Daily zone census

139,187 domains were born on Friday, October 2, 2026

139,187

domains appeared

153,716

domains left the zone

14.3%

had a live website by day's end

766

flagged high or critical

On Friday, October 2, 2026 the census compared 1,062 zone files holding 77,275,567 domains against the day before. 139,187 names were new (0.180% of the universe), 153,716 were gone, net -14,529. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 31Oct 18

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

Active website19,877 14.3%
Parked or for sale2,501 1.8%
Registered, no site yet20,889 15.0%
Nothing there at all38,976 28.0%
Couldn't tell56,944 40.9%

What the 19,877 live sites are about

Unclassified6,715 · 33.8%

Hosting & domains2,936 · 14.8%

Gambling & casino1,451 · 7.3%

E-commerce & retail1,379 · 6.9%

SaaS & tech717 · 3.6%

Blogs & personal527 · 2.7%

Real estate493 · 2.5%

Crypto Web3470 · 2.4%

AI software459 · 2.3%

Construction Trades413 · 2.1%

Gaming387 · 1.9%

Corporate services366 · 1.8%

Where the new names landed

TLD	Born	Gone	Flagged /1k
.top	30,927	17,617	1.7
.shop	10,972	13,108	0.9
.online	10,371	7,656	3.6
.org	9,797	7,050	3.3
.xyz	9,447	32,283	5.5
.site	5,107	4,220	2.2
.info	4,974	10,614	3.0
.store	4,650	6,004	1.3
.cfd	3,635	1,538	3.0
.vip	3,573	2,361	1.1
.pro	2,893	2,118	3.8
.buzz	2,542	571	0.4
.click	2,207	1,171	6.8
.live	2,073	1,164	5.3
.cyou	1,564	1,190	1.3
.dev	1,465	388	1.4
.space	1,397	1,114	2.9
.bond	1,253	125	5.6
.tech	1,241	542	6.4
.fun	1,160	713	13.8
.sbs	1,154	2,268	12.1
.lol	1,145	2,499	14.8
.digital	1,055	481	4.7
.cloud	1,031	676	5.8
.asia	878	945	2.3

Top 25 of 519 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-02.

Who is parking them

Dan523

Sav323

Atom97

NameBright89

Sedo57

Afternic41

Domeneshop23

Epik3

Fabulous1

DomainMarket1

What the live sites are built with

WordPress1,771

Vercel1,730

Wix119

Squarespace68

Next.js67

Shopify54

Joomla9

Webflow9

Drupal8

GitHub Pages5

Writing system of the live sites

latin17,316

cyrillic1,057

han721

arabic263

thai249

hangul118

bengali43

hiragana33

How old the departed names were

1–2 years654

2–5 years21

6–30 days13

1–3 months4

over 5 years22

3–12 months268

0–5 days (add-grace return)16

~1 year (first renewal lapse)92

Risk signals

Every one of the 324,386 births was scored on its name, its nameservers and registrar, and the page it served. 10,351 scored at all; 44 critical, 722 high, 3,155 medium, 6,430 low. The top 300 were screenshotted and shown to a model, which called 156 of them phishing, scam or abuse and 120 benign.

TLDs with the most flagged births per 1,000

.stream28.8 · 3 of 104

.wiki18.8 · 8 of 320

.help18.5 · 5 of 271

.icu16.4 · 13 of 794

.lol14.8 · 20 of 1,145

.cam14.3 · 5 of 349

.fun13.8 · 17 of 1,160

.sbs12.1 · 14 of 1,154

.win11.5 · 5 of 349

.agency11.4 · 2 of 176

Signals that fired most

brand in page title, not in the name2,647

TLD with a high abuse rate2,522

brand name at a retail registrar830

brand in the name613

form on a brand-styled page462

brand name at a watch-list registrar358

brand name behind Cloudflare276

punycode name256

one-letter brand typo227

identical page on many newborns157

lure words (login, verify, secure…)150

nameserver domain born the same day115

Brands most often echoed in new names

icloud87

vanguard39

google36

binance32

tmobile32

fedex31

tiktok26

gmail24

openai24

amazon22

roblox19

revolut16

Registrars of flagged names

Spaceship, Inc.1,767

NameCheap, Inc.245

HOSTINGER operations, UAB180

GoDaddy.com, LLC137

Dynadot Inc127

Porkbun LLC113

Name.com, Inc.104

Cloudflare, Inc.89

NameSilo, LLC86

NameSilo,LLC68

Nameserver providers of flagged names

cloudflare.com2,347

dns-parking.com197

registrar-servers.com127

mismes.com119

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalkraken-official.proscore 100echoes kraken· active website

brand in the name “kraken”lure words (login, verify, secure…) “official”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more

Model opinion: looks like abuse, confidence 70%. An opinion, not a finding.

Criticalloginverify-bankofamerica.comscore 91echoes bankofamerica· active website

brand in the name “bankofamerica”lure words (login, verify, secure…) “login,verify”brand name on a rarely-seen nameserver “bb-online.biz”brand name at a retail registrar “BB-Online UK Limited”+1 more

Model opinion: looks like abuse (target: Bank of America), confidence 80%. An opinion, not a finding.

Criticalrevolut-ai.topscore 91echoes revolut· active website

brand in the name “revolut”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+3 more

Model opinion: looks like a scam (target: Revolut), confidence 88%. An opinion, not a finding.

Criticalxbox360tracker.comscore 90echoes xbox· active website

brand in the name “xbox”lure words (login, verify, secure…) “track”brand plus digits “xbox360tracker”brand name at a retail registrar “Realtime Register B.V.”+1 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalcoinbase-us.livescore 87echoes coinbase· active website

brand in the name “coinbase”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+2 more

Model opinion: looks like phishing (target: Coinbase), confidence 93%. An opinion, not a finding.

Criticalae8888v4.winscore 83echoes bbva· active website

brand spelled with digits “ae8888v4→bbva”brand plus digits “ae8888v4”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse, confidence 70%. An opinion, not a finding.

Criticalbinancecar.orgscore 81echoes binance· active website

brand in the name “binance”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”page impersonates a brand “BINANCE”+1 more

Model opinion: looks like a scam (target: Binance), confidence 80%. An opinion, not a finding.

Criticalrevolutipo.infoscore 77echoes revolut· active website

brand in the name “revolut”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name and brand-styled page “revolut”+1 more

Model opinion: looks like a scam (target: Revolut), confidence 86%. An opinion, not a finding.

Criticalrobloxtea.comscore 77echoes roblox· active website

brand in the name “roblox”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”brand name and brand-styled page “roblox”+1 more

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Critical926051.xyzscore 76· active website

TLD with a high abuse rate “xyz”page asks for credentials “Sign in to your account”brand in page title, not in the name “docusign”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticaltiktok-rewards.onlinescore 76echoes tiktok· active website

brand in the name “tiktok”lure words (login, verify, secure…) “reward,rewards”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks like abuse (target: TikTok), confidence 80%. An opinion, not a finding.

Criticalus-amazon-bank.topscore 76echoes amazon· active website

brand in the name “amazon”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “bdusp.com”brand name at a retail registrar “NameSilo,LLC”+2 more

Model opinion: looks like phishing (target: Zillow), confidence 86%. An opinion, not a finding.

Criticalverizonmyrefund.comscore 76echoes verizon· active website

brand in the name “verizon”lure words (login, verify, secure…) “refund”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: looks like abuse (target: Verizon), confidence 80%. An opinion, not a finding.

Criticalforexkreditkort-finance.xyzscore 74echoes binance· active website

one-letter brand typo “finance≈binance”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.

Criticaltowa-finance.xyzscore 74echoes binance· active website

one-letter brand typo “finance≈binance”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.

See all 766 high and critical rows for 2026-10-02

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.