September 20, 2026

Kuwait's MOI Goes Third-Party, and Equifax's Fingerprints Show Up in DNS

Out of roughly 60,690 changes tracked across the last day (against ~28 million domains being watched), a few stood out from the noise of routine renewals and TTL churn.

A ministry hands off its nameservers

moi.gov.kw — Kuwait's Ministry of Interior — dropped its own ns1.moi.gov.kw / ns2.moi.gov.kw in favor of access.kuwait.net, gulfa.kuwait.net, pr.wimd.com.kw, and sd.wimd.com.kw, and now shows up fronted by Sucuri. Self-hosted-to-outsourced NS swaps on government domains are always worth a second look — it usually means centralizing DNS management or adding a layer of DDoS/security tooling in front of a high-value target.

Equifax's infrastructure peeking through

lawlogix.com and www.lawlogix.com quietly picked up two new NS records: gcpbloxgrid01-us-east4-b-gm-ext.mgt.equifax.com and ibloxgrid11.equifax.com. LawLogix is an Equifax-owned immigration-compliance product, so this looks like internal infrastructure consolidation rather than anything alarming — but it's a nice reminder that DNS records often leak which corporate parent actually runs a brand you didn't know was owned by a credit bureau.

Escaping the parking lot

hostingelephants.com and its www counterpart left parkingcrew.net nameservers behind, swapping in ns1.namepros-dns.com and a companion NS, moving network from AS206834 to AS16509. Along with the NS change it dropped its old CAA/SPF/MX records — classic signs of a domain sale or aftermarket transfer via a domain forum/broker rather than a live hosting migration.

A mini Vercel wave

Three unrelated domains landed on Vercel infrastructure in this window:

  • www.flavorshack.net added ns1.vercel-dns.com / ns2.vercel-dns.com and stripped a long list of CAA issuers down.
  • www.goryboy.com added the same Vercel nameservers, dropped its univer.se CNAME, and switched mail to Google's aspmx.l.google.com cluster — while shedding a pile of old verification TXT records (Ahrefs, Atlassian, OpenAI, Stripe, Webflow) that suggest a full stack teardown.
  • www.asblink.net swapped a CNAME to 5a408ea8ecf4aaf9.vercel-dns-017.com, moved off fivedns.com nameservers, and jumped network from AS174 to AS16509.

Three isn't a trend, but it's a tidy little cluster of sites converging on the same platform in one day.

Flapping in the background

A handful of domains couldn't settle down: gallerycarre.com and www.adeas.nl each logged 5 changes in the window, with lazydeveloper.net and townncountry.com close behind at 4 — worth a look if you're monitoring those zones, since rapid flips like this often point to load-balancer failover, DNS provider migrations mid-flight, or misconfigured automation.