Daily zone census

201,315 domains were born on Tuesday, September 22, 2026

201,315
domains appeared
106,433
domains left the zone
12.7%
had a live website by day's end
878
flagged high or critical

On Tuesday, September 22, 2026 the census compared 1,062 zone files holding 77,225,394 domains against the day before. 201,315 names were new (0.261% of the universe), 106,433 were gone, net +94,882. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 23Oct 8

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website25,641 12.7%
  • Parked or for sale1,873 0.9%
  • Registered, no site yet28,402 14.1%
  • Nothing there at all50,405 25.0%
  • Couldn't tell94,994 47.2%

What the 25,641 live sites are about

Unclassified7,464 · 29.1%
Hosting & domains4,199 · 16.4%
E-commerce & retail3,606 · 14.1%
Gambling & casino1,424 · 5.6%
Streaming Piracy753 · 2.9%
SaaS & tech741 · 2.9%
Crypto Web3641 · 2.5%
Blogs & personal638 · 2.5%
Adult572 · 2.2%
Construction Trades474 · 1.8%
AI software457 · 1.8%
Corporate services455 · 1.8%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz56,5154,2401.4
.top23,50717,8461.1
.shop11,56011,2591.4
.cyou10,9481,2520.5
.org10,4276,7213.9
.online10,2487,3702.6
.info6,1486,4752.9
.site5,5883,2302.7
.store5,4823,9853.6
.biz3,1437390.0
.click2,9201,0578.9
.vip2,6692,4713.4
.lol2,3837918.0
.cloud2,1904782.3
.space2,0741,0091.9
.asia1,9896721.0
.pro1,8392,8230.5
.live1,5579224.5
.sbs1,4263,57610.5
.dev1,3654095.1
.fun1,33574813.5
.tech1,2505812.4
.icu1,2471,67012.8
.lat1,1303490.0
.website1,1176820.0

Top 25 of 545 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-22.

Who is parking them

Dan607
Sav170
Atom127
Afternic71
Sedo58
NameBright48
Domeneshop43
Epik6
HugeDomains1

What the live sites are built with

WordPress2,505
Vercel1,680
Shopify307
Wix101
Next.js65
Squarespace63
Webflow9
Joomla8
GitHub Pages6
Drupal5

Writing system of the live sites

latin21,770
han2,112
cyrillic977
arabic267
hangul183
thai126
bengali69
hiragana35

How old the departed names were

1–2 years182
2–5 years4
6–30 days1
1–3 months2
over 5 years2
3–12 months14
~1 year (first renewal lapse)28

Risk signals

Every one of the 377,316 births was scored on its name, its nameservers and registrar, and the page it served. 10,662 scored at all; 42 critical, 836 high, 1,725 medium, 8,059 low. The top 300 were screenshotted and shown to a model, which called 131 of them phishing, scam or abuse and 101 benign.

TLDs with the most flagged births per 1,000

.win20.6 · 8 of 388
.help16.2 · 7 of 431
.fun13.5 · 19 of 1,335
.icu12.8 · 16 of 1,247
.monster12 · 3 of 250
.cam11.5 · 5 of 433
.agency10.6 · 2 of 189
.sbs10.5 · 16 of 1,426
.quest10.2 · 4 of 294
.mobi9.7 · 1 of 103

Signals that fired most

brand in page title, not in the name1,035
TLD with a high abuse rate938
brand name at a retail registrar892
brand in the name880
form on a brand-styled page481
brand name behind Cloudflare330
brand name at a watch-list registrar306
punycode name260
one-letter brand typo188
lure words (login, verify, secure…)184
nameserver domain born the same day177
identical page on many newborns142

Brands most often echoed in new names

tiktok123
icloud71
amazon65
whatsapp61
usps52
vanguard42
google41
binance38
tmobile30
roblox26
gmail23
ebay21

Registrars of flagged names

NameCheap, Inc.277
TuringSign Inc. d/b/a Cosmotown164
Spaceship, Inc.159
HOSTINGER operations, UAB144
GoDaddy.com, LLC124
NameSilo, LLC123
Dynadot Inc115
Name.com, Inc.113
Cloudflare, Inc.82
NICENIC INTERNATIONAL GROUP CO., LIMITED59

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalinstagramservices.shopscore 97echoes instagram· active website
brand in the name “instagram”lure words (login, verify, secure…) “service,services”brand name on a rarely-seen nameserver “smmrental.in”page pushes urgent payment “claim your bonus”+1 more

Model opinion: looks like abuse (target: Instagram), confidence 78%. An opinion, not a finding.

Criticaltrustwalletsupport.topscore 94echoes trustwallet· active website
brand in the name “trustwallet”lure words (login, verify, secure…) “support,wallet”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “impreza.host”+1 more

Model opinion: looks like abuse (target: Trust Wallet), confidence 68%. An opinion, not a finding.

Criticalpixelgamevanguard.funscore 91echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+3 more

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalbuybitcoinsinstantlywithpaypal.xyzscore 87echoes paypal· active website
brand in the name “paypal”very long name “30”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”+2 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalcryptotopaypal.xyzscore 83echoes paypal· active website
brand in the name “paypal”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”page impersonates a brand “Paypal”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticaldashcoinbase.xyzscore 83echoes coinbase· active website
brand in the name “coinbase”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”page impersonates a brand “Coinbase”+1 more

Model opinion: suspicious (target: Coinbase), confidence 60%. An opinion, not a finding.

Criticalpaypalexchanger.xyzscore 83echoes paypal· active website
brand in the name “paypal”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”page impersonates a brand “Paypal”+1 more

Model opinion: looks like abuse (target: PayPal), confidence 62%. An opinion, not a finding.

Criticalsteelquestvanguard.questscore 77echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “quest”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”+1 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticaltelegram-proxy.bondscore 77echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “telegram”+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalproxytelegram.bondscore 76echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalbradescoatendimentoexclusivopf.digitalscore 73echoes bradesco· active website
brand in the name “bradesco”very long name “30”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “bradesco”+1 more

Model opinion: looks like phishing (target: Banco Bradesco), confidence 96%. An opinion, not a finding.

Criticalbradescoatendimentoexclusivopfcomb.digitalscore 73echoes bradesco· active website
brand in the name “bradesco”very long name “34”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “bradesco”+1 more

Model opinion: looks like phishing (target: Banco Bradesco), confidence 97%. An opinion, not a finding.

Criticalmedicare-4-me.comscore 71echoes medicare· active website
brand in the name “medicare”brand plus digits “medicare-4-me”brand name and brand-styled page “medicare”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalashenraidvanguard.infoscore 69echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalchatgptplus.bestscore 69echoes chatgpt· active website
brand in the name “chatgpt”brand name on a rarely-seen nameserver “link-host.net”brand name and brand-styled page “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: OpenAI), confidence 86%. An opinion, not a finding.

See all 878 high and critical rows for 2026-09-22

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.