July 24, 2026

Five Domains, Three ASNs: A Suspicious Hosting Shuffle

Out of 5,942 changes tracked in the last 24 hours, one pattern stood out for being weird rather than newsworthy: a handful of finance-flavored domains — avoirentor.com, www.kasvu-bitrow.com, www.profitina-fundcore.com, impulsion-tradevo.com, www.larg-profitarian.com, and larg-profitarian.com — all hopped networks within minutes of each other, bouncing between just three ASNs: AS51852, AS42237, and AS202412. Domain names like "profitina-fundcore" and "larg-profitarian" read like auto-generated shells for an affiliate or "trading" scheme, and this kind of rapid, synchronized ASN-hopping across a small pool of networks is a classic signature of throwaway or bulletproof-style hosting rotation rather than a normal infrastructure migration.

Big names quietly leaving Akamai

Two recognizable brands shed Akamai's CDN wrapper today:

  • neweggbusiness.com moved off Akamai (was on AS16625) to AS8075, and its CAA record swapped from amazon.com to pki.goog as the allowed cert issuer — a switch from Amazon-issued certs to Google Trust Services.
  • www.flipkart.com dropped its www.flipkart.com.edgekey.net CNAME (Akamai's edge alias) in favor of pointing straight at flipkart.com, while its network moved from "Akamai (AS9752, AS20940)" to those same ASNs now flagged as unknown hosting. Its CAA list also grew to include digicert.com, globalsign.com, and letsencrypt.org.

Neither looks like an outage — more like a CDN/cert-authority renegotiation behind the scenes — but it's a reminder that even flagship e-commerce domains reshuffle their edge infrastructure without fanfare.

Cert-issuance policy moves

  • bk.ru and www.bk.ru added CAA records authorizing pki.goog (Google Trust Services) to issue certificates — tightening down which CA can mint TLS certs for the domain.
  • subjectbuddy.com went the other way: it left Vercel (ns1/ns2.vercel-dns.com) for GoDaddy's ns41/ns42.domaincontrol.com, and in the process its CAA restrictions (Let's Encrypt, Google, Sectigo) and a brevo-code verification TXT were wiped out entirely — consistent with a domain being dropped from its app and re-parked.
  • mawlanarestaurant.ca left Cloudflare's CDN (AS13335) for AS26496, flipping its hosting classification from "Cloudflare (cdn)" to "unknown" — one less site behind Cloudflare's edge today.

Beeline's TXT spring cleaning

Russian telecom giant beeline.ru (and its www counterpart) did a serious TXT record cleanup — removing a pile of old verification strings (Miro, MS/Office, Google site-verification, an SPF record listing a dozen IP ranges) and replacing them all with a single new token, a2347c82-9361-48c0-ad98-535b5ecc9de7. Its hosting classification also flipped from unknown to direct. Nothing alarming, just a long-overdue tidy-up of accumulated third-party verification clutter.