz	5,301	18,693	5.3
.store	4,722	5,236	3.0
.click	4,484	1,266	6.7
.info	4,269	5,509	2.3
.pro	2,027	1,763	2.0
.dev	1,848	518	1.1
.live	1,735	1,441	2.9
.lol	1,665	788	8.4
.icu	1,602	2,044	12.5
.digital	1,473	250	0.0
.fun	1,449	914	6.2
.biz	1,365	748	1.5
.sbs	1,361	1,482	6.6
.space	1,179	1,179	5.9
.world	1,165	552	2.6
.tech	1,143	620	2.6
.lat	1,036	493	1.0
.cloud	877	830	3.4

Top 25 of 509 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-08-29.

Who is parking them

Dan1,751

Atom107

Sav77

NameBright57

Domeneshop38

Sedo37

Epik2

Voodoo1

Fabulous1

What the live sites are built with

WordPress2,383

Vercel1,665

Shopify299

Wix119

Squarespace93

Next.js80

Webflow15

Drupal8

GitHub Pages7

Joomla4

Writing system of the live sites

latin25,862

han1,089

cyrillic924

arabic296

thai292

hangul205

hiragana41

devanagari28

How old the departed names were

1–2 years417

2–5 years1,523

6–30 days31

1–3 months13

over 5 years9

3–12 months34

0–5 days (add-grace return)11

~1 year (first renewal lapse)71

Risk signals

Every one of the 312,297 births was scored on its name, its nameservers and registrar, and the page it served. 8,715 scored at all; 38 critical, 667 high, 1,513 medium, 6,497 low. The top 300 were screenshotted and shown to a model, which called 136 of them phishing, scam or abuse and 105 benign.

TLDs with the most flagged births per 1,000

.cam19.2 · 9 of 469

.bid19.2 · 2 of 104

.help13 · 7 of 461

.icu12.5 · 21 of 1,602

.rest9.8 · 2 of 204

.cfd9.7 · 8 of 828

.solutions9.4 · 1 of 106

.one8.9 · 2 of 225

.lol8.4 · 14 of 1,665

.casino7.3 · 2 of 273

Signals that fired most

brand in page title, not in the name1,096

TLD with a high abuse rate938

brand name at a retail registrar707

brand in the name507

form on a brand-styled page481

brand name at a watch-list registrar303

brand name behind Cloudflare224

punycode name218

one-letter brand typo206

lure words (login, verify, secure…)134

identical page on many newborns129

nameserver domain born the same day115

Brands most often echoed in new names

icloud96

binance35

google30

tmobile27

tiktok21

vanguard19

amazon18

zelle17

booking17

trezor13

chatgpt13

coinbase13

Registrars of flagged names

NameCheap, Inc.238

Spaceship, Inc.185

Dynadot Inc181

HOSTINGER operations, UAB152

GoDaddy.com, LLC91

NICENIC INTERNATIONAL GROUP CO., LIMITED89

Name.com, Inc.87

NameSilo, LLC81

Cloudflare, Inc.72

NameSilo,LLC58

Nameserver providers of flagged names

cloudflare.com876

dns-parking.com162

registrar-servers.com93

namecheaphosting.com28

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalsecureicloud.techscore 100echoes icloud· active website

brand in the name “icloud”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “HOSTINGER operations, UAB”+3 more

Model opinion: looks like phishing (target: Apple), confidence 95%. An opinion, not a finding.

Criticaldocu-signsecurepoint.topscore 96echoes docusign· active website

brand in the name “docusign”lure words (login, verify, secure…) “secure”TLD with a high abuse rate “top”brand name at a retail registrar “NameSilo,LLC”+2 more

Model opinion: looks like phishing (target: DocuSign), confidence 97%. An opinion, not a finding.

Criticalcommunityvotebinance.xyzscore 89echoes binance· active website

brand in the name “binance”TLD with a high abuse rate “xyz”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more

Model opinion: looks like phishing (target: Binance), confidence 94%. An opinion, not a finding.

Criticalmobile-homeservice.comscore 86echoes tmobile· active website

one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “service”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+1 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalinvoice-coinbase.sitescore 82echoes coinbase· active website

brand in the name “coinbase”lure words (login, verify, secure…) “invoice”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”form on a brand-styled page “has_form”

Model opinion: suspicious (target: Coinbase), confidence 62%. An opinion, not a finding.

Criticallcloud-alert.xyzscore 82echoes icloud· active website

one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “alert”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse (target: Apple (iCloud)), confidence 66%. An opinion, not a finding.

Criticaltrustwallet-promo.sitescore 82echoes trustwallet· active website

brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Trust Wallet), confidence 68%. An opinion, not a finding.

Criticalintagram.sitescore 80echoes instagram· active website

one-letter brand typo “intagram≈instagram”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “instagram”+1 more

Model opinion: looks like abuse (target: Instagram), confidence 60%. An opinion, not a finding.

Criticalvanguardnexus.sitescore 77echoes vanguard· active website

brand in the name “vanguard”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “vanguard”+1 more

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalmobile-casino.topscore 74echoes tmobile· active website

one-letter brand typo “mobile≈tmobile”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Namecheap Inc.”+2 more

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticalnightresetsystem.shopscore 72echoes etsy· active website

brand in the name “etsy”lure words (login, verify, secure…) “reset”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+1 more

Model opinion: looks like a scam, confidence 58%. An opinion, not a finding.

Criticaltelegramdirectory.techscore 71echoes telegram· active website

brand in the name “telegram”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalgoogletamil.comscore 68echoes google· active website

brand in the name “google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more

Model opinion: looks like abuse, confidence 92%. An opinion, not a finding.

Criticalladezelle.shopscore 68echoes zelle· active website

brand in the name “zelle”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc.”brand name at a watch-list registrar “Dynadot Inc.”+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticaloneex.icuscore 68· active website

TLD with a high abuse rate “icu”page impersonates a brand “Binance”brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

See all 705 high and critical rows for 2026-08-29

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.