Daily zone census

179,684 domains were born on Saturday, September 5, 2026

179,684
domains appeared
137,220
domains left the zone
15.6%
had a live website by day's end
941
flagged high or critical

On Saturday, September 5, 2026 the census compared 1,052 zone files holding 75,904,166 domains against the day before. 179,684 names were new (0.237% of the universe), 137,220 were gone, net +42,464. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 19

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website27,978 15.6%
  • Parked or for sale3,866 2.2%
  • Registered, no site yet30,327 16.9%
  • Nothing there at all45,295 25.2%
  • Couldn't tell72,218 40.2%

What the 27,978 live sites are about

Unclassified8,718 · 31.2%
Hosting & domains3,850 · 13.8%
Gambling & casino3,357 · 12.0%
E-commerce & retail2,241 · 8.0%
SaaS & tech1,005 · 3.6%
Adult753 · 2.7%
Gaming691 · 2.5%
Blogs & personal663 · 2.4%
Corporate services537 · 1.9%
Construction Trades516 · 1.8%
AI software494 · 1.8%
Real estate479 · 1.7%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz55,90839,0033.8
.top13,98816,8073.9
.asia10,5655420.5
.shop9,8489,6311.3
.org8,9467,2321.3
.online8,7236,5222.6
.site5,9804,9671.3
.store5,2785,0731.1
.app4,6181,7203.5
.info4,5116,0051.3
.vip2,9952,2672.7
.biz2,5486982.0
.click1,9611,2648.2
.lol1,7811,08219.1
.pro1,6722,3171.8
.cfd1,6049158.7
.space1,4931,0222.0
.sbs1,4781,6278.1
.dev1,4484992.8
.live1,3801,2668.0
.icu1,3561,16714.7
.cyou1,2711,0324.7
.tech1,1465643.5
.garden1,06320.0
.fun1,03583514.5

Top 25 of 508 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-05.

Who is parking them

Dan1,696
Sedo140
Atom123
Sav94
NameBright47
Domeneshop19
Epik7
Efty1
Voodoo1
Afternic1

What the live sites are built with

WordPress2,550
Vercel1,825
Shopify233
Wix128
Next.js82
Squarespace72
Webflow14
Joomla12
Drupal10
GitHub Pages9

Writing system of the live sites

latin23,928
han1,904
cyrillic992
thai422
arabic272
hangul217
bengali110
hiragana40

How old the departed names were

1–2 years262
2–5 years5
6–30 days32
1–3 months2
over 5 years1
3–12 months2
0–5 days (add-grace return)1
~1 year (first renewal lapse)63

Risk signals

Every one of the 351,372 births was scored on its name, its nameservers and registrar, and the page it served. 10,902 scored at all; 40 critical, 901 high, 1,628 medium, 8,333 low. The top 300 were screenshotted and shown to a model, which called 125 of them phishing, scam or abuse and 80 benign.

TLDs with the most flagged births per 1,000

.lol19.1 · 36 of 1,781
.network18.9 · 2 of 106
.cam17.1 · 8 of 468
.win15.4 · 5 of 259
.icu14.7 · 20 of 1,356
.fun14.5 · 17 of 1,035
.help12 · 5 of 416
.surf11.1 · 2 of 180
.fyi9.4 · 2 of 213
.xin9.3 · 1 of 107

Signals that fired most

TLD with a high abuse rate1,259
brand in page title, not in the name1,205
brand name at a retail registrar934
brand in the name792
form on a brand-styled page577
punycode name309
brand name at a watch-list registrar301
brand name behind Cloudflare248
lure words (login, verify, secure…)190
one-letter brand typo145
identical page on many newborns128
page impersonates a brand111

Brands most often echoed in new names

cashapp123
icloud58
gmail49
robinhood44
vanguard35
intuit34
tiktok31
tmobile30
whatsapp30
amazon26
binance26
stripe25

Registrars of flagged names

Dynadot Inc268
NameCheap, Inc.263
GoDaddy.com, LLC170
GMO Internet Group, Inc. d/b/a Onamae.com167
HOSTINGER operations, UAB161
NameSilo, LLC139
Spaceship, Inc.109
Name.com, Inc.106
Cloudflare, Inc.96
NICENIC INTERNATIONAL GROUP CO., LIMITED62

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalbinancenews.topscore 89echoes binance· active website
brand in the name “binance”TLD with a high abuse rate “top”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”+2 more

Model opinion: looks like phishing (target: Binance), confidence 68%. An opinion, not a finding.

Criticalvanguardfrmc.winscore 85echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”+2 more

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Criticalebayfeecalculator.wikiscore 83echoes ebay· active website
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+2 more

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalomaslot4now-mobile.xyzscore 82echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “omaslot4now-mobile”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+3 more

Model opinion: looks like abuse, confidence 86%. An opinion, not a finding.

Criticalbinancenews.vipscore 81echoes binance· active website
brand in the name “binance”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”page impersonates a brand “Binance”+1 more

Model opinion: looks like phishing (target: Binance), confidence 68%. An opinion, not a finding.

Criticalnetflixandchill.vipscore 81echoes netflix· active website
brand in the name “netflix”brand name at a retail registrar “Porkbun”brand name at a watch-list registrar “Porkbun”page impersonates a brand “Netflix”+1 more

Model opinion: looks like a scam (target: Netflix), confidence 82%. An opinion, not a finding.

Criticaljapan-3x-tikktok.sbsscore 78echoes tiktok· active website
one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-3x-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.

Criticaljapan-6-tikktok.sbsscore 78echoes tiktok· active website
one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-6-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse (target: TikTok), confidence 92%. An opinion, not a finding.

Criticalsillage-finance.clickscore 74echoes binance· active website
one-letter brand typo “finance≈binance”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+2 more

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalvanguardwastehub.cyouscore 73echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalrobloxscripts.lolscore 72echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “lol”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalingresseroblox.sitescore 71echoes roblox· active website
brand in the name “roblox”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “roblox”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Ingresse (Brazilian ticketing platform) / Roblox), confidence 90%. An opinion, not a finding.

Criticalstarlinkrastreio.appscore 71echoes starlink· active website
brand in the name “starlink”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “starlink”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Starlink (SpaceX)), confidence 93%. An opinion, not a finding.

Criticalwhatsappreceptionist.onlinescore 71echoes whatsapp· active website
brand in the name “whatsapp”brand name at a retail registrar “Dominet (HK) Limited”brand name and brand-styled page “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Critical365outlook.emailscore 70echoes outlook· active website
brand in the name “outlook”brand plus digits “365outlook”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloud DNS Ltd”+1 more

Model opinion: looks like phishing (target: Microsoft), confidence 91%. An opinion, not a finding.

See all 941 high and critical rows for 2026-09-05

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.