A Domain Drops Cloudflare for Free Web Hosting

Across roughly 33 million tracked domains, our sensors logged 55,077 DNS changes and about 440,000 new domains in the last 24 hours. Most of it is routine — SPF tweaks, nameserver swaps — but a few records stand out.

Leaving the CDN safety net

enoxbd.live quietly stepped off Cloudflare. Its nameservers switched from gerald.ns.cloudflare.com / millie.ns.cloudflare.com to a cluster of free-hosting nameservers (ns1.byet.org, ns1.freehosting.digitalplat.org, and several siblings), and its network home moved from Cloudflare (AS13335) to AS34119 — hosting class flipping from "Cloudflare (cdn)" to "unknown." At the same time it added a CAA record listing nearly twenty certificate authorities (Let's Encrypt, DigiCert, Sectigo, GoDaddy, Google Trust Services, and more) rather than pinning down to one or two issuers. That's an unusually broad CA allowlist for a domain that just left a CDN for free hosting — the kind of combination worth keeping an eye on.

CDN comings and goings

Not every migration is a downgrade. dtneb.cn (and its www host) moved onto Cloudflare proper, swapping ns1.julydns.com / ns2.julydns.com for curt.ns.cloudflare.com / tori.ns.cloudflare.com and landing on AS13335.

Meanwhile dtfservice.com went the other way, leaving Imperva's CDN/WAF (AS19551) for AS46606 — hosting class dropping from "Imperva (cdn)" to "unknown." The change came bundled with new MailerLite verification TXT records and an SPF entry for mail.dtfservice.com, which reads more like a business re-platforming its email and hosting than anything malicious.

Flappers and a sad goodbye

gov.uk racked up 5 changes in the window — more flapping than you'd expect from a domain that critical, even if the specifics of each change didn't make our detail log. orpheuschoir.org.nz wasn't far behind with 3.

And in a bit of DNS irony, no-stalking.de lost its CAA records, its nameshift-branded nameservers, and its SPF policy, picking up a cname-112370.park-my-domain.net CNAME and jumping from AS20473 to AS24940 — all the hallmarks of a domain sliding toward a parking page rather than active hosting.