Daily zone census

240,681 domains were born on Thursday, September 17, 2026

240,681
domains appeared
129,276
domains left the zone
10.1%
had a live website by day's end
961
flagged high or critical

On Thursday, September 17, 2026 the census compared 1,061 zone files holding 76,972,558 domains against the day before. 240,681 names were new (0.313% of the universe), 129,276 were gone, net +111,405. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Oct 3

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website24,250 10.1%
  • Parked or for sale4,065 1.7%
  • Registered, no site yet24,823 10.3%
  • Nothing there at all56,604 23.5%
  • Couldn't tell130,939 54.4%

What the 24,250 live sites are about

Unclassified7,874 · 32.5%
E-commerce & retail2,674 · 11.0%
Gambling & casino1,976 · 8.1%
Hosting & domains1,806 · 7.4%
Blogs & personal926 · 3.8%
Construction Trades898 · 3.7%
SaaS & tech859 · 3.5%
Crypto Web3618 · 2.5%
Adult538 · 2.2%
Gaming528 · 2.2%
AI software519 · 2.1%
Corporate services505 · 2.1%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz100,76911,9221.5
.cfd13,6501,5490.8
.lol13,6484950.7
.online13,2936,5922.7
.site11,9729,0913.1
.top10,82021,0792.4
.shop8,2837,5893.3
.org7,6405,6472.7
.vip6,4215,4230.6
.info4,9537,2052.8
.store4,3703,9112.5
.app3,5251,0665.1
.world2,6411,8121.5
.click1,8621,13910.2
.sbs1,8412,9233.3
.pro1,8182,3935.5
.icu1,4451,25613.8
.space1,3536782.2
.live1,2981,2709.2
.website1,2921,2850.8
.cloud1,2425083.2
.wiki1,1402076.1
.asia1,0938851.8
.fun1,01671012.8
.tech9495360.0

Top 25 of 511 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-17.

Who is parking them

Dan1,509
Sav539
Atom261
Sedo78
NameBright28
Afternic27
Domeneshop18
Epik6

What the live sites are built with

WordPress2,626
Vercel2,329
Shopify235
Wix89
Squarespace65
Next.js44
Joomla12
Webflow11
GitHub Pages7
Drupal5

Writing system of the live sites

latin20,616
cyrillic1,376
han1,288
arabic333
thai228
hangul168
katakana65
hiragana55

How old the departed names were

1–2 years761
2–5 years13
6–30 days13
1–3 months7
over 5 years11
3–12 months19
0–5 days (add-grace return)8
~1 year (first renewal lapse)75

Risk signals

Every one of the 417,296 births was scored on its name, its nameservers and registrar, and the page it served. 11,749 scored at all; 41 critical, 920 high, 1,711 medium, 9,077 low. The top 300 were screenshotted and shown to a model, which called 126 of them phishing, scam or abuse and 126 benign.

TLDs with the most flagged births per 1,000

.ink115.9 · 62 of 535
.help22.7 · 9 of 352
.cam14.1 · 6 of 426
.icu13.8 · 20 of 1,445
.agency13 · 2 of 154
.fun12.8 · 13 of 1,016
.fyi12 · 2 of 167
.yachts12 · 2 of 166
.work10.8 · 11 of 923
.digital10.4 · 5 of 479

Signals that fired most

brand in page title, not in the name1,251
TLD with a high abuse rate1,063
brand in the name803
brand name at a retail registrar792
form on a brand-styled page553
brand name behind Cloudflare351
punycode name271
brand name at a watch-list registrar255
one-letter brand typo178
identical page on many newborns156
brand plus digits154
lure words (login, verify, secure…)148

Brands most often echoed in new names

icloud75
whatsapp68
vanguard61
amex60
tiktok47
google45
telegram43
binance40
tmobile35
microsoft28
gmail27
amazon25

Registrars of flagged names

NameCheap, Inc.367
HOSTINGER operations, UAB187
GoDaddy.com, LLC179
Dynadot Inc143
Spaceship, Inc.135
Name.com, Inc.111
NameSilo, LLC105
Dominet (HK) Limited78
Cloudflare, Inc.65
NICENIC INTERNATIONAL GROUP CO., LIMITED65

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticaldocusigner.onlinescore 100echoes docusign· active website
brand in the name “docusign”page asks for credentials “Sign in to your account”brand name and brand-styled page “docusign”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalpay-line-me.xyzscore 88echoes lineme· active website
brand in the name “lineme”lure words (login, verify, secure…) “pay”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like phishing (target: LINE Pay), confidence 95%. An opinion, not a finding.

Criticaluzb-tikto.clickscore 88echoes tiktok· active website
one-letter brand typo “tikto≈tiktok”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Registrar.eu”+2 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticaldreamtape.xyzscore 76· active website
TLD with a high abuse rate “xyz”page asks for credentials “confirm your payment”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalplaystationstrengths.workscore 76echoes playstation· active website
brand in the name “playstation”TLD with a high abuse rate “work”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalinstagramcreators.xyzscore 71echoes instagram· active website
brand in the name “instagram”TLD with a high abuse rate “xyz”brand name and brand-styled page “instagram”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalwhatsapp-help.sitescore 71echoes whatsapp· active website
brand in the name “whatsapp”lure words (login, verify, secure…) “help”brand name and brand-styled page “whatsapp”

Model opinion: looks like abuse (target: WhatsApp), confidence 62%. An opinion, not a finding.

Criticalsilverbattlevanguard.clubscore 69echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalgrowrocket.shopscore 68· active website
page asks for credentials “log in to your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 58%. An opinion, not a finding.

Criticallaunchclash.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticaloshades.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 56%. An opinion, not a finding.

Criticalpyravo.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalskytravel.topscore 68· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”brand in page title, not in the name “booking”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalvipsmmm.proscore 68· active website
page asks for credentials “log in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalhelpdeskwaw.onlinescore 66· active website
lure words (login, verify, secure…) “helpdesk”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

See all 961 high and critical rows for 2026-09-17

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.