August 14, 2026

A Mystery Mass Exit from AS30058, and a Parking-Lot Shuffle

Ten thousand-ish DNS changes rolled through in the last 24 hours, and buried in the noise is a fun little mystery: a cluster of completely unrelated domains all jumped off the same network within minutes of each other.

Eight domains, one exit door

Between 13:22 and 13:59 UTC, www.eastlondonlocksmith.org, www.lowcaloriehighproteinsnack.com, www.seoyoda.com, tentt.dev (and www.tentt.dev), www.asymbolic.org, www.chariot.is, www.hyphenate.fun, and www.dino.best all recorded the exact same network change: AS30058 → AS16276. Different registrars, different niches (a locksmith, a snack blog, an SEO tool, a couple of personal dev sites), same origin AS, same destination AS, same tight window. That pattern — many unrelated domains changing ASN together — usually means one hosting reseller or platform quietly moved its whole customer base to new infrastructure behind the scenes. None of these sites' owners likely touched a DNS setting themselves.

Parking lot shuffle

A few domains spent the day walking in or out of parking:

  • tophill.biz dropped its SPF record, dropped its freelancemw.com nameservers, and picked up ns1/ns2.lander.d.parity.domains — a landing-page parking setup — while hopping from AS14555 to AS22612.
  • redinoxsolutions.com did the reverse: it left Above.com parking (park-mx.above.com, ns1/ns2.abovedomains.com) for real infrastructure on Porkbun nameservers, with a fresh SPF record now including _spf.google.com — a sign it's about to start sending real mail.
  • odperfumes.com went the other way, losing its Google-verification TXT records and its own nameservers in favor of park-mx.above.com and ns1/ns2.abovedomains.com — looks like it just got parked.
  • Oddly symmetric: nickv.fr added a Let's Encrypt CAA record and an mail.h-email.net MX while dropping parkingcrew.net nameservers — coming out of parking — at almost the same time sm.to did the exact opposite, shedding that same CAA record and the same mail.h-email.net MX. Same fingerprint, opposite directions, worth watching if you track either domain.
  • marsh360.xyz had its Afternic parking nameservers (ns5/ns6.afternic.com) and SPF stripped entirely, alongside a network move from AS16509 to AS7506 — a domain that just lapsed out of a marketplace listing.

Notable one-offs

  • reading.gov.uk picked up a Sectigo wildcard-issue CAA record and flipped from "unknown" to directly-hosted — a UK council tightening up who can issue certs for it.
  • axis.properties swapped nameservers from marketing-strategic.com to a mix including four Hurricane Electric servers (ns2–ns5.he.net) and added a Let's Encrypt CAA policy, moving from AS9009 to AS60439.
  • hiwebenterprise.com left a Hostinger CDN CNAME for a Vercel one (*.vercel-dns-017.com), adding CAA entries for GlobalSign, Let's Encrypt, Google Trust Services, and Sectigo all at once — a proper platform migration with the cert policy updated to match.