Use of the phrase “the long tail” theory in business as "the notion of looking at the tail itself as a new market" of consumers was first coined by Chris Anderson, editor-in-chief of Wired Magazine. We found that the Long Tail theory is relevant for threats coming from the internet. Every day there are hundreds of thousands of new domains registered, many of which are used for scamming and cyber attacks. Only a small portion of those will make it into one of the dozens threat intelligence community or commodity feeds. The feeds collectively still hold only a portion of the attacks seen and analyzed by security professionals on a daily basis. The feeds creators do not encounter most of the long tail of cyber threat indicators, since the campaigns are built from low-visibility domains which, by definition, are very uncommon. In our research, we monitored a large set of newly registered sites as soon they were registered, and kept monitoring them on a daily basis. The monitoring process checked for activity in the domain, such as: IP registration, HTML content, OSINT tracking, who resolved the domain and from which geo-locations.Then we analyzed our results and came up with surprising facts on the statistics of usage of newly registered domains. We also compared different top-level domains for the purpose used by these newly registered domains, in addition to the different statistics for each one. Our set aim was to validate the long tail theory for cyber threats, and paraphrasing the Long Tail claim: "We saw more threats today that weren’t seen at all yesterday, than the threats we saw today that were indeed seen yesterday." Following our claim a key question raises: how effective are indicator blacklist and should we keep using them? The question reminds a similar question: is the AV dead? We’ll present our views and thoughts based on our research.