August 21, 2026

A domain leaves Squadhelp, two more get expiration stamps

Out of roughly 19.7 million tracked domains, about 36,700 changed something in their DNS over the last 24 hours — here are the ones worth a second look.

A domain sale in progress?

praxis.app swapped away from ns1.squadhelp.com / ns2.squadhelp.com — the naming/brand-marketplace nameservers — and landed on Porkbun's (curitiba.ns.porkbun.com and friends), moving from AS14618 to AS16509. Its www record now CNAMEs to pixie.porkbun.com. That combo — leaving a domain-marketplace NS for a registrar's own DNS — usually means a sale just closed and the new owner is standing up their own setup.

Similarly, howloan.xyz (and its www) dropped ns5.afternic.com / ns6.afternic.com — GoDaddy's Afternic parking/sales network — along with its old MX and a v=spf1 -all record, while hopping from AS16509 to AS7506. Another domain likely just walked out of the for-sale bin.

Expiration watch

Two domains got the unmistakable "this lapsed" treatment today. 20220119.xyz picked up a CNAME to domainexpired.domain-expired.com and swapped its DNSPod nameservers for expire01.dnspod.net / expire02.dnspod.net. Meanwhile 66363709.com lost its Cloudflare nameservers (emerson.ns.cloudflare.com, nena.ns.cloudflare.com) in favor of expire1.gname-dns.com / expire2.gname-dns.com, and shed its Google MX records and site-verification TXT in the process — a clean signal that whatever was running there (mail, verification, the works) is now dark.

A CAA cleanup on the way out of Vercel

nexsum.org is the standout security-relevant change: it removed CAA records authorizing GlobalSign, Let's Encrypt, pki.goog, and Sectigo, dropped its Vercel CNAME and all four vercel-dns-3.com nameservers, and switched to GoDaddy's ns43.domaincontrol.com / ns44.domaincontrol.com. It also picked up a Zoho mail-verification TXT and a new DMARC-adjacent SPF include pointing at its own subdomain. Add it up: this looks like a full migration off Vercel onto GoDaddy-hosted DNS with Zoho for mail — worth remembering that a wiped CAA list briefly means any CA can issue for the domain until new records are set.

Quick hits

  • www.gen0u.top moved from AS174 straight onto Cloudflare, flipping its hosting classification from unknown to Cloudflare CDN.
  • www.junko-box.com did the opposite trip — off Cloudflare and onto Above.com's parking infrastructure (park-mx.above.com, ns1.abovedomains.com), suggesting the domain just lapsed into parked status.
  • syup.net lost its DNSPod nameservers and SOA entirely, hopping from AS4811 to AS17621 — a domain in transition with no new home fully configured yet.