September 18, 2026

A domain gets suspended, and a parking pattern hiding in SPF records

Out of roughly 59,541 changes we saw across the ~27 million domains we track today, most are the usual churn — new TXT verification tokens, NS swaps, SPF tweaks. But a few stood out enough to dig into.

A Cloudflare site gets pulled by its own host

htl-management.com was sitting behind Cloudflare with a fairly locked-down CAA policy (only Comodo, DigiCert, GlobalSign, Let's Encrypt, Google Trust, Sectigo and SSL.com allowed to issue certs). Sometime in this window all of that got ripped out: the Cloudflare nameservers were replaced with ns1.dns-suspended.com and ns2.dns-suspended.com, and a new TXT record now reads plainly: "This domain is suspended by Hostinger!" Whatever the site was doing, its registrar/host has stepped in and killed it at the DNS level — a clean example of what a hosting-provider suspension actually looks like on the wire.

Migrations worth noting

  • www.elana.academy swapped GoDaddy nameservers for Vercel's (ns1.vercel-dns-3.com etc.), added a CNAME to cname.vercel-dns.com, and picked up a fresh CAA policy covering GlobalSign, Let's Encrypt, Google Trust, and Sectigo — a textbook "moving the site onto Vercel" migration.
  • schematicelectricllc.com left 1&1/WebsiteWelcome (AS31898) for IONOS's ui-dns nameservers (AS398101), with MX records following from 1and1.com to ionos.com — basically 1&1 rebranding itself under the hood as IONOS.
  • hooshgraam.ir dropped its MihanWebHost nameservers for ArvanCloud's c.ns.arvancdn.ir / t.ns.arvancdn.ir, moving from AS204213 to AS205585 — a common pattern for Iranian sites shifting onto ArvanCloud's CDN/DNS.

A recurring fingerprint on parked domains

Two unrelated-looking domains, audball.com and zumaca.com, both ended up with the exact same distinctive SPF record: v=spf1 ip6:fd1b:212c:a5f9::/48 -all. That's a private/ULA IPv6 range being used purely as a lockdown SPF — the kind of boilerplate a parking or registrar-hold service stamps onto domains once they've lapsed. zumaca.com also picked up ns1.parkingcrew.net and MX to mail.h-email.net, confirming the parking-service pattern. Meanwhile lovingpawsdogcare.com shows a similar shape: NS moved to ns1.ns306.parklogic.com, MX to mail.eye-mail.net, and its old SPF (with a Brazilian include and mailbaby.net) replaced by a locked-down IPv6-only record. If you're monitoring expiring domains, that SPF signature is a handy tell that a name just got swept into a parking pipeline.

That's the window — mostly quiet, with one clean suspension and a couple of tidy provider hops.