August 8, 2026

A shell-parking swap-a-thon and a curious CDN round-trip

Out of roughly 14.5 million tracked domains, we saw 13,414 changes and 373,272 new domains show up in this window. Most of the interesting stuff, as usual, is in the small pile of migrations and security tweaks rather than the raw volume.

Parking lot shuffle

A handful of domains changed hands between parking services today, which is basically the DNS equivalent of moving a "For Sale" sign:

  • www.adpp.com dropped its wadax-sv.jp nameservers for ns1.sedoparking.com/ns2.sedoparking.com, moved from AS47846 to AS131921, and tightened its SPF record down to a hard v=spf1 -all.
  • 21new.com did something similar — swapped GoDaddy's ns73/ns74.domaincontrol.com for ns1.afternic.com/ns2.afternic.com (Afternic being GoDaddy's domain marketplace), dropped its CAA and mail records, and landed on AS16509 (Amazon).
  • mydubaiestate.com left Spaceship's nameservers for ns1.namefind.com/ns2.namefind.com — another sign of a domain heading toward resale rather than active hosting.

Meanwhile xenithbot.com and hay16.com both jumped from ns1/ns2.magpiedns.com-style DNS (koaladns.com in one case) onto ns1.brainydns.com/ns2.brainydns.com, with both moving into AS43350 — looks like a coordinated re-platforming rather than coincidence.

Cloudflare's revolving door

www.11930.net dropped out of Cloudflare (AS209242) and landed on AS138995, flipping its hosting class from "cdn" to "unknown." Its near-twin www.18836.net did the exact opposite move in the same window — leaving AS138995 to land on Cloudflare's AS209242. Same numbers, opposite directions, on domains with suspiciously similar names — a good reminder that "moved to/from Cloudflare" isn't always a big strategic shift; sometimes it's just infrastructure reshuffling behind the scenes.

Locking things down (and not)

  • 000free.us had its parking nameservers (ns1/ns2.parkingcrew.net), SOA, and Let's Encrypt CAA record all pulled — a domain going quiet.
  • nipcams.com and its www counterpart moved off parkingcrew.net onto mid8.ns1.sslparking.com/mid8.ns2.sslparking.com, swapped ASNs from AS206834 to AS24940, and rebuilt their SPF record with new IPs (78.46.152.77, 78.46.5.205) alongside a fresh domain-verification TXT.
  • www.rephraseai.com added a broad CAA policy allowing GlobalSign, Let's Encrypt, Google Trust Services, and Sectigo to issue certs, while dropping NameBright's nameservers — a sensible tightening step for a domain that's clearly still active.

One to watch

0906.net swapped GoDaddy's pdns05/06.domaincontrol.com for a six-server setup spanning ClouDNS (pns51-54.cloudns.net) and rcode0 (sec1.rcode0.eu, sec2.rcode0.net) — a heavier, multi-provider DNS setup that suggests someone is engineering for resilience rather than just changing registrars.