Daily zone census

173,589 domains were born on Saturday, September 19, 2026

173,589
domains appeared
122,173
domains left the zone
14.6%
had a live website by day's end
938
flagged high or critical

On Saturday, September 19, 2026 the census compared 1,062 zone files holding 77,076,847 domains against the day before. 173,589 names were new (0.225% of the universe), 122,173 were gone, net +51,416. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Oct 5

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website25,308 14.6%
  • Parked or for sale2,786 1.6%
  • Registered, no site yet23,401 13.5%
  • Nothing there at all40,731 23.5%
  • Couldn't tell81,363 46.9%

What the 25,308 live sites are about

Unclassified6,823 · 27.0%
E-commerce & retail3,763 · 14.9%
Hosting & domains3,608 · 14.3%
Gambling & casino1,935 · 7.6%
SaaS & tech938 · 3.7%
Crypto Web3611 · 2.4%
Construction Trades607 · 2.4%
Streaming Piracy563 · 2.2%
Blogs & personal543 · 2.1%
Gaming508 · 2.0%
Adult505 · 2.0%
AI software490 · 1.9%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz47,0975,9251.7
.top18,60719,8851.5
.shop10,04315,4951.4
.org9,4677,9498.6
.online8,5896,9533.6
.app7,9652,4142.8
.site5,3254,8273.8
.info4,9358,7733.4
.cam4,9001450.6
.store4,8544,9934.7
.click3,2511,3348.0
.vip3,1502,2271.0
.sbs2,0852,0248.2
.cyou1,9921,0323.0
.asia1,9237980.0
.icu1,6381,7634.9
.digital1,6191,2660.0
.lol1,5685,0038.9
.pro1,4802,4812.7
.live1,4531,4635.5
.cfd1,4151,5195.7
.dev1,4074952.1
.space1,3811,0515.1
.cloud1,3417872.2
.tech1,3155687.6

Top 25 of 525 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-19.

Who is parking them

Dan697
Atom268
Sav113
Sedo68
Domeneshop37
NameBright31
Epik4
Voodoo1

What the live sites are built with

Vercel1,981
WordPress1,973
Shopify420
Wix77
Next.js63
Squarespace63
GitHub Pages10
Drupal9
Webflow9
Joomla5

Writing system of the live sites

latin21,615
han1,587
cyrillic1,011
thai524
arabic263
hangul140
hiragana52
bengali32

How old the departed names were

1–2 years656
2–5 years47
6–30 days2
1–3 months5
over 5 years4
3–12 months14
0–5 days (add-grace return)1
~1 year (first renewal lapse)47

Risk signals

Every one of the 336,145 births was scored on its name, its nameservers and registrar, and the page it served. 10,565 scored at all; 42 critical, 896 high, 1,683 medium, 7,944 low. The top 300 were screenshotted and shown to a model, which called 156 of them phishing, scam or abuse and 94 benign.

TLDs with the most flagged births per 1,000

.ink73.9 · 33 of 433
.fun26.1 · 34 of 1,262
.forum21.6 · 3 of 139
.win21 · 8 of 333
.email15.4 · 2 of 130
.mom15.3 · 3 of 196
.help14.7 · 6 of 409
.agency13.8 · 2 of 145
.homes10.8 · 3 of 279
.wiki10.3 · 11 of 876

Signals that fired most

brand in page title, not in the name1,124
TLD with a high abuse rate928
brand name at a retail registrar896
brand in the name843
form on a brand-styled page551
brand name at a watch-list registrar296
brand name behind Cloudflare257
punycode name238
lure words (login, verify, secure…)218
one-letter brand typo192
very long name177
nameserver domain born the same day145

Brands most often echoed in new names

amazon196
binance84
icloud74
tmobile41
facebook35
americanexpress31
google24
tiktok24
trustwallet24
intuit22
vanguard21
roblox17

Registrars of flagged names

GoDaddy.com, LLC273
Spaceship, Inc.212
NameCheap, Inc.202
HOSTINGER operations, UAB173
Dynadot Inc171
NameSilo, LLC105
Name.com, Inc.101
Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)81
Cloudflare, Inc.65
Dominet (HK) Limited50

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalledger-secure.orgscore 89echoes ledger· active website
brand in the name “ledger”lure words (login, verify, secure…) “secure”brand name and brand-styled page “ledger”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Ledger), confidence 72%. An opinion, not a finding.

Criticalshopifyhardware.shopscore 85echoes shopify· active website
brand in the name “shopify”page impersonates a brand “PayPal”brand name and brand-styled page “shopify”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Shopify), confidence 68%. An opinion, not a finding.

Criticalo-pen-ai.sbsscore 79echoes openai· active website
brand in the name “openai”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Coinbase”+2 more

Model opinion: looks like phishing (target: OpenAI), confidence 93%. An opinion, not a finding.

Criticaldonhangshopee.clickscore 77echoes shopee· active website
brand in the name “shopee”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “shopee”+1 more

Model opinion: looks benign, confidence 68%. An opinion, not a finding.

Criticalpension-weingut-schwab.sitescore 77echoes schwab· active website
brand in the name “schwab”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “schwab”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticaltiktokclone.shopscore 77echoes tiktok· active website
brand in the name “tiktok”brand name at a retail registrar “GMO Internet, Inc.”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse, confidence 86%. An opinion, not a finding.

Criticaliptvwordpress.onlinescore 76echoes wordpress· active website
brand in the name “wordpress”brand name on a rarely-seen nameserver “bigrock.com”page impersonates a brand “Netflix”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Critical9mail.xyzscore 75echoes gmail· active website
brand spelled with digits “9mail→gmail”brand plus digits “9mail”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalusa456.winscore 75echoes usaa· active website
brand spelled with digits “usa456→usaa”brand plus digits “usa456”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 75%. An opinion, not a finding.

Criticaleliteservice.storescore 74· active website
lure words (login, verify, secure…) “service”page asks for credentials “log in to your account”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticallinkedinzoo.appscore 69echoes linkedin· active website
brand in the name “linkedin”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “linkedin”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticalarmbellringer.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “ledger”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Criticaldksmmpro.storescore 68· active website
page asks for credentials “log in to your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 55%. An opinion, not a finding.

Criticalhangoutden.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticalpaywithpump.funscore 68· active website
TLD with a high abuse rate “fun”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: PayPal), confidence 78%. An opinion, not a finding.

See all 938 high and critical rows for 2026-09-19

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.