September 7, 2026

Amazon.in gets an Akamai label, and a StackPath customer swap

Out of 31,983 changes across roughly 23.6 million tracked domains in the last 24 hours, most of the action was the usual churn — nameserver swaps, SPF tweaks, park-and-flip domains. But a few stood out.

Amazon.in picks up an Akamai badge

www.amazon.in didn't actually move — its network footprint stayed on the same ASNs (AS16509, AS16625, AS20940) — but our hosting classification flipped from "unknown" to "Akamai (cdn)" on those same ASNs. It's a reminder that not every DNS change is a migration; sometimes it's just better fingerprinting catching up to how a domain has been routed all along.

A StackPath game of musical chairs

Two hostnames on the same AS62370 traded places within seconds of each other: nmd-api.com left StackPath (AS12989) and landed on AS62370, while nalera-tracking-dns.com did the reverse, moving off AS62370 and onto StackPath. Same timestamp window, opposite directions — looks like a single operator reshuffling which of their domains fronts through StackPath's CDN.

Parking lot traffic

A handful of domains changed which parking network is holding their leash:

  • fitnessthailand.com and lolipa.com both dropped Afternic nameservers (ns1.afternic.com) for Above.com's parking stack (ns1.abovedomains.com, MX park-mx.above.com), landing on AS133618.
  • blackbizlist.net and myrarity.com both lost their letsencrypt.org CAA records, dropped mail.h-email.net as MX, and walked away from ns1.parkingcrew.net — a sign these domains are being repointed to new parking or resale setups.
  • aurea.beauty did a full teardown of its Shopify presence: the CNAME to shops.myshopify.com is gone, all five CAA issuers (DigiCert, GlobalSign, Let's Encrypt, Google Trust Services, SSL.com) were removed, and it's now sitting on ns1.lander.d.parity.domains — a shop that's closed and been handed to a landing-page network.

One to watch

www.ome0q.top sits behind Cloudflare but its CNAME target flipped from hdfskjds.hiidm063fsbi.com to gdgsdlkwy.go5kvsiay5wx.com — two randomly-generated hostnames pointing at the same CDN edge. That kind of rotating, gibberish CNAME chain fronted by a major CDN is a pattern worth keeping an eye on, whatever's actually behind it.