Daily zone census

193,827 domains were born on Thursday, September 3, 2026

193,827

domains appeared

174,314

domains left the zone

17.8%

had a live website by day's end

861

flagged high or critical

On Thursday, September 3, 2026 the census compared 1,052 zone files holding 75,817,515 domains against the day before. 193,827 names were new (0.256% of the universe), 174,314 were gone, net +19,513. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 17

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

Active website34,413 17.8%
Parked or for sale2,785 1.4%
Registered, no site yet24,173 12.5%
Nothing there at all47,443 24.5%
Couldn't tell85,013 43.9%

What the 34,413 live sites are about

Unclassified9,507 · 27.6%

Hosting & domains5,434 · 15.8%

Gambling & casino3,942 · 11.5%

E-commerce & retail2,919 · 8.5%

Construction Trades1,763 · 5.1%

Blogs & personal1,246 · 3.6%

SaaS & tech971 · 2.8%

Gaming763 · 2.2%

Corporate services643 · 1.9%

Real estate633 · 1.8%

Adult627 · 1.8%

AI software614 · 1.8%

Where the new names landed

TLD	Born	Gone	Flagged /1k
.xyz	57,291	66,902	2.6
.top	17,214	19,851	2.8
.shop	11,015	16,522	1.5
.online	10,516	6,768	2.9
.org	10,014	6,850	2.2
.site	7,786	4,743	2.6
.info	6,499	6,176	1.2
.store	5,546	5,060	2.3
.app	5,212	1,402	2.5
.click	5,058	2,006	3.6
.vip	4,566	1,847	1.3
.pro	4,299	1,862	1.2
.biz	2,192	722	1.8
.sbs	1,812	2,254	8.3
.live	1,789	2,096	5.0
.lol	1,670	966	10.8
.space	1,657	1,006	3.6
.icu	1,499	1,253	12.0
.asia	1,491	565	0.7
.onl	1,429	26	0.0
.tech	1,407	818	1.4
.win	1,264	105	0.8
.cyou	1,249	813	4.0
.fun	1,243	723	23.3
.cloud	1,142	675	0.9

Top 25 of 510 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-03.

Who is parking them

Dan1,366

Sedo193

Atom147

Sav78

NameBright35

Domeneshop31

Fabulous3

Epik2

ParkingCrew1

What the live sites are built with

WordPress3,699

Vercel3,101

Shopify296

Wix147

Squarespace95

Next.js45

Webflow36

Joomla27

Drupal16

GitHub Pages11

Writing system of the live sites

latin30,417

han1,592

cyrillic1,086

thai559

arabic320

hangul189

bengali51

katakana45

How old the departed names were

1–2 years305

2–5 years20

6–30 days18

1–3 months17

over 5 years15

3–12 months95

0–5 days (add-grace return)4

~1 year (first renewal lapse)93

Risk signals

Every one of the 383,361 births was scored on its name, its nameservers and registrar, and the page it served. 12,127 scored at all; 48 critical, 813 high, 1,796 medium, 9,470 low. The top 300 were screenshotted and shown to a model, which called 155 of them phishing, scam or abuse and 88 benign.

TLDs with the most flagged births per 1,000

.today27 · 4 of 111

.fun23.3 · 31 of 1,243

.cfd16.3 · 19 of 1,045

.icu12 · 19 of 1,499

.lol10.8 · 18 of 1,670

.agency10.6 · 2 of 188

.health8.4 · 1 of 119

.sbs8.3 · 20 of 1,812

.help6.8 · 4 of 441

.beauty6.6 · 1 of 152

Signals that fired most

brand in page title, not in the name1,309

TLD with a high abuse rate1,280

brand name at a retail registrar865

brand in the name662

form on a brand-styled page584

punycode name347

brand name at a watch-list registrar344

brand name behind Cloudflare252

one-letter brand typo204

identical page on many newborns166

lure words (login, verify, secure…)150

page impersonates a brand100

Brands most often echoed in new names

icloud88

google41

binance38

tmobile32

tiktok29

gmail28

stripe27

ebay24

robinhood24

amazon22

whatsapp22

vanguard21

Registrars of flagged names

NameCheap, Inc.272

Dynadot Inc266

HOSTINGER operations, UAB191

Spaceship, Inc.146

GoDaddy.com, LLC136

GMO Internet Group, Inc. d/b/a Onamae.com123

NameSilo, LLC119

Name.com, Inc.99

NICENIC INTERNATIONAL GROUP CO., LIMITED95

Cloudflare, Inc.83

Nameserver providers of flagged names

cloudflare.com1,055

dns-parking.com223

registrar-servers.com135

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalwalletcloudflare.comscore 100echoes cloudflare· active website

brand in the name “cloudflare”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+2 more

Model opinion: looks like phishing (target: Cloudflare), confidence 92%. An opinion, not a finding.

Criticallebger.funscore 94echoes ledger· active website

one-letter brand typo “lebger≈ledger”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more

Model opinion: looks like phishing (target: Ledger), confidence 96%. An opinion, not a finding.

Criticallebger.topscore 94echoes ledger· active website

one-letter brand typo “lebger≈ledger”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more

Model opinion: looks like phishing (target: Ledger), confidence 96%. An opinion, not a finding.

Criticallebger.xyzscore 94echoes ledger· active website

one-letter brand typo “lebger≈ledger”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more

Model opinion: looks like phishing (target: Ledger), confidence 97%. An opinion, not a finding.

Criticalbestwebsitebuygmailaccount.topscore 91echoes gmail· active website

brand in the name “gmail”lure words (login, verify, secure…) “account”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “sitechai.com”+3 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalbingchatgpt.topscore 91echoes chatgpt· active website

brand in the name “chatgpt”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+3 more

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalbinancebull.funscore 89echoes binance· active website

brand in the name “binance”TLD with a high abuse rate “fun”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+2 more

Model opinion: looks like a scam (target: Binance), confidence 93%. An opinion, not a finding.

Criticalcalculadorapaypal.orgscore 87echoes paypal· active website

brand in the name “paypal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticaljapan-222-tikktok.sbsscore 78echoes tiktok· active website

one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-222-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse (target: TikTok), confidence 91%. An opinion, not a finding.

Criticaljapan-333-tikktok.sbsscore 78echoes tiktok· active website

one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-333-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.

Criticaljapan-44-tikktok.sbsscore 78echoes tiktok· active website

one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-44-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.

Criticalfidelityridge.sitescore 77echoes fidelity· active website

brand in the name “fidelity”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “fidelity”+1 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalvanguardpath.sitescore 77echoes vanguard· active website

brand in the name “vanguard”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “vanguard”+1 more

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Criticalvanguardshield.sitescore 77echoes vanguard· active website

brand in the name “vanguard”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “vanguard”+1 more

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalmercado-pago-slots.sbsscore 76echoes mercadopago· active website

brand in the name “mercadopago”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: looks like abuse (target: Mercado Pago), confidence 68%. An opinion, not a finding.

See all 861 high and critical rows for 2026-09-03

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.