Daily zone census

321,053 domains were born on Saturday, October 17, 2026

321,053
domains appeared
122,388
domains left the zone
6.8%
had a live website by day's end
971
flagged high or critical

On Saturday, October 17, 2026 the census compared 1,062 zone files holding 78,536,409 domains against the day before. 321,053 names were new (0.409% of the universe), 122,388 were gone, net +198,665. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Sep 13Oct 19

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website21,803 6.8%
  • Parked or for sale2,329 0.7%
  • Registered, no site yet22,674 7.1%
  • Nothing there at all50,317 15.7%
  • Couldn't tell223,930 69.7%

What the 21,803 live sites are about

Unclassified6,379 · 29.3%
Hosting & domains3,994 · 18.3%
E-commerce & retail1,173 · 5.4%
Gambling & casino1,117 · 5.1%
SaaS & tech964 · 4.4%
Adult958 · 4.4%
Construction Trades755 · 3.5%
Blogs & personal604 · 2.8%
AI software543 · 2.5%
Corporate services535 · 2.5%
Crypto Web3483 · 2.2%
Gaming472 · 2.2%

Where the new names landed

TLDBornGoneFlagged /1k
.xyz173,7536,8141.2
.top18,71115,9311.8
.shop14,56719,7151.0
.org9,7568,3332.7
.online9,5398,2373.6
.vip6,8042,1170.7
.site6,2924,9533.7
.app6,2551,5261.8
.cam5,9411340.5
.info4,78610,1522.5
.store4,7085,4211.7
.baby3,376702.7
.click2,8211,1565.7
.pro2,5921,7934.6
.best2,402340.0
.asia2,0815831.4
.bar1,954940.0
.wiki1,791882.2
.club1,7525851.1
.sbs1,7261,8219.3
.dev1,6904751.2
.live1,4398513.5
.space1,3701,4313.6
.cfd1,3629938.1
.cyou1,3371,19621.7

Top 25 of 529 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-10-17.

Who is parking them

Dan890
Sav119
Atom119
NameBright41
Sedo36
Domeneshop35
Afternic5
Epik2
Fabulous2

What the live sites are built with

Vercel1,844
WordPress1,575
Next.js62
Wix55
Squarespace54
Shopify47
GitHub Pages12
Drupal10
Webflow5
Joomla4

Writing system of the live sites

latin18,751
han1,556
cyrillic767
arabic261
hangul196
thai113
hiragana43
bengali31

How old the departed names were

1–2 years392
2–5 years43
6–30 days8
1–3 months5
over 5 years27
3–12 months11
0–5 days (add-grace return)10
~1 year (first renewal lapse)223

Risk signals

Every one of the 501,070 births was scored on its name, its nameservers and registrar, and the page it served. 16,087 scored at all; 36 critical, 935 high, 1,622 medium, 13,494 low. The top 300 were screenshotted and shown to a model, which called 134 of them phishing, scam or abuse and 118 benign.

TLDs with the most flagged births per 1,000

.bond65.2 · 24 of 368
.cyou21.7 · 29 of 1,337
.win16.4 · 5 of 305
.fun16.3 · 22 of 1,226
.courses16.1 · 2 of 124
.skin13.1 · 2 of 153
.sbs9.3 · 16 of 1,726
.monster9.3 · 2 of 108
.beauty8.9 · 5 of 448
.mom8.4 · 2 of 238

Signals that fired most

TLD with a high abuse rate1,053
brand in page title, not in the name1,039
brand name at a retail registrar937
brand in the name909
form on a brand-styled page593
brand name behind Cloudflare337
punycode name313
brand name at a watch-list registrar250
lure words (login, verify, secure…)203
one-letter brand typo166
brand plus digits107
very long name106

Brands most often echoed in new names

whatsapp119
stripe67
tmobile58
icloud57
usaa49
amazon44
binance39
google38
facebook32
revolut31
gmail28
tiktok26

Registrars of flagged names

NameCheap, Inc.224
GMO Internet Group, Inc. d/b/a Onamae.com210
HOSTINGER operations, UAB144
GoDaddy.com, LLC139
Spaceship, Inc.136
Dynadot Inc125
NameSilo, LLC97
GKG.Net, Inc.92
Cloudflare, Inc.81
Name.com, Inc.67

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticaluspstracking.funscore 100echoes usps· active website
brand in the name “usps”lure words (login, verify, secure…) “track,tracking”TLD with a high abuse rate “fun”page impersonates a brand “usps”+2 more

Model opinion: looks like abuse (target: USPS), confidence 70%. An opinion, not a finding.

Criticalwellsfargo-secure-login.beautyscore 100echoes wellsfargo· active website
brand in the name “wellsfargo”lure words (login, verify, secure…) “login,secure”TLD with a high abuse rate “beauty”page impersonates a brand “Wells Fargo”+1 more

Model opinion: looks like phishing (target: Wells Fargo), confidence 98%. An opinion, not a finding.

Criticalspin-and-go-mobile-laundry-services.orgscore 88echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “service,services”many hyphens “5”very long name “35”+1 more

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticalroyalmailtracking.sitescore 80echoes royalmail· active website
brand in the name “royalmail”lure words (login, verify, secure…) “track,tracking”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Royal Mail), confidence 77%. An opinion, not a finding.

Criticalsupport-metamask.infoscore 78echoes metamask· active website
brand in the name “metamask”lure words (login, verify, secure…) “support”page impersonates a brand “METAMASK”

Model opinion: looks like abuse (target: MetaMask), confidence 85%. An opinion, not a finding.

Criticalwindseogoogle.clickscore 77echoes google· active website
brand in the name “google”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “google”+1 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalbigbos99-mobile.shopscore 74echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “bigbos99-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Namecheap, Inc.”+2 more

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalmacrimepanel.topscore 74· active website
TLD with a high abuse rate “top”page asks for credentials “log in to your account”page impersonates a brand “PayPal”login form “has_form+login words”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalmejores-casinos-online-mexico.inkscore 70echoes lineme· active website
brand in the name “lineme”many hyphens “3”very long name “29”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalcostco-wholesale-remard.onlinescore 69echoes costco· active website
brand in the name “costco”brand name and brand-styled page “costco”form on a brand-styled page “has_form”form submits over plain HTTP “http://costco-wholesale-remard.online/”

Model opinion: looks like abuse (target: Costco), confidence 80%. An opinion, not a finding.

Criticalalex1710-cloud.xyzscore 68echoes icloud· active website
one-letter brand typo “cloud≈icloud”brand plus digits “alex1710-cloud”TLD with a high abuse rate “xyz”brand name on a rarely-seen nameserver “mitelis.cc”+1 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalbigbos99-mobile.monsterscore 68echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “bigbos99-mobile”TLD with a high abuse rate “monster”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalbollyflix1.lolscore 68· active website
TLD with a high abuse rate “lol”page impersonates a brand “NETFLIX”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalfollowerfans.onlinescore 68· active website
page asks for credentials “verify your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalmineshop.workscore 68· active website
TLD with a high abuse rate “work”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

See all 971 high and critical rows for 2026-10-17

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.