Hidden portfolios, revealed by their moves

When dozens of domains make the exact same infrastructure move on the exact same day, they are almost never unrelated. That is a portfolio, a bulk migration, or a shared operator - a fingerprint you can only see by watching everything at once, continuously.

Showing the last measurement, from 35 hours ago. Not a live read: the signed data door is at its daily read budget, which resets at midnight UTC. Every number below is real and signed - it is just as of 2026-07-30T20:22:42.352Z, not now.

Provable Every number here rolls up observations we continuously scan and Ed25519-sign, then anchor on Base - a signature proves attribution and integrity, added trust, not a claim that a number is beyond question.

243 domainsdns

all made the identical move
cloudflare.com → parity.domains

same day · 2026-07-22

197 domainsdns

all made the identical move
linda.ns.cloudflare.com, trevor.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-22

101 domainsdns

all made the identical move
kira.ns.cloudflare.com, matias.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-30

48 domainsdns

all made the identical move
cloudflare.com → parity.domains

same day · 2026-07-27

40 domainsemail

all made the identical move
1 alltheemails.com → 5 mail.h-email.net

same day · 2026-07-30

36 domainsdns

all made the identical move
heather.ns.cloudflare.com, kolton.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-27

35 domainsdns

all made the identical move
nico.ns.cloudflare.com, walk.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-22

26 domainsdns

all made the identical move
cloudflare.com → parity.domains

same day · 2026-07-23

23 domainsdns

all made the identical move
bill.ns.cloudflare.com, nena.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-30

23 domainsdns

all made the identical move
magpiedns.com → brainydns.com

same day · 2026-07-22

23 domainsdns

all made the identical move
ns1.magpiedns.com, ns2.magpiedns.com → ns1.brainydns.com, ns2.brainydns.com

same day · 2026-07-22

19 domainsdns

all made the identical move
cloudflare.com → registrar-servers.com

same day · 2026-07-23

17 domainsdns

all made the identical move
alberto.ns.cloudflare.com, tiffany.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-30

17 domainsemail

all made the identical move
1 alltheemails.com → 5 mail.h-email.net

same day · 2026-07-29

17 domainsdns

all made the identical move
kirklanddc.com → brainydns.com

same day · 2026-07-22

17 domainsdns

all made the identical move
ns1.kirklanddc.com, ns2.kirklanddc.com → ns1.brainydns.com, ns2.brainydns.com

same day · 2026-07-22

14 domainsemail

all made the identical move
5 mail.h-email.net → 1 alltheemails.com

same day · 2026-07-30

14 domainsdns

all made the identical move
david.ns.cloudflare.com, melina.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-29

14 domainsdns

all made the identical move
dns-parking.com → cloudflare.com

same day · 2026-07-23

14 domainsdns

all made the identical move
domaincontrol.com → cloudflare.com

same day · 2026-07-23

14 domainsdns

all made the identical move
hichina.com → alidns.com

same day · 2026-07-23

13 domainsdns

all made the identical move
hichina.com → alidns.com

same day · 2026-07-22

13 domainsdns

all made the identical move
domaincontrol.com → cloudflare.com

same day · 2026-07-22

12 domainsdns

all made the identical move
cloudflare.com → abovedomains.com

same day · 2026-07-23

12 domainscertificate

all made the identical move
C=PL, O=Unizeto Technologies S.A., 2.5.4.11=Certum Certification Authority, CN=Certum Domain Validation CA SHA2 → C=PL, O=Asseco Data Systems S.A., CN=Certum DV TLS G2 R39 CA

same day · 2026-07-23

12 domainscertificate

same day · 2026-07-22

11 domainsdns

all made the identical move
ns1.brainydns.com, ns2.brainydns.com → ns1.magpiedns.com, ns2.magpiedns.com

same day · 2026-07-30

11 domainsdns

all made the identical move
dns-a.mailobj.net, dns-b.mailobj.net → dns-c.mailobj.net, dns-d.mailobj.net

same day · 2026-07-23

10 domainsdns

all made the identical move
dns1.namecheaphosting.com, dns2.namecheaphosting.com → launch1.spaceship.net, launch2.spaceship.net

same day · 2026-07-30

10 domainsdns

all made the identical move
ns1.brainydns.com, ns2.brainydns.com → ns1.magpiedns.com, ns2.magpiedns.com

same day · 2026-07-27

10 domainsdns

all made the identical move
a.share-dns.com, b.share-dns.net → ns1.parklogic.com, ns2.parklogic.com

same day · 2026-07-26

10 domainscertificate

all made the identical move
C=AT, O=ZeroSSL GmbH, CN=ZeroSSL ECC DV SSL CA 2 → C=US, O=Google Trust Services, CN=WE1

same day · 2026-07-23

10 domainsdns

all made the identical move
storm-pro.net → cloudflare.com

same day · 2026-07-22

9 domainsdns

all made the identical move
ns1.magpiedns.com, ns2.magpiedns.com → ns1.brainydns.com, ns2.brainydns.com

same day · 2026-07-30

9 domainsdns

all made the identical move
ns1.brainydns.com, ns2.brainydns.com → ns1.koaladns.com, ns2.koaladns.com

same day · 2026-07-27

9 domainsdns

all made the identical move
ns1.kirklanddc.com, ns2.kirklanddc.com → ns1.brainydns.com, ns2.brainydns.com

same day · 2026-07-27

9 domainsdns

all made the identical move
share-dns.com + share-dns.net → parklogic.com

same day · 2026-07-26

9 domainsdns

all made the identical move
nile.ns.cloudflare.com, sasha.ns.cloudflare.com → ns1.lander.d.parity.domains, ns2.lander.d.parity.domains

same day · 2026-07-23

9 domainscertificate

all made the identical move
C=US, O=Let's Encrypt, CN=YR2 → C=US, O=Amazon, CN=Amazon RSA 2048 M01

same day · 2026-07-23

9 domainsdns

all made the identical move
cloudflare.com → domaincontrol.com

same day · 2026-07-22

A cohort is 3 or more domains that made the identical change the same UTC day; cohort_size is the exact, uncapped count. Transient reachability blips are excluded so the real portfolios lead. Full cohort membership is on the signed API.