A Peace Group's Domain Lands in a Parking Lot

Out of roughly 46,983 changes tracked in the last day (across an estimated 27 million watched domains, with about 350,000 new registrations in the window), a few stand out from the noise. Here's what caught our eye.

A peace org's DNS quietly changes hands

united-for-peace.org and its www subdomain moved off AS63949 and onto AS201682, with nameservers swapping from ns1.ns306.parklogic.com / ns2.ns306.parklogic.com (a parking-service pattern) to ns1.dyna-ns.net / ns2.dyna-ns.net. Along the way it lost its mail.eye-mail.net MX record and its SPF TXT record. That combination — NS change plus dropped mail and SPF — usually means either a fresh start after expiry/park, or a full re-platforming of the domain's infrastructure. Worth watching if you're the mail admin there, since dropping SPF without adding a new one can hurt deliverability.

Shopify and BunnyCDN pick up new tenants

www.ottoibox.com swapped a generic CNAME (url.registry-server.com) for shops.myshopify.com and picked up Shopify's shared AS13335/AS35908 footprint — a clean signal of a storefront migrating onto Shopify. It also shed a long list of CAA records (DigiCert, GlobalSign, Let's Encrypt, pki.goog, ssl.com), which is expected when a new host takes over cert issuance policy.

Meanwhile www.historicdocumentsproject.com shifted hosting class from CDN77 to BunnyCDN while staying on the same ASNs (AS60068, AS200325, AS212238) — a reminder that "same ASN, different provider label" moves happen when platforms share network infrastructure.

And lymlyte.com left Spaceship's nameservers (launch1/launch2.spaceship.net) for Cloudflare's (emely.ns.cloudflare.com, michael.ns.cloudflare.com), landing on AS13335. Its SPF record was rewritten to a bare +a +mx +ip4:167.235.182.213 ~all, and it picked up a DKIM-style MX pointing at _dc-mx.648b8460c6a1.lymlyte.com.

CAA cleanup at a very big name

Even flipkart.com's www subdomain isn't immune to routine hygiene: it dropped CAA entries for digicert.com, globalsign.com, letsencrypt.org, and a GlobalSign wildcard rule. No hosting or NS change accompanied it — just a narrowing of which CAs are allowed to issue certs for the domain, which is generally a good security tightening move, not cause for alarm.

Small moves, matching pairs

A handful of domains swapped ASN pairs in what looks like coordinated infrastructure shuffling: keywestweddingmusic.com moved AS31898 → AS19871 while fitness-and-diet.com moved the opposite direction, AS19871 → AS31898, within the same window. Similarly, bayindustry.com and bec2020.com both jumped from AS14618 to AS16509 — Cloudflare's numbered space — suggesting a batch of sites migrating through the same hosting reseller.

Also flapping

gunkl.at recorded 4 changes in the window — the busiest single hostname we saw — worth a look if you're tracking that domain specifically.