Domains expire, return, and link.

The page surfaces and analyzes domains through several independent, data-driven layers:

1. Delta detection, diffing consecutive zone-file snapshots to find domains that expired and were newly registered.
2. Maliciousness, checking every newly-registered domain against DomainDefender's own blocklist (the panels above).
3. Reuse, domains that expired and were genuinely re-registered (RDAP creation date after the April baseline).
4. Operator clusters, domains serving byte-identical page content (same content hash = one operator running many throwaways).

The link graph then maps where collected pages point one hop out, and who still links back to the domains we analyze.

It is a comparison of two complete zone-file snapshots taken at two points in time: an April-26 baseline (the zone_history set) and the latest June pull (the daily zone_file). For each TLD we take the set difference on the registered domain names:

• Expired = present in the old snapshot, gone from the new one.
• Newly registered = present in the new snapshot, absent from the old.
• Retained = present in both.

A TLD is only diffed once it has a fresh new pull, so an expiry reflects a real drop from the zone rather than a missing re-pull. The window on this page is roughly six weeks, long enough to capture meaningful registration and drop turnover.

It is all, two ways. There are no subsets anywhere in the delta.

Within a TLD: every domain, no sampling. A CZDS zone file enumerates every delegated domain in the TLD (any name with nameserver records), and the diff runs over that entire set. Concretely, .lol this run: all 661,421 April names were compared against all 992,513 June names, giving 28,988 expired, 360,080 newly registered, and 632,433 retained. Not a sample, not a top-N.

Across TLDs: all 1,080, each diffed in full. The identical full set difference runs for every covered TLD, from tiny brand zones up to .com's 160M+ names. We do not sample TLDs and we do not sample within them, so the headline counts (1,080 TLDs, 10.3M expired, 15.0M newly) are 100% of every zone, not an estimate.

The only place anything is sampled is the separate content-collection stage (a few hundred domains per TLD for screenshots and HTML), which is a different part of the pipeline and never touches the delta counts. One inherent caveat of any zone-based measurement: a domain that is registered but never delegated (no nameserver records) does not appear in the zone file, so it falls outside the diff.

All gTLDs we hold ICANN CZDS access for, about 1,087 zones across four disjoint CZDS credential sets (zero overlap). The daily pull refreshes them and the delta is computed across every gTLD that has a fresh snapshot pair (1,080 in the current run, expanding to the full set as pulls complete).

Country-code TLDs (.de, .uk, and so on) are out of scope: ICANN CZDS only distributes gTLD zones, not ccTLD zones.

Zone files are pulled daily via an automated CZDS job across the four credential sets, so a current snapshot is always on hand. The delta shown here compares the April-26 baseline against the latest snapshot, and can be recomputed against any newer snapshot as the daily pulls accumulate.

A set difference is only as honest as its two snapshots, so four controls guard the result. Each is an ablation: remove it and the numbers visibly move.

• Complete-pull guard (largest effect): a TLD is diffed only if its new pull is complete. Without it, a half-pulled zone reads as mass expiry, one incomplete .paris pull alone produced 21,986 phantom expiries against 473 real, so the guard removes roughly 24,000 false expiries and is why net growth is the internally consistent newly − expired, not a contaminated figure.
• Apex-row exclusion: the registry/zone apex (domain == tld) is never counted as a domain (negligible, 2 + 7 rows, but keeps the semantics clean).
• Large-zone pass: giant zones like .com are run separately so a single zone cannot exhaust memory in the bulk job.
• Reuse recovery: a name that drops and re-registers within the window stays in "retained", so reported churn is a lower bound; RDAP creation dates recover those cases.

One wording caveat: "expired" means a name left the DNS zone (delegation withdrawn), which is broader than registry deletion, a domain can leave the zone without being formally deleted. It is the signal we can measure uniformly across every gTLD.

To test maliciousness we intersect the newly-registered domains with DomainDefender's own ingested blocklist, which aggregates public threat feeds (PhishTank, OpenPhish, URLhaus, abuse.ch, Phishing.Database, Phishing.Army). A domain is malicious if one of those feeds has reported it for phishing or malware.

Many newly-registered abuse domains are not on any feed yet, which is exactly the early-warning value of catching them at the zone-delta stage, before the feeds list them. The feeds themselves are maintained and vetted by the security community.

A domain counts as malicious if it appears on DomainDefender's own ingested blocklist. That blocklist aggregates public threat feeds, PhishTank, OpenPhish, URLhaus, abuse.ch (MalwareBazaar / Feodo / SSLBL), Phishing.Database, and Phishing.Army, covering phishing, malware download, scamming, and C&C.

These signals are not ours. A domain is on the list because one of those feeds observed and reported it serving phishing or malware. We do not label domains ourselves; we intersect the newly-registered set with the feeds.

Stated plainly, this measures "listed by a public threat feed as malicious," a reputation signal, not an independent forensic analysis of each domain. Freshly-registered abuse is often not on any feed yet, which is why catching it early at the zone-delta stage is the value of this pipeline.

Yes. The creation date, registrar, and registrant come from RDAP enrichment. The "newly registered" flag on this page is from the zone delta, a domain present in the June zone files but absent from our April-26 baseline, which we then join to the actual registration record.

The default "By volume" ranking tracks TLD size, .com tops it simply because it's the biggest zone (11.6M churned = only 6.85%, normal turnover). Switch to "By rate" and the big TLDs fall below the 14.3% median; the real per-zone abuse intensity is in cheap flood TLDs. Size ≠ abuse.

Operator clusters, groups of domains serving byte-identical page content (same content hash). Identical content across many throwaway names is one operator / phishing kit; every domain in a cluster is a lead.

Zone files from ICANN CZDS (1,080 gTLDs in the current run, being extended to the full ~1,087-zone set). The delta compares the 2026-04-26 baseline against the latest June snapshot. Maliciousness comes from DomainDefender's own ingested blocklist; the link graph from our own content crawl.

Surfaced = a domain shows up in one of our analysis layers (newly registered, re-registered, or part of a shared-content operator cluster). It is a candidate, derived cheaply from zone + content data.

Malicious = the domain appears on DomainDefender's blocklist, meaning a public threat feed reported it for phishing or malware. A domain can be surfaced but not malicious, or malicious but not surfaced by our other layers. We report them separately.

The match is deterministic: a newly-registered domain either appears on a public threat feed or it does not, so there is no model or score to second-guess. The blocklist is maintained and vetted by the security community (PhishTank, abuse.ch, and so on). The malicious set's TLD distribution (heavy on .top / .click / .cfd / .cyou) matches known abuse patterns.

The maliciousness signal is DomainDefender's own ingested blocklist (PhishTank, OpenPhish, URLhaus, abuse.ch, Phishing.Database, Phishing.Army), refreshed by our own pipeline. The link graph is built from our own content crawl. (An external infrastructure graph was used only for early exploration; the figures on this page are entirely from DomainDefender's own data.)

279M zone records across 1,080 gTLDs. The April→June delta found 10,304,777 expired and 14,977,736 newly-registered domains, all checked for maliciousness against our own blocklist; the link graph holds 2,500 forward edges from our own content crawl.