Daily zone census

190,562 domains were born on Saturday, September 12, 2026

190,562
domains appeared
97,517
domains left the zone
11.5%
had a live website by day's end
505
flagged high or critical

On Saturday, September 12, 2026 the census compared 1,055 zone files holding 76,523,924 domains against the day before. 190,562 names were new (0.249% of the universe), 97,517 were gone, net +93,045. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 28

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website21,839 11.5%
  • Parked or for sale3,243 1.7%
  • Registered, no site yet22,347 11.7%
  • Nothing there at all36,207 19.0%
  • Couldn't tell106,926 56.1%

What the 21,839 live sites are about

Unclassified6,738 · 30.9%
Hosting & domains3,358 · 15.4%
E-commerce & retail2,296 · 10.5%
Gambling & casino2,031 · 9.3%
SaaS & tech695 · 3.2%
Blogs & personal646 · 3.0%
Construction Trades519 · 2.4%
Gaming467 · 2.1%
Streaming Piracy409 · 1.9%
Crypto Web3406 · 1.9%
Corporate services403 · 1.8%
AI software388 · 1.8%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz57,5054,7550.8
.top31,6179,2690.7
.shop11,40712,3861.4
.online9,17911,0132.0
.org9,1187,5221.3
.site5,6574,9391.6
.store5,0994,9932.0
.info4,8846,2521.2
.click3,1091,1394.8
.vip2,9322,7321.0
.cam2,9171311.7
.cyou1,8421,8221.6
.lol1,7691,13311.9
.pro1,6981,7812.4
.sbs1,6872,1104.7
.cfd1,6431,2383.7
.dev1,5885811.3
.live1,4478792.1
.cloud1,4336034.2
.space1,4042,0572.8
.icu1,3511,4344.4
.world1,1255482.7
.fun1,12486910.7
.club1,1154871.8
.tech1,1035803.6

Top 25 of 506 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-12.

Who is parking them

Dan967
Atom254
Sedo98
Sav71
NameBright34
Domeneshop28
Epik26
Efty1

What the live sites are built with

WordPress2,303
Vercel1,663
Shopify223
Wix101
Next.js85
Squarespace81
Webflow17
Joomla13
Drupal10
GitHub Pages7

Writing system of the live sites

latin18,610
cyrillic1,336
han1,195
arabic268
thai189
hangul104
hiragana42
bengali30

How old the departed names were

1–2 years284
2–5 years31
6–30 days49
1–3 months6
over 5 years4
3–12 months21
0–5 days (add-grace return)5
~1 year (first renewal lapse)131

Risk signals

Every one of the 352,522 births was scored on its name, its nameservers and registrar, and the page it served. 9,643 scored at all; 16 critical, 489 high, 1,923 medium, 7,215 low. The top 300 were screenshotted and shown to a model, which called 128 of them phishing, scam or abuse and 136 benign.

TLDs with the most flagged births per 1,000

.ink108 · 54 of 500
.monster20 · 3 of 150
.homes14.4 · 5 of 348
.lol11.9 · 21 of 1,769
.work11.4 · 4 of 350
.autos11.4 · 3 of 263
.fun10.7 · 12 of 1,124
.link10.3 · 4 of 290
.wtf10 · 1 of 100
.health7.6 · 1 of 131

Signals that fired most

brand in page title, not in the name990
TLD with a high abuse rate856
brand in the name685
form on a brand-styled page425
brand name behind Cloudflare266
nameserver domain born the same day237
one-letter brand typo229
brand name at a retail registrar226
punycode name224
identical page on many newborns174
brand plus digits156
lure words (login, verify, secure…)134

Brands most often echoed in new names

americanexpress90
tiktok76
icloud74
whatsapp72
google56
amazon33
binance25
tmobile23
shopify22
gmail18
stripe18
vanguard18

Registrars of flagged names

NameCheap, Inc.104
Dominet (HK) Limited59
GoDaddy.com, LLC48
Spaceship, Inc.41
HOSTINGER operations, UAB39
Name.com, Inc.36
Dynadot Inc35
Cloudflare, Inc.29
NameSilo, LLC21
Global Domain Group LLC16

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalvanguardforpeace.orgscore 75echoes vanguard· active website
brand in the name “vanguard”brand name on a rarely-seen nameserver “verpex.com”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”+1 more

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalboostx.socialscore 68· active website
page asks for credentials “sign in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalrobinhoodfly.sitescore 67echoes robinhood· active website
brand in the name “robinhood”page impersonates a brand “MetaMask”brand name and brand-styled page “robinhood”

Model opinion: looks like a scam, confidence 68%. An opinion, not a finding.

Criticalparcelwhere.comscore 66· active website
lure words (login, verify, secure…) “parcel”page impersonates a brand “USPS”brand in page title, not in the name “usps”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Criticalcanwechat.devscore 64echoes wechat· active website
brand in the name “wechat”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CloudFlare, Inc.”brand in page title, not in the name “telegram”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalamazonepublishings.comscore 63echoes amazon· active website
brand in the name “amazon”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Amazon), confidence 72%. An opinion, not a finding.

Criticalaramexcargo.comscore 63echoes aramex· active website
brand in the name “aramex”brand name and brand-styled page “aramex”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Aramex), confidence 62%. An opinion, not a finding.

Criticaloutgrewquickbooks.onlinescore 63echoes quickbooks· active website
brand in the name “quickbooks”brand name and brand-styled page “quickbooks”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalquickbookservices.shopscore 62echoes quickbooks· active website
brand in the name “quickbooks”lure words (login, verify, secure…) “service,services”

Model opinion: looks benign, confidence 68%. An opinion, not a finding.

Criticalblockaimailmanager.worldscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Microsoft), confidence 62%. An opinion, not a finding.

Criticalhttps-forms-cloud-microsoft-pages-responsepage-a.linkscore 60echoes microsoft· active website
brand in the name “microsoft”many hyphens “6”very long name “48”random-looking name “H=3.84”+1 more

Model opinion: looks like phishing (target: Microsoft), confidence 78%. An opinion, not a finding.

Criticalmailotp.orgscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “outlook”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 87%. An opinion, not a finding.

Criticalmoodyfashion.storescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Moody Fashion (moodyfashion.ch)), confidence 58%. An opinion, not a finding.

Criticalpoulcheck.xyzscore 60· active website
TLD with a high abuse rate “xyz”page pushes urgent payment “act now”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Criticalraseed-x13.cloudscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

See all 505 high and critical rows for 2026-09-12

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.