Daily zone census

279,022 domains were born on Wednesday, September 16, 2026

279,022
domains appeared
126,131
domains left the zone
9.9%
had a live website by day's end
1,975
flagged high or critical

On Wednesday, September 16, 2026 the census compared 1,060 zone files holding 76,860,100 domains against the day before. 279,022 names were new (0.363% of the universe), 126,131 were gone, net +152,891. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Oct 2

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website27,714 9.9%
  • Parked or for sale3,842 1.4%
  • Registered, no site yet26,694 9.6%
  • Nothing there at all77,531 27.8%
  • Couldn't tell143,241 51.3%

What the 27,714 live sites are about

Unclassified8,582 · 31.0%
E-commerce & retail4,369 · 15.8%
Hosting & domains2,780 · 10.0%
Gambling & casino2,213 · 8.0%
SaaS & tech1,239 · 4.5%
Blogs & personal699 · 2.5%
Gaming642 · 2.3%
AI software594 · 2.1%
Construction Trades521 · 1.9%
Crypto Web3520 · 1.9%
Corporate services500 · 1.8%
Education494 · 1.8%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz104,8597,8262.3
.cfd24,0771,5470.3
.online17,77012,9952.2
.lol17,6931,3921.0
.top16,98823,1332.6
.shop14,75914,58168.0
.org11,9779,4403.0
.app7,9732,7752.5
.info7,7756,4926.7
.store6,5486,1994.1
.click2,9111,7693.4
.dev2,5238831.2
.sbs2,3932,0877.1
.cyou2,0461,0691.5
.pro1,9203,2702.6
.space1,8939092.6
.live1,7131,4025.3
.club1,6956491.8
.tech1,4356084.9
.icu1,4081,4487.1
.fun1,36497913.9
.cloud1,2851,2863.9
.digital1,1714215.1
.asia1,1066950.9
.blog1,0057163.0

Top 25 of 463 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-16.

Who is parking them

Dan1,830
Atom329
Sedo166
Sav95
NameBright54
Afternic43
Domeneshop33
Epik5
Efty1

What the live sites are built with

WordPress2,583
Vercel2,369
Shopify472
Wix115
Next.js95
Squarespace83
Webflow17
GitHub Pages10
Joomla7
Drupal6

Writing system of the live sites

latin24,073
cyrillic1,548
han993
thai354
arabic288
hangul284
hiragana47
hebrew37

How old the departed names were

1–2 years872
2–5 years108
6–30 days93
1–3 months12
over 5 years36
3–12 months135
0–5 days (add-grace return)36
~1 year (first renewal lapse)164

Risk signals

Every one of the 461,587 births was scored on its name, its nameservers and registrar, and the page it served. 15,116 scored at all; 1,029 critical, 946 high, 2,243 medium, 10,898 low. The top 300 were screenshotted and shown to a model, which called 245 of them phishing, scam or abuse and 14 benign.

TLDs with the most flagged births per 1,000

.shop68 · 1,997 of 14,759
.help23.9 · 13 of 545
.fun13.9 · 20 of 1,364
.skin10.1 · 2 of 198
.media9 · 1 of 111
.baby8.8 · 1 of 114
.bond8.6 · 3 of 348
.stream8.5 · 1 of 118
.sbs7.1 · 18 of 2,393
.icu7.1 · 11 of 1,408

Signals that fired most

brand in page title, not in the name2,546
form on a brand-styled page1,640
TLD with a high abuse rate1,380
page impersonates a brand1,078
brand name at a retail registrar1,058
brand in the name945
punycode name389
brand name at a watch-list registrar329
identical page on many newborns317
brand name behind Cloudflare239
lure words (login, verify, secure…)188
one-letter brand typo161

Brands most often echoed in new names

cashapp157
whatsapp89
icloud80
gmail42
tiktok38
tmobile38
stripe37
google30
binance30
telegram30
vanguard27
revolut26

Registrars of flagged names

HOSTINGER operations, UAB307
NameCheap, Inc.302
GMO Internet Group, Inc. d/b/a Onamae.com242
Spaceship, Inc.211
Dynadot Inc152
GoDaddy.com, LLC144
NameSilo, LLC131
Name.com, Inc.107
Porkbun LLC102
Cloudflare, Inc.78

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalmailicloud.topscore 91echoes icloud· active website
brand in the name “icloud”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Namecheap Inc.”+3 more

Model opinion: looks like abuse, confidence 84%. An opinion, not a finding.

Criticalshopifyradar.devscore 83echoes shopify· active website
brand in the name “shopify”brand name behind Cloudflare “cloudflare.com”page pushes urgent payment “risk-free”brand name and brand-styled page “shopify”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticaltelegramifsaarsivi.lolscore 73echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalnepchat.appscore 72· active website
page asks for credentials “Verify your identity”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalbolivia-1-1-tikktok.sbsscore 70echoes tiktok· active website
one-letter brand typo “tikktok≈tiktok”many hyphens “3”brand plus digits “bolivia-1-1-tikktok”TLD with a high abuse rate “sbs”+1 more

Model opinion: looks like abuse (target: TikTok), confidence 92%. An opinion, not a finding.

Criticalintuitive.softwarescore 70echoes intuit· active website
brand in the name “intuit”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticaltrustwallets.storescore 70echoes trustwallet· active website
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”

Model opinion: looks like phishing (target: Trust Wallet), confidence 90%. An opinion, not a finding.

Criticalorangeoutlook.orgscore 69echoes outlook· active website
brand in the name “outlook”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “outlook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 97%. An opinion, not a finding.

Criticalvayicloud.appscore 69echoes icloud· active website
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “icloud”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalfreemovies.buzzscore 68· active website
TLD with a high abuse rate “buzz”page impersonates a brand “NetFlix”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 95%. An opinion, not a finding.

Criticalb2blinkedin.marketingscore 67echoes linkedin· active website
brand in the name “linkedin”brand plus digits “b2blinkedin”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalmediafused.storescore 66· active website
page asks for credentials “log in to your account”page impersonates a brand “PayPal”login form “has_form+login words”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalwestpaw.livescore 66echoes westpac· active website
one-letter brand typo “westpaw≈westpac”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more

Model opinion: suspicious (target: West Paw), confidence 56%. An opinion, not a finding.

Criticalmetamaskwallet.icuscore 64echoes metamask· active website
brand in the name “metamask”lure words (login, verify, secure…) “wallet”TLD with a high abuse rate “icu”

Model opinion: looks like abuse (target: MetaMask), confidence 82%. An opinion, not a finding.

Criticalrobinhoodape.funscore 64echoes robinhood· active website
brand in the name “robinhood”TLD with a high abuse rate “fun”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

See all 1,975 high and critical rows for 2026-09-16

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.