AWS's ASN Shuffle, a Cloudflare Onboarding Spree, and a Sale Cluster

Out of roughly 9.5 million tracked domains, today's window logged 8,791 changes and 645,744 newly-seen domains. Most of the interesting stuff, as usual, is in the small pile of DNS record and network changes — here's what caught my eye.

AWS's game of musical ASNs

A little cluster of numbered .us domains — 01090.us, 07052.us, 02718.us, 21833.us, and 23315.us — all shuffled between AS16509 and AS14618, two Amazon-operated ASNs. The moves went in both directions (some AS16509 → AS14618, others AS14618 → AS16509), which reads less like a migration and more like automated rebalancing across Amazon-side infrastructure for what's likely a bulk-owned domain portfolio. 23315.us also lost its parkco2.neustar.biz nameservers and its v=spf1 -all TXT record in the same breath — a parked domain getting reshuffled, not resurrected.

Two sites land on Cloudflare, one flips off

tbsins.net swapped four locallinux.com nameservers for Cloudflare's rihana.ns.cloudflare.com and vern.ns.cloudflare.com, landing squarely on AS13335 with hosting: unknown → Cloudflare (cdn). nos89.org did almost the same move, dropping Spaceship's nameservers (launch1.spaceship.net, launch2.spaceship.net) and its Spaceship SPF include for Cloudflare's NS pair — a clean "leaving the registrar's default DNS for Cloudflare" story.

Meanwhile 79972.villas had a split personality: www.79972.villas moved onto Cloudflare (AS152194 → Cloudflare AS209242), while the bare apex 79972.villas moved the opposite direction, off Cloudflare and back to AS152194 — a reminder that www and apex records don't always travel together.

A cluster of domains dressed for sale

Four unrelated-looking domains — sititaly.com, invoai.com, bevelly.com, and ipcheap.com — all picked up the identical fingerprint within hours of each other: new nameservers ns1.domain.group / ns2.domain.group, a fresh CAA set covering buypass.com, harica.gr, letsencrypt.org, pki.goog, and sectigo.com, and a TXT record reading afternic-verification-iLzyovYXKJCYLcmj8rbffY. That verification string ties back to Afternic, the domain marketplace — a strong signal these four are being staged for sale under the same broker setup.

A CAA wipe worth a second look

cteops.com had its entire CAA record set removed in one shot — every issue/issuewild rule for Comodo, DigiCert, Let's Encrypt, Google Trust Services, and SSL.com, plus its iodef contact. CAA records exist specifically to restrict who's allowed to issue TLS certs for a domain; wiping them all doesn't break anything by itself, but it does mean the domain is (temporarily, at least) back to "anyone can issue" — worth a check-in if you run that zone.