Daily zone census

300,850 domains were born on Friday, October 16, 2026

300,850

domains appeared

122,446

domains left the zone

7.7%

had a live website by day's end

1,031

flagged high or critical

On Friday, October 16, 2026 the census compared 1,062 zone files holding 78,337,744 domains against the day before. 300,850 names were new (0.384% of the universe), 122,446 were gone, net +178,404. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Sep 12Oct 19

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

Active website23,292 7.7%
Parked or for sale2,064 0.7%
Registered, no site yet27,210 9.0%
Nothing there at all49,194 16.4%
Couldn't tell199,090 66.2%

What the 23,292 live sites are about

Unclassified6,890 · 29.6%

Hosting & domains3,534 · 15.2%

E-commerce & retail1,502 · 6.4%

Gambling & casino1,260 · 5.4%

SaaS & tech1,055 · 4.5%

Adult861 · 3.7%

Construction Trades824 · 3.5%

Corporate services789 · 3.4%

AI software608 · 2.6%

Blogs & personal571 · 2.5%

Streaming Piracy554 · 2.4%

Real estate510 · 2.2%

Where the new names landed

TLD	Born	Gone	Flagged /1k
.xyz	166,945	8,672	1.2
.top	18,128	21,377	1.6
.org	10,145	8,093	3.5
.online	9,753	8,023	2.4
.shop	8,541	12,093	0.6
.site	7,562	4,697	2.1
.info	6,396	9,869	9.2
.app	6,006	1,590	2.7
.lol	5,826	538	2.6
.store	5,204	5,184	2.7
.vip	3,399	2,545	2.1
.click	2,990	1,879	5.7
.baby	2,817	88	2.1
.pro	2,401	2,212	3.3
.wiki	1,851	112	1.6
.dev	1,815	487	2.2
.cyou	1,733	2,124	6.3
.cfd	1,652	1,424	6.1
.live	1,627	993	2.5
.space	1,540	1,233	2.6
.sbs	1,396	3,444	10.7
.tech	1,368	622	6.6
.fun	1,323	1,016	6.8
.digital	1,248	687	5.6
.asia	1,168	487	0.0

Top 25 of 522 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-16.

Who is parking them

Dan603

Sav205

Atom188

NameBright46

Domeneshop39

Sedo38

Epik3

What the live sites are built with

Vercel1,898

WordPress1,754

Shopify81

Wix80

Next.js77

Squarespace59

Webflow14

GitHub Pages11

Joomla10

Drupal5

Writing system of the live sites

latin19,865

han1,780

cyrillic840

arabic271

hangul176

thai131

bengali103

greek42

How old the departed names were

1–2 years245

2–5 years29

6–30 days23

1–3 months8

over 5 years18

3–12 months5

0–5 days (add-grace return)6

~1 year (first renewal lapse)81

Risk signals

Every one of the 494,190 births was scored on its name, its nameservers and registrar, and the page it served. 16,680 scored at all; 33 critical, 998 high, 1,626 medium, 14,023 low. The top 300 were screenshotted and shown to a model, which called 162 of them phishing, scam or abuse and 98 benign.

TLDs with the most flagged births per 1,000

.bond53.1 · 11 of 207

.rest29.6 · 4 of 135

.work20.9 · 14 of 671

.mom18.2 · 3 of 165

.icu12.2 · 12 of 987

.one11.4 · 4 of 264

.sbs10.7 · 15 of 1,396

.stream9.9 · 1 of 101

.win9.6 · 3 of 313

.fyi9.6 · 2 of 209

Signals that fired most

brand name at a retail registrar1,063

brand in the name1,017

TLD with a high abuse rate982

brand in page title, not in the name968

form on a brand-styled page522

brand name behind Cloudflare375

brand name at a watch-list registrar375

punycode name320

one-letter brand typo185

lure words (login, verify, secure…)182

very long name141

identical page on many newborns121

Brands most often echoed in new names

whatsapp121

icloud86

tmobile85

amazon84

vanguard71

google47

gmail41

binance36

tiktok35

schwab26

microsoft25

ebay23

Registrars of flagged names

NameCheap, Inc.216

GMO Internet Group, Inc. d/b/a Onamae.com194

Spaceship, Inc.187

HOSTINGER operations, UAB163

Dynadot Inc162

GoDaddy.com, LLC126

NameSilo, LLC101

Cloudflare, Inc.99

Porkbun LLC95

GKG.Net, Inc.80

Nameserver providers of flagged names

cloudflare.com798

dns-parking.com178

afternic.com176

registrar-servers.com127

xundns.com109

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalpaypal-kundenservice26.proscore 100echoes paypal· active website

brand in the name “paypal”lure words (login, verify, secure…) “service”brand plus digits “paypal-kundenservice26”page impersonates a brand “PayPal”+2 more

Model opinion: looks like phishing (target: PayPal), confidence 97%. An opinion, not a finding.

Criticalmycostcorewards0029.onlinescore 78echoes costco· active website

brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards0029”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Costco), confidence 80%. An opinion, not a finding.

Criticalssstwitter.clickscore 71echoes twitter· active website

brand in the name “twitter”TLD with a high abuse rate “click”brand name and brand-styled page “twitter”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Twitter), confidence 62%. An opinion, not a finding.

Criticalbohcom.appscore 68· active website

page asks for credentials “Sign in to your account”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalbotmart.lolscore 68· active website

TLD with a high abuse rate “lol”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticaldacourentinu.onescore 68· active website

free DNS provider “dnsowl.com”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Microsoft), confidence 97%. An opinion, not a finding.

Criticallivraservece.funscore 68· active website

TLD with a high abuse rate “fun”page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: FedEx), confidence 86%. An opinion, not a finding.

Criticalmondaze.xyzscore 68· active website

TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalogboost.sitescore 68· active website

page asks for credentials “log in to your account”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalxn--ehqx7tcnnope.clickscore 68· active website

punycode name “三毛机场 scripts=CJK”TLD with a high abuse rate “click”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”

Model opinion: looks benign, confidence 66%. An opinion, not a finding.

Criticalxprimecoin.funscore 68· active website

TLD with a high abuse rate “fun”page impersonates a brand “Amazon Prime”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Criticalevaluadortiktok.appscore 67echoes tiktok· active website

brand in the name “tiktok”page impersonates a brand “PayPal”brand name and brand-styled page “tiktok”

Model opinion: looks like phishing (target: TikTok), confidence 74%. An opinion, not a finding.

Criticalalertglobal.techscore 66· active website

lure words (login, verify, secure…) “alert”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalvanguardtacticalsupply.comscore 65echoes vanguard· active website

brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalitmobile.storescore 64echoes tmobile· active website

brand in the name “tmobile”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “nationwide”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

See all 1,032 high and critical rows for 2026-10-16

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.