Hidden portfolios, revealed by their moves

When dozens of domains make the exact same infrastructure move on the exact same day, they are almost never unrelated. That is a portfolio, a bulk migration, or a shared operator - a fingerprint you can only see by watching everything at once, continuously.

A cohort is 3 or more domains that made the identical change the same UTC day; cohort_size is the exact, uncapped count. Transient reachability blips are excluded so the real portfolios lead. Full cohort membership is on the signed API.