August 29, 2026

Parking meters expire, and a Shopify store goes solo

Out of roughly 21.2 million tracked domains, today's window logged 16,960 changes and 204,677 brand-new domains. Most of the churn is routine — SOA refreshes, SPF tweaks — but a few clusters stand out.

The parkingcrew.net cluster quietly packs up

Three unrelated-looking domains — nuxie.com, www.aceites10.com, and www.bvautogroup.com — all dropped their ns1.parkingcrew.net / ns2.parkingcrew.net nameservers within a few hours of each other, and all three also removed a CAA: 0 issue letsencrypt.org record at the same time. www.bvautogroup.com went further, picking up new nameservers (ns1.abovedomains.com, ns2.abovedomains.com), a new MX (park-mx.above.com), and a fresh network home in AS133618. That pattern — parking nameservers out, CAA gone, new mail routing in — looks like a batch of expired/lapsed domains getting recycled by a new parking or resale operator rather than any single migration.

A Shopify storefront cuts the cord

www.ezaffiro.de left Shopify's CDN entirely: its CNAME to shops.myshopify.com was replaced with a self-referencing ezaffiro.de, it picked up dns.home.pl / dns2.home.pl / dns3.home.pl as nameservers, added its own MX record, and moved networks from Shopify's Cloudflare-fronted AS13335 to AS12824. It also stripped five separate CAA issue records (DigiCert, GlobalSign, Let's Encrypt, Google Trust Services, SSL.com) that Shopify had set up — a clean break from managed e-commerce hosting to something self-run on a Polish registrar's infrastructure.

An identity swap on bag-bags.ru

bag-bags.ru had a near-total TXT record turnover: out went Facebook, Google, Pinterest, and Zoom domain-verification strings plus an old SPF record; in came Atlassian, Notion, and Slack verification strings and a brand-new SPF (v=spf1 ip4:130.17.2.6 mx ~all). Mail also switched from Mailgun/Yandex to mx.timeweb.ru and mx.zoho.com, and the CAA iodef contact flipped from admin@ to caa@. Worth a mention: the new CAA issuewild value shows up as empty (0 issuewild ;) — that's a malformed record that will likely block wildcard cert issuance until someone notices.

Also worth a glance

  • flowersforyou.org left Vercel's nameservers for a registrar's defaults, wiped three CAA issue records, and switched mail to Namecheap's Private Email (mx1/mx2.privateemail.com) — a full stack swap in one shot.
  • nationwideutilities.com, already on Cloudflare, simply added a CAA: issue pki.goog — a small, deliberate step toward allowing Google Trust Services to issue certs alongside whatever else is authorized.
  • zhqs.net dropped off Cloudflare and lost its agent31.juming.com CNAME along with its exp1/exp2.judns.com nameservers, landing in AS45102 — a signal that a domain-trading listing on the Juming marketplace just changed hands or got pulled.