Daily zone census

175,009 domains were born on Saturday, October 3, 2026

175,009
domains appeared
120,717
domains left the zone
12.5%
had a live website by day's end
765
flagged high or critical

On Saturday, October 3, 2026 the census compared 1,062 zone files holding 77,329,859 domains against the day before. 175,009 names were new (0.226% of the universe), 120,717 were gone, net +54,292. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Sep 1Oct 19

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website21,855 12.5%
  • Parked or for sale2,788 1.6%
  • Registered, no site yet21,959 12.5%
  • Nothing there at all41,819 23.9%
  • Couldn't tell86,588 49.5%

What the 21,855 live sites are about

Unclassified7,495 · 34.3%
Hosting & domains2,395 · 11.0%
E-commerce & retail1,314 · 6.0%
SaaS & tech1,293 · 5.9%
Gambling & casino1,256 · 5.7%
AI software757 · 3.5%
Construction Trades609 · 2.8%
Streaming Piracy560 · 2.6%
Crypto Web3526 · 2.4%
Blogs & personal526 · 2.4%
Gaming477 · 2.2%
Corporate services453 · 2.1%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz56,9488,7782.0
.shop14,02712,7530.8
.top12,35515,7653.3
.org9,6537,0112.8
.app9,6442,6373.7
.online8,9446,9032.5
.site4,9544,0504.8
.info4,7849,4842.1
.store4,3804,5772.5
.vip3,4072,6741.2
.dev3,1278152.6
.pro2,5832,6121.5
.cyou2,2582,3102.7
.lat1,8112542.2
.buzz1,6742710.6
.click1,6471,08310.9
.lol1,4281,9739.1
.live1,4091,2145.0
.sbs1,3882,8438.6
.cfd1,3231,1274.5
.tech1,2125032.5
.space1,1891,1611.7
.fun1,15983218.1
.icu1,1501,4007.0
.cloud9816572.0

Top 25 of 525 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-03.

Who is parking them

Dan511
Sav322
Atom154
Afternic51
NameBright49
Domeneshop45
Sedo31
Fabulous4
Epik3

What the live sites are built with

Vercel2,568
WordPress1,666
Next.js122
Shopify122
Wix100
Squarespace56
Joomla10
GitHub Pages9
Webflow8
Linktree5

Writing system of the live sites

latin18,743
cyrillic1,459
han872
arabic301
hangul231
thai108
hiragana42
hebrew35

How old the departed names were

1–2 years883
2–5 years31
6–30 days8
1–3 months3
over 5 years15
3–12 months1
~1 year (first renewal lapse)112

Risk signals

Every one of the 337,682 births was scored on its name, its nameservers and registrar, and the page it served. 9,822 scored at all; 42 critical, 723 high, 1,498 medium, 7,559 low. The top 300 were screenshotted and shown to a model, which called 111 of them phishing, scam or abuse and 142 benign.

TLDs with the most flagged births per 1,000

.wiki24.7 · 7 of 243
.fun18.1 · 23 of 1,159
.work12.9 · 5 of 387
.bond11.9 · 3 of 252
.help11.8 · 3 of 254
.mom11.7 · 2 of 171
.click10.9 · 18 of 1,647
.win9.7 · 3 of 309
.lol9.1 · 16 of 1,428
.bid8.8 · 1 of 114

Signals that fired most

brand in page title, not in the name1,154
TLD with a high abuse rate864
brand name at a retail registrar739
form on a brand-styled page614
brand in the name559
brand name at a watch-list registrar264
brand name behind Cloudflare234
one-letter brand typo189
punycode name177
lure words (login, verify, secure…)142
identical page on many newborns122
page impersonates a brand118

Brands most often echoed in new names

icloud80
binance47
gmail36
amazon31
telegram26
google25
tmobile25
vanguard25
tiktok19
openai18
stripe18
roblox17

Registrars of flagged names

NameCheap, Inc.271
HOSTINGER operations, UAB202
Spaceship, Inc.168
GoDaddy.com, LLC126
Dynadot Inc118
Name.com, Inc.110
NameSilo, LLC104
GMO Internet Group, Inc. d/b/a Onamae.com99
Cloudflare, Inc.96
Porkbun LLC67

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalanthropig.lolscore 88echoes anthropic· active website
one-letter brand typo “anthropig≈anthropic”TLD with a high abuse rate “lol”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+2 more

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Criticalrobloxtoolscreator.topscore 85echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd.”+2 more

Model opinion: looks like phishing (target: Roblox), confidence 72%. An opinion, not a finding.

Criticaldmcaalertsinfo.comscore 80· active website
lure words (login, verify, secure…) “alert,alerts”page asks for credentials “log in to your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: YouTube), confidence 90%. An opinion, not a finding.

Criticalamazondeals.sitescore 77echoes amazon· active website
brand in the name “amazon”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “amazon”+1 more

Model opinion: looks like abuse (target: Amazon), confidence 60%. An opinion, not a finding.

Criticaltelegrampornoizle.comscore 77echoes telegram· active website
brand in the name “telegram”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “telegram”+1 more

Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.

Criticalproxy-dlya-telegram.topscore 76echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalproxy-telegram.topscore 76echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticaltelegram-proxy.cfdscore 76echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticaltelegrammproxy.topscore 76echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalcom-binance.comscore 75echoes binance· active website
brand in the name “binance”brand name at a retail registrar “Cloud Yuqu LLC”page impersonates a brand “Binance”brand name and brand-styled page “binance”

Model opinion: looks like phishing (target: Binance), confidence 82%. An opinion, not a finding.

Criticalgoogleveo3aivideogenerator.lolscore 75echoes google· active website
brand in the name “google”brand plus digits “googleveo3aivideogenerator”TLD with a high abuse rate “lol”brand name at a retail registrar “Porkbun LLC”+2 more

Model opinion: looks like abuse (target: Google), confidence 70%. An opinion, not a finding.

Criticalhalk-finance.sbsscore 74echoes binance· active website
one-letter brand typo “finance≈binance”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Criticalvanguardfrontier.worldscore 71echoes vanguard· active website
brand in the name “vanguard”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticaltiktokbonusagora.latscore 70echoes tiktok· active website
brand in the name “tiktok”lure words (login, verify, secure…) “bonus”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks like phishing (target: TikTok), confidence 85%. An opinion, not a finding.

Criticaltopmaxwp.topscore 68· active website
TLD with a high abuse rate “top”page impersonates a brand “NETFLIX”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Netflix), confidence 70%. An opinion, not a finding.

See all 765 high and critical rows for 2026-10-03

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.