September 24, 2026

A Shopify exodus, a mystery cloud shuffle, and CAA cleanup

Roughly 80,727 changes rippled across the ~30 million domains we track in the last 24 hours, with about 650,000 new domains showing up in the window. Most of it is routine churn, but a few stood out.

multcloud.link quietly logs off Cloudflare

Both multcloud.link and www.multcloud.link pulled their Cloudflare nameservers (cortney.ns.cloudflare.com, dale.ns.cloudflare.com) and swapped in ns1.lander.d.parity.domains / ns2.lander.d.parity.domains. The whole mail stack went with it — all six of the registrar-servers.com forwarding MX records and the SPF include were removed — and the network moved from Cloudflare's AS13335 to AS22612/AS49981. That combination (parity.domains "lander" nameservers + a wiped mail setup) is the classic fingerprint of a domain landing on a parking/for-sale page after changing hands or lapsing.

Two storefronts leave Shopify, in opposite directions

www.zuriaccessories.com dropped its CNAME to shops.myshopify.com and its Shopify-issued CAA records (digicert.com, globalsign.com, letsencrypt.org, pki.goog, ssl.com), landing on Cloudflare instead — still a CDN setup, just no longer Shopify's.

www.beausandbellesboutique.com made a similar break: the myshopify.com CNAME was swapped for a self-referencing CNAME, nameservers moved to GoDaddy's ns49/ns50.domaincontrol.com, the Shopify CAA records vanished, and a fresh facebook-domain-verification TXT appeared. Network-wise it moved off Shopify's AS13335 to AS16509. Two merchants, two different next stops, same starting point.

CDN reshuffling

www.pinterest.com.pe switched CDNs outright, moving from Fastly (AS54113) to Akamai (AS16625) — hosting class stayed "cdn" the whole time, just a different one. Meanwhile eurabota.com shifted from CDN77 to BunnyCDN, though interestingly kept AS60068 and AS212238 in its network mix alongside the new AS200325 — a hint these two CDNs may share underlying infrastructure.

A cluster of CAA and nameserver cleanups

Several domains lost their Let's Encrypt CAA records in the same window they changed nameservers or registrars — worth flagging since a missing CAA record technically reopens the door to certs from any CA:

  • kompas69.org removed its letsencrypt.org CAA entry, dropped its MX record, and moved from ns1/ns2.ultahostjangkrik.online to dnsowl.com nameservers, with its network hopping from AS174 to AS47846.
  • bidlance.com lost its letsencrypt.org CAA record while moving off parkingcrew.net nameservers onto sslparking.com — a parking-to-parking handoff.
  • egyptpos.com shed a whole set of CAA entries (including a Google pki.goog one) alongside its nameshift.com nameservers, moving to ns1/ns2.atom.com and AS14618.

None of these look malicious on their own, but if you manage a domain and see your CAA records disappear unexpectedly, it's worth double-checking who's issuing certificates for you next.