Daily zone census

203,902 domains were born on Friday, September 11, 2026

203,902
domains appeared
116,881
domains left the zone
11.1%
had a live website by day's end
898
flagged high or critical

On Friday, September 11, 2026 the census compared 1,055 zone files holding 76,430,879 domains against the day before. 203,902 names were new (0.267% of the universe), 116,881 were gone, net +87,021. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 27

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website22,711 11.1%
  • Parked or for sale3,486 1.7%
  • Registered, no site yet25,259 12.4%
  • Nothing there at all38,950 19.1%
  • Couldn't tell113,496 55.7%

What the 22,711 live sites are about

Unclassified7,318 · 32.2%
E-commerce & retail2,804 · 12.3%
Gambling & casino2,178 · 9.6%
Hosting & domains1,533 · 6.8%
SaaS & tech854 · 3.8%
Blogs & personal836 · 3.7%
Streaming Piracy610 · 2.7%
Construction Trades541 · 2.4%
Gaming490 · 2.2%
Real estate490 · 2.2%
Crypto Web3478 · 2.1%
Corporate services432 · 1.9%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz74,77318,3471.4
.top11,32313,2882.6
.online9,9326,2263.1
.org9,7896,8572.5
.shop9,13412,5971.0
.cfd6,7931,0003.2
.site6,3124,4954.3
.cam5,4571961.8
.store5,3914,9024.8
.vip5,20210,2710.6
.app4,8551,0852.7
.info4,8528,4111.9
.pro2,7392,1641.1
.click2,5121,4686.8
.fun2,0838316.2
.lol2,03464335.4
.website1,7034500.0
.cloud1,6896743.6
.space1,6811,0662.4
.live1,6141,0322.5
.icu1,4321,90614.0
.sbs1,3802,2645.8
.tech1,1184871.8
.club1,1175590.0
.dev1,0583952.8

Top 25 of 506 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-11.

Who is parking them

Dan860
Atom195
Sav85
Sedo67
NameBright35
Domeneshop23
Epik9
Afternic1
Fabulous1
ParkingCrew1

What the live sites are built with

WordPress2,778
Vercel1,909
Shopify288
Squarespace82
Wix78
Next.js73
Drupal15
Webflow15
Joomla14
GitHub Pages11

Writing system of the live sites

latin19,275
han1,452
cyrillic1,251
arabic254
thai183
hangul135
hiragana48
bengali37

How old the departed names were

1–2 years171
2–5 years6
6–30 days115
over 5 years3
3–12 months3
0–5 days (add-grace return)2
~1 year (first renewal lapse)33

Risk signals

Every one of the 381,050 births was scored on its name, its nameservers and registrar, and the page it served. 10,814 scored at all; 33 critical, 865 high, 1,888 medium, 8,028 low. The top 300 were screenshotted and shown to a model, which called 169 of them phishing, scam or abuse and 90 benign.

TLDs with the most flagged births per 1,000

.ink118.2 · 61 of 516
.lol35.4 · 72 of 2,034
.win19.6 · 14 of 716
.homes14.5 · 7 of 483
.icu14 · 20 of 1,432
.global12 · 2 of 166
.today11.6 · 3 of 172
.help10 · 4 of 400
.chat8.9 · 1 of 112
.wtf8.3 · 1 of 121

Signals that fired most

TLD with a high abuse rate1,151
brand in page title, not in the name1,149
brand name at a retail registrar834
brand in the name760
form on a brand-styled page523
punycode name306
brand name behind Cloudflare292
nameserver domain born the same day257
brand name at a watch-list registrar254
one-letter brand typo233
brand plus digits199
lure words (login, verify, secure…)155

Brands most often echoed in new names

whatsapp65
americanexpress61
google60
icloud60
telegram40
gmail33
tiktok31
tmobile31
revolut30
shopify25
binance24
ebay23

Registrars of flagged names

NameSilo, LLC292
NameCheap, Inc.263
Dynadot Inc187
GoDaddy.com, LLC171
HOSTINGER operations, UAB169
Spaceship, Inc.124
GMO Internet Group, Inc. d/b/a Onamae.com90
Cloudflare, Inc.75
Dominet (HK) Limited74
Name.com, Inc.73

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalquikcancelsub.infoscore 90· active website
page asks for credentials “Log in to your account”page impersonates a brand “Amazon Prime”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 91%. An opinion, not a finding.

Criticalapple-support.todayscore 89echoes apple· active website
brand in the name “apple”lure words (login, verify, secure…) “support”brand name and brand-styled page “apple”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Apple), confidence 72%. An opinion, not a finding.

Criticalnetflix-casino-uk.orgscore 87echoes netflix· active website
brand in the name “netflix”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Netflix”page pushes urgent payment “Claim Your Bonus”+1 more

Model opinion: looks like abuse (target: Netflix), confidence 88%. An opinion, not a finding.

Criticaltelegramgroups.infoscore 85echoes telegram· active website
brand in the name “telegram”page impersonates a brand “binance”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalintesa365erix.digitalscore 77echoes intesa· active website
brand in the name “intesa”brand plus digits “intesa365erix”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “intesa”+1 more

Model opinion: looks like a scam, confidence 86%. An opinion, not a finding.

Criticalshopifydevelopmentservices.orgscore 77echoes shopify· active website
brand in the name “shopify”lure words (login, verify, secure…) “service,services”brand name and brand-styled page “shopify”

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticaltiktokstory.appscore 77echoes tiktok· active website
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CloudFlare, Inc.”brand name and brand-styled page “tiktok”+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticallinkedinutilities.comscore 71echoes linkedin· active website
brand in the name “linkedin”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “linkedin”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticaltelegramultra.topscore 71echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “top”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Telegram), confidence 62%. An opinion, not a finding.

Criticalspotify88.sbsscore 70echoes spotify· active website
brand in the name “spotify”brand plus digits “spotify88”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalgooglefinanceaitech.digitalscore 69echoes google· active website
brand in the name “google”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “google”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Google), confidence 86%. An opinion, not a finding.

Criticalintesazomixsoft.digitalscore 69echoes intesa· active website
brand in the name “intesa”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “intesa”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 86%. An opinion, not a finding.

Criticalbarclaysfst.comscore 68echoes barclays· active website
brand in the name “barclays”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+1 more

Model opinion: looks like a scam (target: Barclays), confidence 89%. An opinion, not a finding.

Criticalprincenetflix.storescore 67echoes netflix· active website
brand in the name “netflix”page impersonates a brand “Netflix”brand name and brand-styled page “netflix”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalbotbooster.bizscore 66· active website
page asks for credentials “log in to your account”page impersonates a brand “PayPal”login form “has_form+login words”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

See all 899 high and critical rows for 2026-09-11

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.