Daily zone census

191,009 domains were born on Thursday, October 8, 2026

191,009
domains appeared
124,194
domains left the zone
11.9%
had a live website by day's end
801
flagged high or critical

On Thursday, October 8, 2026 the census compared 1,062 zone files holding 77,599,678 domains against the day before. 191,009 names were new (0.246% of the universe), 124,194 were gone, net +66,815. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Sep 6Oct 19

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website22,639 11.9%
  • Parked or for sale1,766 0.9%
  • Registered, no site yet26,413 13.8%
  • Nothing there at all46,077 24.1%
  • Couldn't tell94,114 49.3%

What the 22,639 live sites are about

Unclassified7,500 · 33.1%
Hosting & domains2,657 · 11.7%
E-commerce & retail1,365 · 6.0%
Gambling & casino1,282 · 5.7%
SaaS & tech1,136 · 5.0%
AI software761 · 3.4%
Blogs & personal647 · 2.9%
Crypto Web3616 · 2.7%
Construction Trades570 · 2.5%
Corporate services550 · 2.4%
Streaming Piracy479 · 2.1%
Gaming454 · 2.0%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz59,50012,2820.7
.top13,26521,7402.3
.shop11,50210,5051.0
.online10,9447,0432.6
.org10,8897,8221.9
.info6,4467,2652.0
.app5,8441,2892.9
.site5,7287,6952.1
.store5,1125,2372.3
.icu3,8219642.6
.vip3,1802,5591.3
.click2,9011,6516.9
.biz2,6978430.4
.cyou2,2532,3813.1
.pro2,2162,3651.8
.dev1,8103960.6
.asia1,6366880.6
.tech1,5865823.2
.live1,5719842.5
.space1,5519801.9
.cfd1,5062,25310.6
.fun1,50384714.0
.world1,4671,0202.7
.cloud1,4225654.2
.lol1,3985527.9

Top 25 of 519 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-08.

Who is parking them

Dan744
Atom114
Sav112
NameBright48
Domeneshop28
Afternic23
Sedo16
Epik2

What the live sites are built with

Vercel2,431
WordPress1,938
Wix98
Next.js89
Squarespace58
Shopify40
Joomla9
Linktree9
Webflow8
GitHub Pages8

Writing system of the live sites

latin19,518
cyrillic1,239
han1,070
hangul262
arabic251
thai115
hiragana40
bengali39

How old the departed names were

1–2 years2,143
2–5 years23
6–30 days31
1–3 months8
over 5 years10
3–12 months12
0–5 days (add-grace return)9
~1 year (first renewal lapse)44

Risk signals

Every one of the 381,911 births was scored on its name, its nameservers and registrar, and the page it served. 10,100 scored at all; 26 critical, 775 high, 2,112 medium, 7,187 low. The top 300 were screenshotted and shown to a model, which called 148 of them phishing, scam or abuse and 117 benign.

TLDs with the most flagged births per 1,000

.ink136.1 · 60 of 441
.help16.5 · 11 of 665
.stream15.3 · 2 of 131
.sbs14.8 · 19 of 1,216
.fun14 · 22 of 1,503
.win13.8 · 6 of 435
.cam13.7 · 5 of 366
.wiki13.1 · 7 of 459
.monster11.9 · 3 of 252
.beauty11.8 · 2 of 170

Signals that fired most

brand in page title, not in the name1,211
TLD with a high abuse rate1,131
brand name at a retail registrar854
brand in the name832
form on a brand-styled page590
punycode name467
brand name at a watch-list registrar269
brand name behind Cloudflare266
one-letter brand typo176
lure words (login, verify, secure…)154
identical page on many newborns152
brand plus digits147

Brands most often echoed in new names

whatsapp140
americanexpress66
fedex55
icloud54
tmobile44
binance41
amazon40
gmail27
google24
coinbase22
tiktok20
revolut19

Registrars of flagged names

Dynadot Inc215
Spaceship, Inc.197
NameCheap, Inc.191
HOSTINGER operations, UAB175
Porkbun LLC134
GKG.Net, Inc.122
NameSilo, LLC113
GoDaddy.com, LLC111
Dominet (HK) Limited93
Name.com, Inc.88

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalfilepackage-documentm365778-okta.infoscore 92echoes okta· active website
brand in the name “okta”lure words (login, verify, secure…) “package”very long name “32”brand plus digits “filepackage-documentm365778-okta”+2 more

Model opinion: looks like abuse (target: Okta), confidence 78%. An opinion, not a finding.

Criticalxinweicloud.sbsscore 86echoes icloud· active website
brand in the name “icloud”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Netflix”+1 more

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalintesatradeai.sitescore 76echoes intesa· active website
brand in the name “intesa”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Coinbase”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Intesa Sanpaolo), confidence 88%. An opinion, not a finding.

Criticaltrezr.funscore 74echoes trezor· active website
one-letter brand typo “trezr≈trezor”TLD with a high abuse rate “fun”brand in page title, not in the name “ledger”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalnetflix-it.orgscore 73echoes netflix· active website
brand in the name “netflix”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Netflix”brand name and brand-styled page “netflix”

Model opinion: looks like abuse (target: Netflix), confidence 86%. An opinion, not a finding.

Criticalamazonapiwebservices.cloudscore 68echoes amazon· active website
brand in the name “amazon”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Amazon Web Services), confidence 93%. An opinion, not a finding.

Criticalmovieindo.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalmp4start.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalvanguardfront.onlinescore 67echoes vanguard· active website
brand in the name “vanguard”page impersonates a brand “PAYPAL”brand name and brand-styled page “vanguard”

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

Criticalparcelradar.appscore 66· active website
lure words (login, verify, secure…) “parcel”page impersonates a brand “DHL”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalkabukiroblox.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

Criticalintesatradeai.clickscore 62echoes intesa· active website
brand in the name “intesa”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 88%. An opinion, not a finding.

Criticalbusytwin.comscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “outlook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalcinemaisplay.spacescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalgetpicture.netscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

See all 802 high and critical rows for 2026-10-08

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.