Daily zone census

211,646 domains were born on Thursday, October 15, 2026

211,646
domains appeared
114,431
domains left the zone
11.0%
had a live website by day's end
816
flagged high or critical

On Thursday, October 15, 2026 the census compared 1,062 zone files holding 78,159,340 domains against the day before. 211,646 names were new (0.271% of the universe), 114,431 were gone, net +97,215. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Sep 11Oct 19

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website23,352 11.0%
  • Parked or for sale2,279 1.1%
  • Registered, no site yet23,093 10.9%
  • Nothing there at all50,482 23.9%
  • Couldn't tell112,440 53.1%

What the 23,352 live sites are about

Unclassified7,722 · 33.1%
Hosting & domains2,664 · 11.4%
E-commerce & retail1,416 · 6.1%
Gambling & casino1,264 · 5.4%
SaaS & tech1,034 · 4.4%
Adult897 · 3.8%
Construction Trades731 · 3.1%
Corporate services718 · 3.1%
AI software674 · 2.9%
Blogs & personal662 · 2.8%
Real estate516 · 2.2%
Gaming509 · 2.2%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz61,19210,7830.9
.top27,96415,8761.7
.org11,5738,5522.4
.online10,59010,2833.1
.shop8,95411,2560.9
.info7,4126,2162.3
.site5,9824,3343.7
.app5,9131,9361.7
.store5,7025,7452.5
.vip3,6522,3540.8
.lat3,6523082.2
.bar3,174531.3
.click2,8121,1989.2
.baby2,777640.4
.pro2,3001,6271.7
.live2,0287895.4
.wiki1,915893.7
.dev1,8184940.6
.sbs1,7131,3586.4
.lol1,6284786.8
.cfd1,5801,17410.1
.digital1,5764380.6
.space1,5501,1751.9
.tech1,5055844.0
.cloud1,3877342.9

Top 25 of 531 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-15.

Who is parking them

Dan708
Atom528
Sav125
NameBright74
Sedo50
Domeneshop36
Epik2
Voodoo2
Afternic2
Efty1

What the live sites are built with

WordPress1,906
Vercel1,789
Shopify94
Wix92
Next.js84
Squarespace66
Webflow16
GitHub Pages13
Joomla10
Drupal9

Writing system of the live sites

latin19,751
han1,800
cyrillic969
arabic327
hangul195
thai127
hiragana43
bengali42

How old the departed names were

1–2 years317
2–5 years29
6–30 days72
1–3 months14
over 5 years10
3–12 months24
0–5 days (add-grace return)20
~1 year (first renewal lapse)116

Risk signals

Every one of the 399,367 births was scored on its name, its nameservers and registrar, and the page it served. 10,771 scored at all; 41 critical, 775 high, 1,795 medium, 8,160 low. The top 300 were screenshotted and shown to a model, which called 129 of them phishing, scam or abuse and 133 benign.

TLDs with the most flagged births per 1,000

.hair19.6 · 2 of 102
.work13.9 · 7 of 503
.icu13.3 · 10 of 754
.win13 · 6 of 385
.ltd12.7 · 2 of 157
.fyi10.2 · 2 of 196
.cfd10.1 · 17 of 1,580
.mom10 · 2 of 200
.stream9.7 · 1 of 103
.ink9.3 · 3 of 321

Signals that fired most

brand in page title, not in the name1,070
TLD with a high abuse rate1,008
brand name at a retail registrar828
brand in the name798
form on a brand-styled page564
punycode name390
brand name behind Cloudflare288
brand name at a watch-list registrar267
one-letter brand typo196
random-looking name165
lure words (login, verify, secure…)155
identical page on many newborns138

Brands most often echoed in new names

whatsapp149
icloud68
binance47
tmobile41
google40
gmail39
amazon29
tiktok28
vanguard27
shopify24
roblox21
stripe21

Registrars of flagged names

NameCheap, Inc.228
HOSTINGER operations, UAB162
GoDaddy.com, LLC134
Dynadot Inc130
Spaceship, Inc.120
Cloudflare, Inc.119
NameSilo, LLC99
Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)87
GKG.Net, Inc.76
Name.com, Inc.64

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalpay-cloud.appscore 100echoes icloud· active website
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “pay”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “PayPal”+1 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalcostcowholesale-rewards8834.onlinescore 94echoes costco· active website
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “costcowholesale-rewards8834”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Costco), confidence 86%. An opinion, not a finding.

Criticalamazontrack-uk.livescore 89echoes amazon· active website
brand in the name “amazon”lure words (login, verify, secure…) “track”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticalpiensosmaqvsida-dobe.xyzscore 83echoes adobe· active website
brand in the name “adobe”TLD with a high abuse rate “xyz”page asks for credentials “Verify your identity”

Model opinion: looks like phishing (target: Adobe), confidence 88%. An opinion, not a finding.

Criticalfreecashapp.storescore 80echoes cashapp· active website
brand in the name “cashapp”brand name at a retail registrar “IONOS SE”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”

Model opinion: looks like abuse (target: Cash App), confidence 60%. An opinion, not a finding.

Criticaltelegran.winscore 80echoes telegram· active website
one-letter brand typo “telegran≈telegram”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “telegram”+1 more

Model opinion: looks like abuse (target: Telegram), confidence 70%. An opinion, not a finding.

Criticalweb3-trustwallet.cfdscore 80echoes trustwallet· active website
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand plus digits “web3-trustwallet”TLD with a high abuse rate “cfd”+1 more

Model opinion: looks like abuse (target: Trust Wallet), confidence 82%. An opinion, not a finding.

Criticaltesla-ai-south-africa.topscore 79echoes tesla· active website
ambiguous brand word “tesla”many hyphens “3”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+3 more

Model opinion: looks like a scam (target: Tesla), confidence 92%. An opinion, not a finding.

Criticalmycostcorewards1989.onlinescore 78echoes costco· active website
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards1989”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Costco), confidence 77%. An opinion, not a finding.

Criticalmycostcorewards37272.onlinescore 78echoes costco· active website
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards37272”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Costco), confidence 80%. An opinion, not a finding.

Criticalcatalog-telegram.lolscore 77echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “lol”brand name on a rarely-seen nameserver “amydns.ru”brand name and brand-styled page “telegram”+1 more

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalmakepad.funscore 76· active website
TLD with a high abuse rate “fun”free DNS provider “dnsowl.com”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”+1 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalmsokusaautomobilesprivatelimited.shopscore 76echoes usaa· active website
brand in the name “usaa”lure words (login, verify, secure…) “limited”very long name “32”brand name at a retail registrar “Spaceship, Inc.”+2 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalgusti-leder.livescore 74echoes ledger· active website
one-letter brand typo “leder≈ledger”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “DHL”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Gusti Leder), confidence 80%. An opinion, not a finding.

Criticalhulumerchandise.comscore 71echoes hulu· active website
brand in the name “hulu”brand name at a retail registrar “Gransy, s.r.o.”brand name and brand-styled page “hulu”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Hulu), confidence 85%. An opinion, not a finding.

See all 816 high and critical rows for 2026-10-15

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.