July 21, 2026

A Cloudflare migration, a mystery TXT purge, and ASN musical chairs

Out of 2,938 changes tracked in the last 24 hours, one migration stood out for doing everything textbook-perfectly, while a pair of domains quietly nuked nearly every third-party integration they'd ever had.

A clean move onto Cloudflare

hassra.org.uk did a full-stack migration: nameservers swapped from ns1.netnames.net/ns2.netnames.net (and friends) to candy.ns.cloudflare.com and logan.ns.cloudflare.com, hosting flipped from unknown to Cloudflare (cdn), and the CAA record was rebuilt from a single-issuer Let's Encrypt policy to a much broader list (Comodo, DigiCert, Let's Encrypt, Google, SSL.com — wildcard included). The SPF record also picked up explicit ip4/ip6 fallbacks alongside the existing include: entries. That's a domain owner being genuinely careful about certificate issuance and mail authentication while switching providers — the kind of migration you want to see more of.

Two domains, one enormous TXT cleanup

www.1-800callatt.com and www.attla.info both had the exact same sprawling list of TXT records removed on the same day: Dynatrace site verifications, an MS token, a Tailscale auth string, Apple domain verification, Box, Canva, Censys, Cisco, Docker, Figma, Flexera, Formstack, HCP, MongoDB, OneTrust, Palo Alto Networks, Postman, SafeBreach, and four separate Smartsheet validations. That's a graveyard of old SaaS integrations being swept away in one shot — usually a sign of a domain being decommissioned, consolidated, or handed off to a new owner who's wiping the slate clean.

ASN musical chairs

A handful of domains spent the window bouncing between the same small set of networks:

  • byte-roxe.com jumped AS42237 → AS51852, while rikdom-bitrad.com and its www moved the opposite direction, landing on AS42237 and AS202412 respectively — same three ASNs, different directions.
  • www.hanmail.net, bns10.com, and www.next-income.com all moved AS38099 → AS7625 within a few hours of each other, while news1004.org made the reverse trip, AS7625 → AS38099.
  • www.romickwealth.com and www.maestro-associates.com migrated in lockstep, both AS7029 → AS13645, minutes apart — a strong signal they share infrastructure or an operator.

None of these flipped their hosting_class out of "unknown," so from the outside they look like backend shuffles rather than provider rebrands — but the synchronized timing is the interesting part.

Also worth a glance

  • mlb.com picked up a fresh SOA (new refresh/retry/expire/minimum timers: 21600/3600/259200/300) and got reclassified from unknown to direct hosting.
  • orange.pl added a new TXT ownership-verification token and also flipped to direct hosting.
  • www.grou.tech walked away from Shopify entirely — CNAME to shops.myshopify.com removed, nameservers swapped to ns1.lander.d.parity.domains/ns2.lander.d.parity.domains, network moved off Cloudflare/Shopify's AS13335 to AS30058. Looks like a storefront that's closing up shop, DNS-wise.