Daily zone census

163,566 domains were born on Thursday, October 1, 2026

163,566

domains appeared

147,264

domains left the zone

15.3%

had a live website by day's end

1,241

flagged high or critical

On Thursday, October 1, 2026 the census compared 1,062 zone files holding 77,290,096 domains against the day before. 163,566 names were new (0.212% of the universe), 147,264 were gone, net +16,302. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 30Oct 17

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

Active website25,004 15.3%
Parked or for sale1,778 1.1%
Registered, no site yet28,877 17.7%
Nothing there at all43,617 26.7%
Couldn't tell64,290 39.3%

What the 25,004 live sites are about

Unclassified7,650 · 30.6%

Hosting & domains3,205 · 12.8%

Gambling & casino2,225 · 8.9%

E-commerce & retail1,522 · 6.1%

SaaS & tech1,179 · 4.7%

Adult802 · 3.2%

AI software726 · 2.9%

Corporate services631 · 2.5%

Construction Trades619 · 2.5%

Real estate609 · 2.4%

Blogs & personal531 · 2.1%

Streaming Piracy515 · 2.1%

Where the new names landed

TLD	Born	Gone	Flagged /1k
.top	25,739	20,302	2.4
.vip	16,878	1,894	0.2
.online	10,559	7,190	2.9
.xyz	10,483	16,350	4.4
.app	10,173	2,355	2.9
.org	10,075	6,903	4.8
.shop	8,947	12,563	1.9
.info	6,323	6,341	2.4
.site	5,359	4,146	5.0
.store	5,336	4,931	3.2
.pro	3,520	2,622	1.4
.click	2,957	1,635	7.8
.wiki	1,831	81	2.2
.lol	1,691	4,067	8.3
.space	1,604	1,079	5.0
.live	1,539	1,502	3.9
.dev	1,532	384	2.6
.cfd	1,522	4,311	3.3
.sbs	1,459	1,429	8.9
.tech	1,402	510	2.9
.cyou	1,364	1,232	5.9
.fun	1,309	764	16.0
.cloud	1,236	610	3.2
.icu	1,205	1,329	7.5
.lat	1,049	198	0.0

Top 25 of 519 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-01.

Who is parking them

Dan478

Sav230

Atom171

Sedo75

Domeneshop39

NameBright37

Afternic34

Epik3

What the live sites are built with

Vercel2,505

WordPress1,813

Wix109

Squarespace83

Next.js72

Shopify67

Webflow11

GitHub Pages6

Joomla5

Drupal4

Writing system of the live sites

latin21,149

han1,797

cyrillic1,000

arabic345

thai248

hangul228

bengali84

hebrew36

How old the departed names were

1–2 years719

2–5 years12

6–30 days163

1–3 months1

over 5 years4

3–12 months9

0–5 days (add-grace return)6

~1 year (first renewal lapse)64

Risk signals

Every one of the 355,941 births was scored on its name, its nameservers and registrar, and the page it served. 10,742 scored at all; 34 critical, 1,207 high, 1,706 medium, 7,795 low. The top 300 were screenshotted and shown to a model, which called 154 of them phishing, scam or abuse and 92 benign.

TLDs with the most flagged births per 1,000

.bid80 · 8 of 100

.win25.2 · 8 of 318

.bio18 · 2 of 111

.fun16 · 22 of 1,309

.xin15.3 · 2 of 131

.bond13.7 · 6 of 438

.homes11 · 6 of 544

.cat9.4 · 1 of 106

.sbs8.9 · 13 of 1,459

.hair8.9 · 1 of 112

Signals that fired most

brand name at a retail registrar1,335

brand in page title, not in the name1,178

brand in the name1,047

TLD with a high abuse rate970

form on a brand-styled page575

brand name at a watch-list registrar406

brand plus digits375

brand name behind Cloudflare330

punycode name290

one-letter brand typo227

identical page on many newborns180

lure words (login, verify, secure…)161

Brands most often echoed in new names

tmobile366

icloud83

whatsapp70

binance56

google43

openai33

facebook32

gmail25

vanguard23

tiktok21

revolut21

coinbase20

Registrars of flagged names

NameMart Pte. Ltd.324

NameCheap, Inc.236

HOSTINGER operations, UAB215

GoDaddy.com, LLC197

Spaceship, Inc.194

Cloudflare, Inc.129

Name.com, Inc.110

Dynadot Inc108

NameSilo, LLC103

Porkbun LLC82

Nameserver providers of flagged names

dyna-ns.net126

registrar-servers.com121

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Critical04-icloud.comscore 98echoes icloud· active website

brand in the name “icloud”brand plus digits “04-icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+3 more

Model opinion: looks like abuse (target: Apple), confidence 80%. An opinion, not a finding.

Criticalfidelityandsecurity.appscore 97echoes fidelity· active website

brand in the name “fidelity”lure words (login, verify, secure…) “security”brand name at a retail registrar “1&1 Internet SE”brand name and brand-styled page “fidelity”+1 more

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalrevolutguide.xyzscore 85echoes revolut· active website

brand in the name “revolut”TLD with a high abuse rate “xyz”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+2 more

Model opinion: looks like a scam, confidence 82%. An opinion, not a finding.

Critical33bay.buzzscore 83echoes ebay· active website

brand spelled with digits “33bay→ebay”brand plus digits “33bay”TLD with a high abuse rate “buzz”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalbinanceisland.xyzscore 83echoes binance· active website

brand in the name “binance”TLD with a high abuse rate “xyz”brand name at a retail registrar “Name.com, Inc.”page impersonates a brand “Binance”+1 more

Model opinion: suspicious (target: Binance), confidence 65%. An opinion, not a finding.

Criticalmobile-security.topscore 82echoes tmobile· active website

one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “security”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like a scam, confidence 74%. An opinion, not a finding.

Criticalexpediagroup8.vipscore 79echoes expedia· active website

brand in the name “expedia”brand plus digits “expediagroup8”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “expedia”+1 more

Model opinion: looks like a scam (target: Expedia Group), confidence 85%. An opinion, not a finding.

Criticalhttps-www-instagram-com-south-main-ya-stkn-d2dpd.linkscore 76echoes instagram· active website

brand in the name “instagram”many hyphens “8”very long name “48”brand plus digits “https-www-instagram-com-south-main-ya-st”+3 more

Model opinion: looks like abuse (target: Instagram), confidence 80%. An opinion, not a finding.

Criticalrequestrefundmac.xyzscore 74· active website

lure words (login, verify, secure…) “refund”TLD with a high abuse rate “xyz”page impersonates a brand “PayPal”brand in page title, not in the name “apple”+1 more

Model opinion: looks like phishing (target: Apple), confidence 93%. An opinion, not a finding.

Criticalsparkasse-kiel.comscore 71echoes sparkasse· active website

brand in the name “sparkasse”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “sparkasse”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Sparkasse (Förde Sparkasse / Sparkassen-Finanzgruppe)), confidence 96%. An opinion, not a finding.

Criticalrevolutionar.clickscore 70echoes revolut· active website

brand in the name “revolut”TLD with a high abuse rate “click”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalkinoweb.topscore 68· active website

TLD with a high abuse rate “top”page impersonates a brand “NETFLIX”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticallinktelegram.wikiscore 68echoes telegram· active website

brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks like abuse, confidence 86%. An opinion, not a finding.

Criticalplaytandem.funscore 68· active website

TLD with a high abuse rate “fun”page impersonates a brand “Coinbase”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalstno-openmenu.xyzscore 68· active website

TLD with a high abuse rate “xyz”page impersonates a brand “Apple ID”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Apple), confidence 95%. An opinion, not a finding.

See all 1,241 high and critical rows for 2026-10-01

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.