Daily zone census

203,610 domains were born on Monday, September 21, 2026

203,610

domains appeared

147,114

domains left the zone

9.2%

had a live website by day's end

787

flagged high or critical

On Monday, September 21, 2026 the census compared 1,062 zone files holding 77,130,512 domains against the day before. 203,610 names were new (0.264% of the universe), 147,114 were gone, net +56,496. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 22Oct 7

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

Active website18,697 9.2%
Parked or for sale1,472 0.7%
Registered, no site yet19,638 9.6%
Nothing there at all33,579 16.5%
Couldn't tell130,224 64.0%

What the 18,697 live sites are about

Unclassified6,455 · 34.5%

E-commerce & retail2,677 · 14.3%

Hosting & domains1,960 · 10.5%

Gambling & casino1,021 · 5.5%

SaaS & tech861 · 4.6%

Blogs & personal521 · 2.8%

Crypto Web3455 · 2.4%

AI software420 · 2.2%

Corporate services367 · 2.0%

Gaming362 · 1.9%

Education319 · 1.7%

Construction Trades295 · 1.6%

Where the new names landed

TLD	Born	Gone	Flagged /1k
.xyz	111,490	55,378	1.5
.top	8,487	18,985	1.8
.online	7,470	6,097	4.8
.shop	7,024	10,587	1.6
.app	6,449	2,158	3.3
.org	6,342	6,513	2.5
.info	6,133	5,387	1.3
.site	4,906	2,838	2.9
.store	4,193	4,227	4.3
.vip	2,935	2,197	1.0
.asia	2,286	575	0.0
.lol	1,621	908	4.3
.website	1,535	632	0.7
.click	1,344	2,208	4.5
.dev	1,271	401	0.0
.pro	1,265	1,812	2.4
.space	1,190	618	3.4
.live	1,127	1,220	1.8
.icu	1,018	941	11.8
.fun	982	651	12.2
.cfd	952	947	3.2
.cloud	929	921	2.2
.cyou	924	799	1.1
.tech	924	520	7.6
.sbs	902	1,864	27.7

Top 25 of 517 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-21.

Who is parking them

Atom359

Dan335

Sav82

Sedo42

Domeneshop35

NameBright30

Afternic14

Epik2

What the live sites are built with

WordPress2,048

Vercel1,952

Shopify234

Next.js78

Wix52

Squarespace46

GitHub Pages10

Webflow4

Linktree3

Drupal1

Writing system of the live sites

latin16,363

han880

cyrillic724

arabic301

thai146

hangul137

hiragana43

bengali40

How old the departed names were

1–2 years452

2–5 years49

6–30 days52

1–3 months1

over 5 years14

3–12 months47

0–5 days (add-grace return)3

~1 year (first renewal lapse)40

Risk signals

Every one of the 333,175 births was scored on its name, its nameservers and registrar, and the page it served. 15,107 scored at all; 29 critical, 758 high, 1,476 medium, 12,844 low. The top 300 were screenshotted and shown to a model, which called 147 of them phishing, scam or abuse and 95 benign.

TLDs with the most flagged births per 1,000

.ink73 · 30 of 411

.wiki29.2 · 7 of 171

.sbs27.7 · 25 of 902

.today15.5 · 3 of 129

.mom14 · 2 of 143

.link12.8 · 3 of 234

.fun12.2 · 12 of 982

.icu11.8 · 12 of 1,018

.help9.7 · 4 of 413

.win8.7 · 3 of 343

Signals that fired most

TLD with a high abuse rate1,149

brand in page title, not in the name1,123

brand in the name615

brand name at a retail registrar516

form on a brand-styled page464

brand name behind Cloudflare300

punycode name266

lure words (login, verify, secure…)208

brand name at a watch-list registrar202

one-letter brand typo120

brand plus digits108

identical page on many newborns93

Brands most often echoed in new names

usps99

icloud56

tiktok38

binance35

cashapp33

gmail30

salesforce29

commerzbank29

ebay23

google22

stripe17

vanguard17

Registrars of flagged names

NameCheap, Inc.118

HOSTINGER operations, UAB88

NICENIC INTERNATIONAL GROUP CO., LIMITED81

Cloudflare, Inc.76

GoDaddy.com, LLC74

GMO Internet Group, Inc. d/b/a Onamae.com65

Name.com, Inc.62

Spaceship, Inc.57

Dynadot Inc48

NameSilo, LLC41

Nameserver providers of flagged names

cloudflare.com889

dns-parking.com145

mismes.com117

vercel-dns.com117

registrar-servers.com116

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalpaypalreq.spacescore 85echoes paypal· active website

brand in the name “paypal”page impersonates a brand “PayPal”brand name and brand-styled page “paypal”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: PayPal), confidence 97%. An opinion, not a finding.

Criticalbestbuycanadas.comscore 77echoes bestbuy· active website

brand in the name “bestbuy”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”brand name and brand-styled page “bestbuy”+1 more

Model opinion: looks like phishing (target: Best Buy), confidence 94%. An opinion, not a finding.

Criticalpaypalcasino.appscore 73echoes paypal· active website

brand in the name “paypal”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “paypal”brand name and brand-styled page “paypal”

Model opinion: looks like abuse (target: PayPal), confidence 82%. An opinion, not a finding.

Criticalaxl777-mobile.xyzscore 69echoes tmobile· active website

brand spelled with digits “axl777-mobile→tmobile”brand plus digits “axl777-mobile”TLD with a high abuse rate “xyz”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 89%. An opinion, not a finding.

Criticaldora77-mobile.xyzscore 69echoes tmobile· active website

brand spelled with digits “dora77-mobile→tmobile”brand plus digits “dora77-mobile”TLD with a high abuse rate “xyz”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalsstiktok.appscore 69echoes tiktok· active website

brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 58%. An opinion, not a finding.

Criticalbestbuyhearing.onlinescore 68echoes bestbuy· active website

brand in the name “bestbuy”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalhdtv4k.xyzscore 68· active website

TLD with a high abuse rate “xyz”page impersonates a brand “netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 96%. An opinion, not a finding.

Criticalonaircoins.comscore 68· active website

page asks for credentials “Verify your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalpropassnp.xyzscore 68· active website

TLD with a high abuse rate “xyz”page impersonates a brand “NETFLIX”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalwhatsappnumberishere.shopscore 68echoes whatsapp· active website

brand in the name “whatsapp”brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Criticaltiptok.techscore 66echoes tiktok· active website

one-letter brand typo “tiptok≈tiktok”brand in page title, not in the name “tiktok”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 58%. An opinion, not a finding.

Criticalroblox-high-school-2.wikiscore 65echoes roblox· active website

brand in the name “roblox”many hyphens “3”brand plus digits “roblox-high-school-2”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalthehuntroblox.wikiscore 65echoes roblox· active website

brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: suspicious (target: Roblox), confidence 60%. An opinion, not a finding.

Criticaletsy-reverse-fee.onlinescore 63echoes etsy· active website

brand in the name “etsy”brand name and brand-styled page “etsy”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

See all 787 high and critical rows for 2026-09-21

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.