Daily zone census

217,572 domains were born on Thursday, September 10, 2026

217,572
domains appeared
128,312
domains left the zone
12.2%
had a live website by day's end
906
flagged high or critical

On Thursday, September 10, 2026 the census compared 1,053 zone files holding 76,308,449 domains against the day before. 217,572 names were new (0.285% of the universe), 128,312 were gone, net +89,260. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 26

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website26,464 12.2%
  • Parked or for sale2,696 1.2%
  • Registered, no site yet26,522 12.2%
  • Nothing there at all51,064 23.5%
  • Couldn't tell110,826 50.9%

What the 26,464 live sites are about

Unclassified8,510 · 32.2%
E-commerce & retail2,682 · 10.1%
Gambling & casino2,608 · 9.9%
Hosting & domains1,719 · 6.5%
SaaS & tech1,492 · 5.6%
Blogs & personal847 · 3.2%
Construction Trades696 · 2.6%
AI software676 · 2.6%
Gaming628 · 2.4%
Corporate services579 · 2.2%
Streaming Piracy565 · 2.1%
Real estate553 · 2.1%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz57,11222,0221.3
.top17,33610,3331.7
.app13,0343,4587.7
.shop11,83911,9720.8
.online10,6586,4023.3
.org9,9337,8422.8
.site8,1474,4783.1
.cam7,3412150.3
.cfd6,0873,3041.1
.store5,7244,9093.3
.info5,4398,2853.5
.work3,4872330.9
.pro2,8822,8602.8
.click2,8741,2909.4
.dev2,8518433.5
.vip2,8054,4702.1
.best2,645351.1
.win2,506991.2
.space2,0939861.0
.fun1,87492610.7
.live1,8501,2028.6
.lol1,77682314.1
.icu1,6131,17510.5
.website1,5254791.3
.onl1,497470.0

Top 25 of 513 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-10.

Who is parking them

Dan1,119
Atom236
Sav107
Sedo63
NameBright62
Domeneshop33
Epik15
Efty1
Voodoo1

What the live sites are built with

Vercel2,848
WordPress2,540
Shopify278
Squarespace115
Wix99
Next.js94
Webflow19
GitHub Pages14
Joomla13
Drupal12

Writing system of the live sites

latin22,961
han1,508
cyrillic1,123
arabic326
hangul212
thai136
hiragana52
hebrew50

How old the departed names were

1–2 years340
2–5 years14
6–30 days10
1–3 months6
over 5 years12
3–12 months14
0–5 days (add-grace return)8
~1 year (first renewal lapse)70

Risk signals

Every one of the 405,089 births was scored on its name, its nameservers and registrar, and the page it served. 10,809 scored at all; 31 critical, 875 high, 1,625 medium, 8,278 low. The top 300 were screenshotted and shown to a model, which called 139 of them phishing, scam or abuse and 107 benign.

TLDs with the most flagged births per 1,000

.lol14.1 · 25 of 1,776
.blog12.7 · 9 of 551
.run11.6 · 2 of 173
.fit11.2 · 3 of 267
.fun10.7 · 21 of 1,874
.plus10.7 · 2 of 187
.icu10.5 · 17 of 1,613
.help9.6 · 5 of 519
.click9.4 · 28 of 2,874
.link9.4 · 3 of 319

Signals that fired most

brand in page title, not in the name1,268
TLD with a high abuse rate909
brand name at a retail registrar750
brand in the name719
form on a brand-styled page607
brand name at a watch-list registrar311
brand name behind Cloudflare308
punycode name224
one-letter brand typo189
page impersonates a brand180
lure words (login, verify, secure…)162
identical page on many newborns147

Brands most often echoed in new names

icloud83
binance41
tmobile41
whatsapp38
vanguard37
amazon32
tiktok32
google29
spotify28
gmail27
chatgpt26
ebay23

Registrars of flagged names

NameCheap, Inc.254
Dynadot Inc182
HOSTINGER operations, UAB177
NameSilo, LLC140
Spaceship, Inc.130
GoDaddy.com, LLC119
Name.com, Inc.93
Cloudflare, Inc.90
Porkbun LLC38
GMO Internet Group, Inc. d/b/a Onamae.com36

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalquickbookservices.onlinescore 94echoes quickbooks· active website
brand in the name “quickbooks”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: looks like a scam, confidence 76%. An opinion, not a finding.

Criticalpaypal-pay.comscore 93echoes paypal· active website
brand in the name “paypal”lure words (login, verify, secure…) “pay”page impersonates a brand “PayPal”brand name and brand-styled page “paypal”

Model opinion: looks like phishing (target: PayPal), confidence 96%. An opinion, not a finding.

Criticalbinancetown.techscore 91echoes binance· active website
brand in the name “binance”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “BINANCE”brand name and brand-styled page “binance”+1 more

Model opinion: looks like a scam (target: Binance), confidence 82%. An opinion, not a finding.

Criticalinvite-pay-pal.netscore 84echoes paypal· active website
brand in the name “paypal”lure words (login, verify, secure…) “pay”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “PayPal”

Model opinion: looks like phishing (target: PayPal), confidence 98%. An opinion, not a finding.

Criticalsavagedungeonvanguard.funscore 77echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”+1 more

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Criticaltelegramai.xyzscore 77echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “telegram”+1 more

Model opinion: looks like a scam (target: Telegram), confidence 86%. An opinion, not a finding.

Criticalsmallstonks.xyzscore 74· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”brand in page title, not in the name “coinbase”form on a brand-styled page “has_form”+1 more

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalancientraidvanguard.storescore 69echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalchatgptimages.chatscore 69echoes chatgpt· active website
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticaltiktok-18plus.xyzscore 67echoes tiktok· active website
brand in the name “tiktok”brand plus digits “tiktok-18plus”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse (target: TikTok), confidence 72%. An opinion, not a finding.

Criticalsnsmarketing.shopscore 66· active website
page asks for credentials “log in to your account”page impersonates a brand “PayPal”login form “has_form+login words”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalbritain-1-tikktok.sbsscore 64echoes tiktok· active website
one-letter brand typo “tikktok≈tiktok”brand plus digits “britain-1-tikktok”TLD with a high abuse rate “sbs”brand in page title, not in the name “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 92%. An opinion, not a finding.

Criticalchatgptrukou.sbsscore 64echoes chatgpt· active website
brand in the name “chatgpt”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “openai”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalamazonfindsdaily.blogscore 63echoes amazon· active website
brand in the name “amazon”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalvolatilityvanguard.appscore 63echoes vanguard· active website
brand in the name “vanguard”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 58%. An opinion, not a finding.

See all 907 high and critical rows for 2026-09-10

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.