Daily zone census

117,711 domains were born on Tuesday, September 15, 2026

117,711
domains appeared
109,695
domains left the zone
18.6%
had a live website by day's end
690
flagged high or critical

On Tuesday, September 15, 2026 the census compared 1,060 zone files holding 76,707,209 domains against the day before. 117,711 names were new (0.153% of the universe), 109,695 were gone, net +8,016. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Oct 1

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website21,851 18.6%
  • Parked or for sale1,565 1.3%
  • Registered, no site yet25,019 21.3%
  • Nothing there at all33,990 28.9%
  • Couldn't tell35,286 30.0%

What the 21,851 live sites are about

Unclassified7,075 · 32.4%
E-commerce & retail2,489 · 11.4%
Hosting & domains2,421 · 11.1%
Gambling & casino1,647 · 7.5%
SaaS & tech790 · 3.6%
Blogs & personal757 · 3.5%
Gaming586 · 2.7%
Construction Trades472 · 2.2%
Corporate services468 · 2.1%
AI software432 · 2.0%
Streaming Piracy411 · 1.9%
Real estate404 · 1.8%

Where the new names landed

TLDBornGoneFlagged /1k
.shop10,9447,2741.0
.online9,8576,1302.5
.org9,4727,2461.6
.top8,32229,2303.2
.cfd6,5571,3453.5
.site5,9072,5193.6
.info5,87312,7322.7
.store5,7024,1072.6
.click3,4941,36811.4
.vip3,4863,2501.7
.app3,3309864.2
.digital2,4354600.8
.pro2,2582,4032.2
.live1,7398354.6
.sbs1,6581,43021.1
.space1,5777082.5
.cloud1,5636334.5
.icu1,4951,9238.0
.dev1,3014491.5
.lol1,2911,0816.2
.club1,2216544.9
.fun1,21166916.5
.tech1,1974824.2
.world1,1055290.0
.asia8766390.0

Top 25 of 527 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-15.

Who is parking them

Dan655
Atom66
NameBright62
Sav59
Sedo46
Domeneshop24
Epik4

What the live sites are built with

WordPress2,433
Vercel1,642
Shopify299
Wix103
Next.js82
Squarespace81
Webflow11
GitHub Pages11
Drupal8
Joomla6

Writing system of the live sites

latin18,965
han1,213
cyrillic922
arabic278
hangul185
thai148
hiragana40
hebrew32

How old the departed names were

1–2 years210
2–5 years37
6–30 days4
1–3 months3
over 5 years11
3–12 months32
0–5 days (add-grace return)4
~1 year (first renewal lapse)82

Risk signals

Every one of the 290,883 births was scored on its name, its nameservers and registrar, and the page it served. 8,344 scored at all; 30 critical, 660 high, 1,383 medium, 6,271 low. The top 300 were screenshotted and shown to a model, which called 132 of them phishing, scam or abuse and 112 benign.

TLDs with the most flagged births per 1,000

.ltd32.1 · 6 of 187
.sbs21.1 · 39 of 1,658
.rest17 · 3 of 176
.help16.9 · 7 of 413
.fun16.5 · 21 of 1,211
.click11.4 · 41 of 3,494
.cam11 · 5 of 455
.quest9 · 3 of 223
.ink8.2 · 4 of 366
.icu8 · 13 of 1,495

Signals that fired most

brand in page title, not in the name999
TLD with a high abuse rate664
brand name at a retail registrar650
brand in the name595
form on a brand-styled page532
brand name behind Cloudflare244
brand name at a watch-list registrar219
one-letter brand typo173
punycode name170
identical page on many newborns150
lure words (login, verify, secure…)133
nameserver domain born the same day84

Brands most often echoed in new names

whatsapp88
icloud53
binance42
google34
tmobile26
tiktok24
vanguard23
ebay21
gmail21
shopify19
robinhood19
amazon16

Registrars of flagged names

NameCheap, Inc.225
HOSTINGER operations, UAB167
Spaceship, Inc.157
NameSilo, LLC99
GoDaddy.com, LLC97
Dynadot Inc85
Name.com, Inc.81
Cloudflare, Inc.73
Porkbun LLC49
PDR Ltd. d/b/a PublicDomainRegistry.com37

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticaltikto-18plus.clickscore 88echoes tiktok· active website
one-letter brand typo “tikto≈tiktok”brand plus digits “tikto-18plus”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticalbolivia-2-tikktok.sbsscore 78echoes tiktok· active website
one-letter brand typo “tikktok≈tiktok”brand plus digits “bolivia-2-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse (target: TikTok), confidence 90%. An opinion, not a finding.

Criticallinkedin7.orgscore 77echoes linkedin· active website
brand in the name “linkedin”brand plus digits “linkedin7”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “linkedin”+1 more

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalopenaiplus.onlinescore 76echoes openai· active website
brand in the name “openai”free DNS provider “dnsowl.com”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: OpenAI), confidence 62%. An opinion, not a finding.

Criticalbinancetown.funscore 75echoes binance· active website
brand in the name “binance”TLD with a high abuse rate “fun”page impersonates a brand “Binance”brand name and brand-styled page “binance”

Model opinion: suspicious (target: Binance), confidence 60%. An opinion, not a finding.

Criticalauth-live-doc-ms0365-sharepoint.sitescore 74echoes sharepoint· active website
brand in the name “sharepoint”lure words (login, verify, secure…) “auth”many hyphens “4”very long name “31”+1 more

Model opinion: looks like phishing (target: Microsoft), confidence 94%. An opinion, not a finding.

Criticaltesla-ai-za.sbsscore 73echoes tesla· active website
ambiguous brand word “tesla”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Coinbase”+2 more

Model opinion: looks like a scam (target: Tesla), confidence 93%. An opinion, not a finding.

Criticallinkedlin.orgscore 72echoes linkedin· active website
one-letter brand typo “linkedlin≈linkedin”brand name on a rarely-seen nameserver “monsterdns.net”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: LinkedIn), confidence 92%. An opinion, not a finding.

Criticalmy-telegram.cyouscore 70echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “cyou”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more

Model opinion: looks like abuse (target: Telegram), confidence 60%. An opinion, not a finding.

Criticalpixellegendsvanguard.inkscore 69echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalconstructionos.bizscore 68echoes ionos· active website
brand in the name “ionos”brand in page title, not in the name “chase”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Criticalthegioimmo.icuscore 68· active website
TLD with a high abuse rate “icu”page impersonates a brand “NETFLIX”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalthexpf.cyouscore 68· active website
TLD with a high abuse rate “cyou”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: suspicious (target: Microsoft), confidence 60%. An opinion, not a finding.

Criticalvyoraboost.onlinescore 68· active website
page asks for credentials “log in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticaljapan-51-tikktok.sbsscore 64echoes tiktok· active website
one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-51-tikktok”TLD with a high abuse rate “sbs”brand in page title, not in the name “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.

See all 690 high and critical rows for 2026-09-15

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.