Daily zone census

172,566 domains were born on Saturday, September 26, 2026

172,566
domains appeared
195,576
domains left the zone
12.2%
had a live website by day's end
393
flagged high or critical

On Saturday, September 26, 2026 the census compared 1,063 zone files holding 77,201,738 domains against the day before. 172,566 names were new (0.224% of the universe), 195,576 were gone, net -23,010. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 25Oct 10

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website21,067 12.2%
  • Parked or for sale2,144 1.2%
  • Registered, no site yet29,768 17.3%
  • Nothing there at all42,595 24.7%
  • Couldn't tell76,992 44.6%

What the 21,067 live sites are about

Unclassified6,235 · 29.6%
Hosting & domains4,018 · 19.1%
E-commerce & retail2,073 · 9.8%
Gambling & casino1,037 · 4.9%
SaaS & tech815 · 3.9%
Streaming Piracy601 · 2.9%
Blogs & personal476 · 2.3%
Construction Trades474 · 2.2%
AI software473 · 2.2%
Crypto Web3428 · 2.0%
Corporate services416 · 2.0%
Real estate408 · 1.9%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz47,78189,3670.6
.casa12,460710.1
.top12,03618,9652.2
.vip11,7652,5270.2
.org9,2347,1861.4
.online8,3828,1161.9
.shop6,84512,6621.0
.site5,1025,3361.2
.info4,9909,5942.0
.store4,9204,7272.6
.app4,0751,2322.0
.click3,5711,5843.6
.pro2,7482,5172.2
.dev1,5694721.3
.asia1,4771,0973.4
.cyou1,4678110.0
.sbs1,4121,8865.0
.bond1,3891250.0
.space1,3837901.4
.fun1,26966910.2
.world1,2366664.0
.cloud1,2266371.6
.live1,1821,4913.4
.tech1,1705430.9
.cfd1,0571,5314.7

Top 25 of 519 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-09-26.

Who is parking them

Dan630
Sedo324
Sav290
Atom71
NameBright46
Domeneshop26
Epik4

What the live sites are built with

Vercel1,916
WordPress1,722
Shopify205
Wix89
Squarespace71
Next.js62
GitHub Pages8
Joomla6
Drupal3
Webflow3

Writing system of the live sites

latin18,327
cyrillic1,266
han789
arabic239
thai162
hangul116
greek55
katakana28

How old the departed names were

1–2 years610
2–5 years1,826
6–30 days7
1–3 months2
over 5 years16
3–12 months2
0–5 days (add-grace return)4
~1 year (first renewal lapse)84

Risk signals

Every one of the 328,216 births was scored on its name, its nameservers and registrar, and the page it served. 9,661 scored at all; 25 critical, 368 high, 1,808 medium, 7,460 low. The top 600 were screenshotted and shown to a model, which called 121 of them phishing, scam or abuse and 278 benign.

TLDs with the most flagged births per 1,000

.ink114.6 · 33 of 288
.global15.6 · 3 of 192
.fun10.2 · 14 of 1,269
.wiki9.5 · 3 of 315
.beauty9.3 · 2 of 215
.hair8.3 · 1 of 120
.homes8 · 3 of 375
.lol7.9 · 9 of 1,011
.lat7 · 4 of 572
.autos6.2 · 2 of 323

Signals that fired most

brand in page title, not in the name978
TLD with a high abuse rate805
brand in the name575
form on a brand-styled page530
punycode name213
one-letter brand typo210
brand name behind Cloudflare209
lure words (login, verify, secure…)162
nameserver domain born the same day135
brand plus digits108
identical page on many newborns98
page impersonates a brand85

Brands most often echoed in new names

binance84
icloud66
amazon47
tmobile33
gmail30
facebook25
revolut24
chatgpt21
google20
tiktok20
vanguard20
wordpress19

Registrars of flagged names

Dynadot Inc18
Spaceship, Inc.17
NameCheap, Inc.14
NICENIC INTERNATIONAL GROUP CO., LIMITED12
NameSilo, LLC8
Porkbun LLC7
Dynadot, LLC7
GoDaddy.com, LLC7
HOSTINGER operations, UAB6
GMO Internet Group, Inc. d/b/a Onamae.com6

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalinstagram-private-account-viewer.topscore 97echoes instagram· active website
brand in the name “instagram”lure words (login, verify, secure…) “account”many hyphens “3”very long name “32”+3 more

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticaljp-chatgpt-app-test.blogscore 77echoes chatgpt· active website
brand in the name “chatgpt”many hyphens “3”brand name at a retail registrar “Automattic Inc.”brand name and brand-styled page “chatgpt”+1 more

Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 55%. An opinion, not a finding.

Criticalroblox-hub.lolscore 77echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “roblox”+1 more

Model opinion: looks like a scam (target: Roblox), confidence 80%. An opinion, not a finding.

Criticalunicreditgroup.topscore 77echoes unicredit· active website
brand in the name “unicredit”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “unicredit”+1 more

Model opinion: looks like phishing (target: UniCredit), confidence 80%. An opinion, not a finding.

Criticaltraxonsmm.topscore 76· active website
TLD with a high abuse rate “top”page asks for credentials “Sign in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalstripeone.xyzscore 71echoes stripe· active website
brand in the name “stripe”TLD with a high abuse rate “xyz”brand name and brand-styled page “stripe”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalgetrichwithchatgpt.comscore 69echoes chatgpt· active website
brand in the name “chatgpt”brand name on a rarely-seen nameserver “namefi.io”brand name and brand-styled page “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalhdmovie55.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalhoneyframe.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalpreampfm.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “uniswap”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalsupremesmm.storescore 68· active website
page asks for credentials “log in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 68%. An opinion, not a finding.

Criticalfutbolplayaveteranossantander.comscore 67echoes santander· active website
brand in the name “santander”very long name “29”brand name and brand-styled page “santander”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalchatgptjichang.onlinescore 65echoes chatgpt· active website
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more

Model opinion: looks like abuse (target: OpenAI), confidence 62%. An opinion, not a finding.

Criticalintelligenceartificielle-finance.xyzscore 64echoes binance· active website
one-letter brand typo “finance≈binance”very long name “32”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.

Criticalapexvanguard.orgscore 63echoes vanguard· active website
brand in the name “vanguard”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

See all 393 high and critical rows for 2026-09-26

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.