A Parking Lot Exodus and a Credit Union's CAA Wobble

Out of 16,134 DNS changes tracked across 20.3 million domains in the last 24 hours, one pattern stood out: a synchronized migration of parked domains, all leaving the same network within minutes of each other.

The AS30058 → AS16276 shuffle

Four domains — www.botzero.org, botzero.org, www.jotec.co.uk, jotec.co.uk, www.wowdeals.site, wowdeals.site, and www.adairathleisurewear.site — all moved off AS30058 and landed on AS16276 within about 20 minutes of each other. The .org and .co.uk pairs tell a clear story: they dropped Namecheap's parkingpage.namecheap.com CNAME and the dns1/dns2.registrar-servers.com nameservers, along with their eforward MX records and SPF include for spf.efwd.registrar-servers.com, and picked up ns1.lander.d.parity.domains / ns2.lander.d.parity.domains instead. That's a parking-page provider swap, not a real "site" moving — but seeing several unrelated domains do the exact same NS/MX/network change back-to-back suggests a registrar or reseller batch-migrated a chunk of its parked portfolio to a new landing-page platform.

A quieter, more official move

Not every migration was park-to-park. pastoreturismo.com.br swapped out dns1-4.nowebdns.com.br for ns1-4.bdm.microsoftonline.com — a straightforward sign of a business onboarding to Microsoft 365 / Entra for its mail and domain verification (its TXT records now carry an mscid= value alongside the existing Google site-verification token).

Security odds and ends

A few CAA changes are worth a raised eyebrow:

• www.123x.ai (fronted by Fastly) had its entire CAA record set removed — certainly.com, digicert.com, letsencrypt.org, and sectigo.com issuers all dropped in one shot, meaning the domain currently has no CAA-based restriction on who can issue certificates for it.
• www.cdfcu.org, a credit union domain, went through a brief detour: it had picked up ns1/ns2.parkingcrew.net and a Let's Encrypt CAA entry, then swapped again to mid8.ns1.sslparking.com / mid8.ns2.sslparking.com, dropped the Let's Encrypt CAA line entirely, and updated its SPF to explicit ip4:78.46.152.77 / ip4:78.46.5.205 ranges. Bouncing a financial-institution domain through parking-style nameservers, even briefly, is the kind of thing worth double-checking with the registrant.
• Meanwhile www.zaehneknirschen.com, skagitcounty.blog, www.dxq.fr/dxq.fr, and www.beeload.com/beeload.com all picked up fresh Let's Encrypt CAA entries alongside a shift to ns1/ns2.parkingcrew.net and mail.h-email.net MX records — another small cluster suggesting a shared parking/redirect service rolling out CAA hygiene by default.

In brief

Also spotted: www.dowm8.top moved fully onto Cloudflare (AS13335, CDN class), uch.edu swapped one UCHealth-managed nameserver (a-info-dmz.uchealth.org → h-info-dmz.uchealth.org), and ckdfoods.com dropped its nanohosting.in nameservers for a new SPF record listing five bare IPs — worth a look if you're the one running that mail server.