August 10, 2026

A Quiet Mass Migration, and Gazprombank Picks New CAs

Out of 23,489 changes tracked across roughly 15.5M domains in the last 24 hours (and 468,936 brand-new domains registered), one pattern stood out: a tight cluster of unrelated sites all landing in the same network within minutes of each other.

Everybody's moving to AS16276

Within about a ten-minute window, a batch of otherwise-unconnected domains — jasperlionsrodeo.com (and its www), www.gradnav.org, www.damacalbania.com, prepflow.app, fitmieux.com, www.nursa.courses, and www.mszuiderdam.com — all flipped their hosting from AS30058 over to AS16276. Same source ASN, same destination ASN, same tight timeframe, completely different domain names and topics (a rodeo, a grad-nav site, an Albanian real-estate brand, a fitness app...). That smell usually means one reseller or hosting panel is quietly reassigning a block of customer sites to new infrastructure — the kind of behind-the-scenes migration end users never notice unless something breaks.

CAA policy shakeups

Two CAA changes worth flagging today:

  • gazprombank.ru added CAA records restricting certificate issuance to emsign.com and harica.gr (including wildcard issuance for both). That's a deliberate lock-down to a specific pair of CAs — notably not the usual Let's Encrypt/DigiCert/Sectigo crowd.
  • www.csdecatur.net, sitting behind Cloudflare, went the other way and removed its CAA restrictions entirely — previously it had pinned issuance to Comodo, DigiCert, GoDaddy, Let's Encrypt, Google Trust Services, and SSL.com. Dropping that record opens the door to any public CA issuing for the domain going forward.

A Vercel departure

www.explodeai.pro pulled itself off Vercel entirely: its CNAME to cname.vercel-dns.com is gone, its ns1-4.vercel-dns-3.com nameservers were swapped for ns1/2.lander.d.parity.domains, and its CAA restrictions (GlobalSign, Let's Encrypt, Google Trust Services, Sectigo) disappeared along with it. The network flag flipped from Vercel/AS16509 to AS16276 and hosting class dropped to "unknown" — a pretty clean signature of a project being decommissioned and the domain landing on a parking/lander setup instead.

Small but telling

  • swada.pl and www.swada.pl dropped their parkingcrew.net nameservers and Let's Encrypt CAA record in the same breath — a domain likely coming off parking to be actually used.
  • agbukefas.com swapped ns1/2.brainydns.com for ns1/2.magpiedns.com while its neighbor alebiafricanrestaurant.com made the opposite move onto brainydns.com — nameserver musical chairs within what looks like the same small DNS operator ecosystem.