Where the Web Moves: We Followed 110 Million Domains for 38 Months — Two-Thirds Never Left Their Host, and One in Four Domains Now Points at a Parking Lot

The cloud wars are usually narrated as a story of constant motion: workloads fleeing to hyperscalers, hosts poaching each other's customers, the web endlessly re-platforming itself. Our own hosting census ended on an open question: the stocks barely moved between 2023 and 2026 — but stocks can hide enormous flows that cancel out. A market where half the customers swap providers every year and a market where nobody ever moves produce the same market-share chart. To tell them apart you have to follow individual domains, by name, from one address to the next.

So we did. The survival study published last week followed the 181 million domains that resolved in April 2023 and found 63.5% still alive in June 2026. This post follows the survivors' addresses: for every domain that resolved at both endpoints, we compared the IPv4 address behind its website — the A record of the bare domain or its www — in April 2023 and in June 2026, and classified both against the BGP networks that announce them. That yields something the market-share view cannot show: a full migration matrix of who actually moves where, a stickiness league table of who keeps their customers, and — folded in as its own section — the answer to a companion question: what fraction of the web still answers from the same IP address after three years?

The measurement covers 110.6 million domains observed with a website A record at both endpoints, classified by an IP-to-ASN map built from 69,683 autonomous systems, with the twenty-odd giant "front door" IPs — single addresses fronting millions of parked, for-sale, and registrar-default domains — identified individually and verified by HTTP probe, nameserver, and reverse-DNS evidence. Russian-administered TLDs are excluded throughout, per project policy. Full method, and the two measurement artifacts we had to quarantine, in the Methodology.

The conventional wisdom fails in both directions at once. The web is far more immobile than the cloud-war narrative implies: 46.8% of surviving domains answer from the exact same IPv4 address after 38 months, and 67.7% never left their provider. And the motion that does exist is largely not what anyone would call a customer choosing a better host: the single largest "cloud migration" of the period was GoDaddy relocating its parked-domain estate — about ten million domains — from Google Cloud to AWS anycast, a move no domain owner made. Registrar-controlled landers — parked pages, for-sale marketplaces, expiry pages, and setup defaults — grew from 15.0% to 24.8% of all website records: one domain in four now points at a lander, not a website.

The Data

Unlike the hosting census, which sampled one shard in twelve every month, this study processes both endpoint crawls in full — every record, every shard — because flows are rarer than stocks and the interesting ones live in the tails. The 110.6M flow universe is 98.7% of all domains the survival study counts as alive at both endpoints; the missing 1.3% resolved somewhere under their name but had no bare or www A record at one end.

Methodology

The website record. A domain's "address" here is the A record of the apex itself or, failing that, of www — the record a browser hits when a person types the name. This deliberately ignores subdomains: a company whose api. lives on AWS while its homepage sits on Squarespace counts as Squarespace. It also means our numbers differ by construction from the census series, which classified each apex by the first A record observed anywhere under the name. Both are valid units; this one matches the question "where does the website live."

Provider = BGP origin, plus named front doors. Every IP is mapped to the autonomous system that originates its /24, using an empirical map built from this project's own IP-to-ASN dataset (5.16 million /24s). ASNs are grouped into named providers (Cloudflare = AS13335/209242, Amazon = AS16509/14618/…, IONOS = AS8560, and so on — 67 ASNs named). On top of the ASN layer, 60 individually verified IPs are classified separately, because a single address like 3.33.130.190 fronts sixteen-plus million domains and calling it "Amazon" would be technically true and analytically useless: it is GoDaddy's parked-domain lander riding AWS Global Accelerator anycast. Each front-door IP was identified by fetching sample domains (the GoDaddy /lander redirect, marketplace titles), by nameserver forensics (domaincontrol.com, cashparking.com, sedoparking.com, parkingcrew.net), and by reverse DNS (Namecheap's expiry landers announce themselves as k8s-svc-lander-namecheap-expired-*.parklogic.net). One fixed classification rule is applied to both endpoints, so a domain that never changed its IP can never register as a mover.

Definitions used throughout:

• Survivor: a domain with a website A record at both endpoints. Stay: its 2026 provider label equals its 2023 label. Stickiness: percentage of a provider's 2023 survivor domains that stayed.
• Same IP: the 2023 and 2026 website-IP sets share at least one address. Tiers below it: same /24 block, same origin AS, same provider, moved.
• GoDaddy front door: the verified estate of GoDaddy-operated lander IPs — the parked-page lander, Afternic/Dan for-sale landers, CashParking, and domaincontrol.com-defaulted builder/forwarding pages — on whichever cloud they sit. GoDaddy's own hosting ASNs (AS26496 and kin) are counted separately as "GoDaddy hosting."
• Parking tier: the front-door estates plus the dedicated parking and aftermarket operators (Sedo, HugeDomains, Trellian/Above, Team Internet/ParkingCrew, Bodis, Dynadot, Atom.com, BuyDomains, expiry landers, registrar defaults). A domain "moving" to this tier usually means its registration lapsed, expired into auction, or was never developed — not that a customer chose a host.
• Dead: absent from the full June 2026 resolving-apex set under the survival study's any-hostname definition.

Known limitations, stated plainly:

• A lander is not always abandonment. The GoDaddy default estate includes Website Builder and forwarding pages with real content behind them; parked domains carry ads someone maintains. We label what the infrastructure is — a registrar-operated front door — not the intent of every owner behind it.
• Fixed classification is anachronism-proof but coarse. The ASN map is a 2026 snapshot applied to 2023 addresses. Because the same rule classifies both ends, no unchanged IP can produce a phantom flow; but a block that changed hands between owners mid-window is classified as its current owner at both ends, understating flows between those two parties.
• Two artifacts quarantined. 719,542 June 2026 records (27,195 in 2023) resolve to 208.91.112.55 — the Fortinet DNS-filter block page, a resolver-path artifact, not hosting; these are excluded from every flow and death table. And geoIP country attribution drifts as databases update: 42% of the US→un-geolocated flow kept its exact IP, so we treat the anycast bucket's growth as partly database surrender and say so where it matters.
• First hop, not origin. As in every census in this series, Cloudflare and other reverse proxies are the visible address; the origin behind the proxy is invisible by design.
• ±2-point error bound from the survival study's live-DNS verification carries over to the death rates here.

Dataset vs. external counts. Our census series reported AWS at 15.9% of resolving apexes in June 2026 using published compute ranges and first-observed records. This study, counting website records against everything Amazon announces into BGP, puts Amazon-announced space at 30.5% — and the difference is almost entirely the front-door estates riding Global Accelerator anycast. Neither number is wrong; "how big is AWS" has no answer until you say which records and which ranges. That definitional wedge — nearly fifteen points of the entire web — is itself a finding, and the deep-dive below decomposes it.

Reproducibility. A Go extractor (fast-path scanner validated byte-identical against a full JSON parse on both the 2023 and 2026 record formats) reduces each crawl to per-apex website records; merging, joining, and classification are streaming passes under C collation; the /24→ASN map and front-door list are flat TSVs. Same two-stage design as the published survival, MX, and DNS censuses. Chart data: stickiness, IP stability, same-IP by provider, parking, geography, full matrix, death rates.

The Scorecard: How Much of the Web Actually Moves

Rounded; the exact same-provider-or-closer total is 67.7%.

Two-thirds of the surviving web never left its provider, and nearly half never changed a single bit of its address. The annualized voluntary-migration rate implied by the 32.3% is roughly 10-12% per year — and, as the matrix below shows, a large share of even that is not migration in any commercial sense but domains lapsing into parking. Data → inference: hosting is a stock market with very little turnover; the visible share shifts in the census series are driven mostly by births and deaths, not by switching. Implication: the customer-acquisition war the cloud industry narrates is being fought over a thin, migratory minority — and over the newly registered — while the standing web mostly sits still.

The Stickiness League: Loyalty Is European

Stickiness is the market-power metric that share charts cannot show — a provider that loses every comparison shop but keeps every existing customer is stronger than its flat share suggests. Here is the league table: of each provider's April 2023 domains that survived, the share still on that provider in June 2026.

The top of the league is a tour of European mass hosting: Aruba, IONOS, One.com, Strato, OVH, Hetzner all hold 74-88% of their domains for three years. These are the same registries' worth of infrastructure whose ccTLDs topped the durability tables — bundled hosting, annual invoices, small-business inertia. Data → inference: the €5-a-month European hosting contract is among the stickiest products on the Internet. Implication: the "sovereign cloud" Europe frets about already exists at the mass-hosting layer; it retains customers better than any hyperscaler.

The bottom of the league is the American platform economy — but read the two worst rows differently. Google keeps 51.5%, and the single largest destination for its 2023 domains is Squarespace at 12.1%. That flow is not customer defection: it is the per-domain imprint of Google Domains' 2023 sale to Squarespace — a divestiture that force-migrated an entire registrar's default-hosted estate, one more instance of this post's recurring finding that the web's largest movements are corporate decisions, not webmaster choices. Amazon's 45.2%, by contrast, does look like genuine churn: 12.2% of its surviving 2023 domains left for Cloudflare, and 8.7% ended up on HugeDomains' for-sale landers — AWS's 2023 population was heavy with speculative and project domains that died into the aftermarket. Strato's 11.4% "defection" to IONOS is consolidation inside one corporate group, not a market event — visible in DNS as tidily as in the org chart.

One caution on reading the table: stickiness is not health. The GoDaddy front door holds 83.9% of its domains — parked stays parked — and that inertia is a revenue property of the lander estate, not customer satisfaction.

The Parked Quarter: The Web's Biggest "Host" Doesn't Host Anything

Classify every June 2026 website record, and the largest named infrastructure operator on the web is not a cloud, not a CDN, and not a hosting company. It is GoDaddy's collection of lander IPs.

Rows are rounded to 0.1M; the exact tier total is 73,524,011 domains.

One domain in four now points at a lander, and three quarters of the parked web points at one company's front doors. The GoDaddy estate alone grew from 20.3M to 54.7M domains — from 11.5% to 18.4% of every website record we can see — spread across roughly two dozen verified IPs: the parked lander (24.7M), builder-and-forwarding defaults (13.9M), the Afternic/Dan aftermarket (12.8M), and CashParking (3.3M). For scale: the entire Cloudflare-fronted web is 40.2M domains; the .com monopoly is the only larger named structure in the namespace. Data → inference: the fastest-growing category of web infrastructure in 2023-2026 was not compute; it was the monetized absence of websites. Implication: any census that classifies by IP ranges alone will report this as "Amazon grew" — and any analysis of "domains hosted on AWS" that does not carve out the front doors is, to the tune of tens of millions of names, measuring GoDaddy's parking business. Note the honest caveat: the default sub-estate includes live Website Builder pages alongside true parking; the split between them is not observable from DNS.

The aftermarket, not the cloud, is where 2023's dead projects went. Of AWS's 2023 survivors that left, the third-largest destination was HugeDomains — an operator that did not exist in our 2023 measurement at all and fronts 3.3M domains by 2026. Sedo nearly doubled to 3.8M. Hostinger's parking system went from ~zero to 2.0M. When Bodis retired its parking platform, its surviving domains scattered exactly as a market-share fight would predict: 41.7% to GoDaddy's landers, 11.7% behind Cloudflare, 10.4% to Trellian — a succession war over inventory whose owners likely never noticed.

The Great Lander Migration: Ten Million Domains Changed Clouds and Nobody Chose It

The census series recorded Google's hosting share halving while Amazon's tripled and could not say why. Following individual domains answers it.

In April 2023, a single Google Cloud address — 34.102.136.180 — was the website record of 9.0 million domains: 52% of every website record on Google-announced networks. By June 2026 that address has vanished from the top of the table, and 91.4% of its surviving domains sit on GoDaddy front doors now announced by Amazon. GoDaddy re-platformed its lander estate from GCP to AWS Global Accelerator; ten-plus million domains "migrated clouds" in the largest single flow in this dataset, and not one domain owner participated in the decision. Wix's 2023-era Google Cloud estate (0.8M domains on one IP) tells the same story in miniature: 80% of its survivors now answer from Wix's own network. Data → inference: Google's "halving" was substantially two tenants leaving; Amazon's "tripling" is substantially landers arriving. Amazon-announced space grew from 12.7% to 30.5% of website records, but the AWS that customers rent grew far more modestly: 6.0% to 8.7%. Implication: cloud-level market share measured on the open web is hostage to a handful of B2B replatforming decisions by registrars and site builders. The interesting economics — who wins the landers' business — is invisible in every market-share chart and enormous in the DNS.

Fixed Addresses: The Web That Never Moves

The stability ladder from the scorecard, cut by who ran the domain in 2023, answers the folded-in question — what fraction of the web answers from the same IP after three years — and turns out to be a fingerprint of infrastructure philosophy.

Squarespace points every customer at the same four addresses and has not moved them in years; AWS hands out elastic IPs that turn over even when the customer stays. The platform tier (Squarespace, Wix, Strato's shared hosting) barely re-addresses; the hyperscalers re-address constantly; and the self-hosted long tail — half of which still answers from the same IP after three years — is quietly the most conservative infrastructure on the Internet. The GoDaddy front door's 13.5% is the mirror image of its 83.9% stickiness: the domains never moved, the estate's addresses did. Data → inference: same-IP share measures provider architecture, not customer behavior — which is exactly why it matters operationally. Implication: for abuse teams, IP-reputation systems, allowlists, and anyone still pinning addresses in firewall rules, half the web is safe to reason about by IP across years — and the other half churns addresses by design, so every IP-keyed assumption silently expires.

The same cut by TLD reproduces the durability gradient: .ch (68.3%), .jp (67.2%), .fr (64.6%) and .eu (60.1%) lead same-IP stability; .com sits at 43.2% and the churn-belt names trail. National webs hosted on national mass hosting do not move; the speculative gTLD web moves — usually to a parking lot.

Who Poaches Whom: The Matrix's Off-Diagonal

Read down the inflow side of the matrix — what share of each provider's June 2026 stock (among survivors) arrived from somewhere else — and the market's real dynamics separate cleanly from its inertia.

Cloudflare is the largest genuine migration destination on the web: over half its 2026 survivor stock arrived within the window, mostly from the self-hosted long tail. That inflow is what the proxy-layer censuses see from the other side; here it is one domain at a time. Hostinger is the fastest-growing attacker in mass hosting — two-thirds of its 2026 stock is new — though its exit table below shows the other side of that funnel. Newfold is the structural loser of the period: the old EIG hosting empire is the only major provider whose absolute footprint shrank (6.0M → 4.4M domains), with barely any inflow to offset it. Data → inference: actual competitive motion is concentrated in exactly two battles — the edge (Cloudflare vs. self-hosting) and discount mass hosting (Hostinger vs. the legacy shared-hosting estates). Implication: everything else the market-share charts show is churn, births, deaths, and landers.

Exit Rates: Where Domains Go to Die

Death is not evenly distributed across hosts. Within the 2023 universe, 36.4% of domains were gone by June 2026 — but the rate ranges threefold by provider.

Cloudflare's 64% headline number is two populations wearing one orange coat. 6.3 million of its 2023 domains were Freenom free-TLD names — 91% of Freenom's entire website-record web sat behind Cloudflare — and Freenom's collapse killed 99.5% of them. Strip Freenom out and Cloudflare-fronted domains still died at 48.4% against a 33.8% ex-Freenom baseline — the free tier attracts precisely the throwaway, speculative, and abusive registrations that die young. At the other end, Strato and Aruba customers died at 18%: the same European small-business web that tops the stickiness league barely dies at all. Hostinger's exit rate (52.4%) next to its market-leading inflow completes its funnel: fast in, fast out — growth-machine hosting with churn to match. Data → inference: a provider's death rate is a census of who its customers are; free and promotional acquisition buys mortality. Implication: for threat-intel and reputation systems, provider context is a usable prior — and for the survival literature, "where was it hosted" belongs next to "which TLD" as a first-class mortality predictor.

The Geography of Nowhere

Finally, geography — the dimension our census series found immobile. Following the same 110.6M domains confirms the stillness and sharpens its one exception.

No country gained. The de-Americanization that would show up here — the same domains, physically re-homed — amounts to a net −3.0 points for the US, and the flow table shows where it went: the single largest cross-border flow is US → nowhere (5.4M domains), more than double the largest country-to-country flow. Germany-to-US (2.3M) actually outweighs US-to-Germany (0.8M); Canada's US flows nearly cancel (623K out, 615K in). The honest caveat is built into the headline: 42% of the US→anycast flow kept its exact IP — those domains did not move; the geolocation databases stopped asserting a country for their ranges. The other 58% genuinely re-addressed onto anycast front-ends. Data → inference: both halves erode the same thing — the answerability of "where is this domain hosted." Implication: the census-series conclusion survives the strongest test we can throw at it: even domain-by-domain, the web is not moving between countries. It is moving — one part physically, one part definitionally — off the map.

What's at Stake

• "Domains on AWS" is now a meaningless number without a front-door carve-out. Amazon announces 30.5% of the web's website records; a majority of the growth since 2023 is parked and for-sale landers operated by GoDaddy and the aftermarket. Any vendor analysis, market sizing, or academic study that classifies by IP range alone is off by up to fifteen points of the entire web.
• A quarter of the web points at registrar front doors, and most of that is inventory, not publication. 73.5M domains resolve to lander infrastructure — overwhelmingly parked, for-sale, and expiry pages, though the builder-default slice hides some real sites. Crawlers, LLM training pipelines, and "number of websites" statistics that count resolving domains as sites are counting a few dozen lander templates tens of millions of times.
• Stickiness, not share, is where hosting market power lives. European mass hosts keep 74-88% of their customers for three years; the hyperscalers keep 45-52% of the domains that touch them. Anyone pricing customer lifetime value — or antitrust exposure — off market-share charts is mismeasuring both ends.
• IP-keyed security assumptions have a half-life. Half the web hasn't changed address in three years; the cloud-hosted half re-addresses by design; and the parked fifth re-addresses in bulk when a registrar switches clouds. Reputation systems inherit all three regimes at once.
• Hosting-country is dissolving as a category. The only growing "country" is no-country, and nearly half of that growth is measurement giving up rather than servers moving. Jurisdiction, sanctions, and data-residency frameworks keyed to IP geolocation are aiming at a shrinking target.

What Would Help

1. Cloud and market analysts: publish compute share and announced share separately. The 15.9%-vs-30.5% AWS gap is entirely definitional. Two lines — "ranges sold to customers" and "everything the AS announces" — with front-door estates itemized, would let footprint claims be compared instead of talked past. Our matrix CSV is a starting decomposition.
2. Measurement researchers: treat lander IPs as first-class infrastructure. Twenty-odd IPs front a quarter of the web, and each is identifiable in an afternoon with HTTP probes, NS records, and rDNS. A maintained public registry of parking front doors would improve every downstream census, including ours.
3. Registrars and parking operators: label the estates. A _lander TXT convention or reserved rDNS naming (Namecheap's parklogic.net reverse names are the honorable example) would let crawlers and researchers separate inventory from publication without heuristics.
4. Security teams: key detection to the stability regime, not the address. Squarespace-class infrastructure supports years-long IP pinning; hyperscaler-hosted domains need ASN- or provider-level rules; anything on a front-door IP needs none of it — the domain is a lander. The same-IP-by-provider table is directly usable as that regime map.
5. Registries and policymakers: read churn and stickiness together. A TLD whose web sits on sticky national hosting (.ch, .jp, .de) has structurally different renewal economics than one whose web sits on promotional hosting that loses half its customers in three years. Pair this post's provider tables with the survival tables before pricing or forecasting anything.

Methodology: full-corpus A-record crawls of 7 April 2023 and 9 June 2026, reduced to one website record per ICANN registrable apex (bare-domain A, else www), joined by name across endpoints — 110,753,314 surviving domains, of which 196,405 DNS-filter artifacts were quarantined. Addresses classified by BGP origin AS via an empirical 5.16M-prefix /24→ASN map derived from this project's IP-to-ASN dataset, with 68 ASNs grouped into named providers and 60 high-concentration front-door IPs individually verified by HTTP probe, nameserver, and reverse-DNS evidence; one fixed rule applied to both endpoints. Death rates use the survival study's any-hostname aliveness against the full June 2026 crawl (±2-point live-DNS error bound). Geography is the geoIP country embedded in each endpoint crawl, with un-geolocated anycast reported as its own category and the same-IP drift share disclosed. Russian-administered TLDs excluded throughout. External triangulation: Google Domains→Squarespace transition (support.google.com), IONOS Group brand structure, AWS Global Accelerator BYOIP documentation, Verisign DNIB renewal rates. Companion posts: Where the Web Lives (stocks), The Half-Life of a Domain (deaths), this post (flows). Explore the dataset at /dataset and per-TLD statistics at /stats/.