Who just switched provider - a daily leads list
Every domain that changed host, DNS, mail or CDN provider in the last 24 hours, dated the day the move was read: a warm leads list for sales - the accounts that just left a competitor - and a churn read for everyone else. Each lane below is one part of the plumbing, measured against its own normal day, with the pairs that moved together marked.
What this shows, and why you'd care
Domains switch providers every day, and most of it is routine shuffle. The question worth asking is which movement is unusual: a provider suddenly bleeding or gaining domains is the earliest public sign of an outage response, a price revolt, a consolidation, or one operator rotating a bulk portfolio.
This board ranks churn - how many domains moved through each provider, arrivals and departures side by side. It is deliberately not a leaderboard: a provider that gained 40 and lost 38 moved through 78 and kept 2. A big row means activity, never standing.
How “unusual” is measured
Each lane is compared only to itself. We take what a typical mover in the lane carried over the last 24 hours and the spread around that, and place every provider by how far it sits from that average - that distance is the σ printed on each row, and it is drawn on each lane's chart. σ is in this lane's own unit: domain moves per provider, last 24 hours, nothing else.
So “+1.5σ” reads as: noticeably beyond this lane's ordinary day. A rung is that distance banded, never a market position - a quiet lane's outlier can be a small number, and that is the correct reading.
Hosting network 91 moves
15 providers moved · a typical mover carried 12.1 domains, spread ±16.9 · the biggest single flow carries 7% of the lane · showing the top 12 of 15 providers and 20 of 21 flows
Second rung well above this lane's normal day (1–2σ above its average)
Third rung busier than this lane's average, inside its normal spread
The field this lane's ordinary day, at or below its average
Departures grouped by the provider they left
Arrivals grouped by the provider they moved to
How to read this page
The window is the last 24 hours
Everything above is the recent-observation window (last 24h). The 30-day view shows the same providers across a wider window, sectioned by what each one is.
A move needs both ends known
We never draw an arrow from an unknown origin, so a move where we only saw the destination is counted but not drawn. The grouped departures and arrivals are the same flows pivoted twice - each side sums to the lane.
Moved together is not market share
When one pair of providers carries most of a lane's moves in one window, the flow is marked coordinated; when the reverse flow carries a comparable count in the same window, both directions are marked rotation - a round trip, not a migration. Either pattern is usually a single operator rotating a bulk portfolio between backends, not many independent owners making the same choice on the same day - which is why this board ranks movement and never standing.
A signature never proves a classification
Every move is a signed observation you can re-verify. The provider class chips are curated editorial metadata: a provider is named by the registrable domain behind its authoritative records, chips come from evidence we verified, and "unclassified" means we have not verified what a backend is, never a judgment about it.