Hidden portfolios, revealed by their moves

When dozens of domains make the exact same infrastructure move on the exact same day, they are almost never unrelated. That is a portfolio, a bulk migration, or a shared operator - a fingerprint you can only see by watching everything at once, continuously.

Showing the last measurement, from 26 hours ago. Not a live read: we could not complete a fresh read from the signed data door. Every number below is real and signed - it is just as of , not now.
Provable Every number here rolls up observations we continuously scan and Ed25519-sign, then anchor on Base - a signature proves attribution and integrity, added trust, not a claim that a number is beyond question. Open a domain's signed record, take a receipt id from it, then paste that id into the verifier: it checks the Ed25519 signature and resolves that window's root from Base. Both checks run in your own browser, against published keys.
81 domainsdns
all made the identical move
magpiedns.com → kirklanddc.com
same day · 2026-10-17
81 domainsdns
all made the identical move
kirklanddc.com → magpiedns.com
same day · 2026-10-17
80 domainsdns
all made the identical move
kirklanddc.com → magpiedns.com
same day · 2026-10-18
80 domainsdns
all made the identical move
kirklanddc.com → magpiedns.com
same day · 2026-10-16
79 domainsdns
all made the identical move
kirklanddc.com → magpiedns.com
same day · 2026-10-20
79 domainsdns
all made the identical move
magpiedns.com → kirklanddc.com
same day · 2026-10-20
79 domainsdns
all made the identical move
magpiedns.com → kirklanddc.com
same day · 2026-10-16
78 domainsdns
all made the identical move
kirklanddc.com → magpiedns.com
same day · 2026-10-27
78 domainsdns
all made the identical move
magpiedns.com → koaladns.com
same day · 2026-10-19
78 domainsdns
all made the identical move
koaladns.com → magpiedns.com
same day · 2026-10-19
78 domainsdns
all made the identical move
koaladns.com → magpiedns.com
same day · 2026-10-18
78 domainsdns
all made the identical move
kirklanddc.com → koaladns.com
same day · 2026-10-18
78 domainsdns
all made the identical move
magpiedns.com → koaladns.com
same day · 2026-10-18
78 domainsdns
all made the identical move
koaladns.com → magpiedns.com
same day · 2026-10-17
78 domainsdns
all made the identical move
koaladns.com → kirklanddc.com
same day · 2026-10-17
78 domainsdns
all made the identical move
kirklanddc.com → koaladns.com
same day · 2026-10-16
78 domainsdns
all made the identical move
koaladns.com → magpiedns.com
same day · 2026-10-16
78 domainsdns
all made the identical move
magpiedns.com → koaladns.com
same day · 2026-10-16
78 domainsdns
all made the identical move
koaladns.com → kirklanddc.com
same day · 2026-10-16
77 domainsdns
all made the identical move
koaladns.com → magpiedns.com
same day · 2026-10-29
77 domainsdns
all made the identical move
koaladns.com → kirklanddc.com
same day · 2026-10-29
77 domainsdns
all made the identical move
kirklanddc.com → koaladns.com
same day · 2026-10-28
77 domainsdns
all made the identical move
koaladns.com → magpiedns.com
same day · 2026-10-28
77 domainsdns
all made the identical move
magpiedns.com → koaladns.com
same day · 2026-10-28
77 domainsdns
all made the identical move
koaladns.com → kirklanddc.com
same day · 2026-10-28

A cohort is 3 or more domains that made the identical change the same UTC day; cohort_size is the exact, uncapped count. Transient reachability blips are excluded so the real portfolios lead. Full cohort membership is on the signed API.

CONTINUOUS INTERNET TELEMETRY24H DRIFT5,819 material changesacross 276 domains · 24h to ~25m ago · -3,058 vs yesterdayROTATION52 domains moved DNS from koaladns.com to magpiedns.com, 48 moved backa rotation loop, not a migration · 24hREGISTRAR DRIFT3 changed registrar24hNOW1,438 curated domains not reachable+44 vs yesterdaySITE ERRORS20,313 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 88,050 sites429 rate-limit / 403 bot-block, a posture signal