Domains for sale, one domain wiped clean, and a move to Cloudflare

Out of about 8,872 changes spotted across 11.3 million tracked domains in the last 24 hours, a few tell genuinely interesting stories once you read between the record types.

Something is up with skip2.net

The most dramatic change of the window belongs to skip2.net, which had its entire DNS footprint stripped in one shot: every CAA record gone (Comodo, DigiCert, GlobalSign, Let's Encrypt, pki.goog, Sectigo, ssl.com — all removed), all six Google Workspace MX records removed, and TXT verification strings for AbuseIPDB, Canva, Google Site Verification, and a Webflow proxy record all wiped. That's the signature of a domain being fully decommissioned or handed off — mail routing, TLS issuance policy, and third-party verifications all pulled at once rather than tweaked.

Signs of domains changing hands

A few records point to domains heading to the aftermarket. auxh.com and www.auxh.com dropped their Spaceship nameservers (launch1.spaceship.net, launch2.spaceship.net) for ns1.sudos.co/ns2.sudos.co, moved from AS16509 to AS17378, and picked up an afternic-verification TXT record — a clear tell that it's now listed through Afternic's marketplace. aroa.ai shows the same pattern: new nameservers at ns1.domain.group/ns2.domain.group, a fresh afternic=afternic-verification TXT, and SPF locked down to v=spf1 -all (no mail should be coming from it).

Meanwhile padsp.com swapped its nameservers for ns1.lander.d.parity.domains and ns2.lander.d.parity.domains, shed its MX record and SPF, and moved from AS40676 to AS30058 — consistent with a domain being parked on a "for sale" landing page rather than actively hosting anything.

Migrations worth noting

hktechclub.com left Network Solutions' default nameservers (ns1.worldnic.com, ns2.worldnic.com) for Cloudflare's ruth.ns.cloudflare.com and skip.ns.cloudflare.com, flipping its hosting class from unknown straight to Cloudflare's CDN and moving networks to AS13335 — a textbook "sign up and switch" migration.

wavpark.com dropped Iran-based nameservers (ns3.irandns.com, ns4.irandns.com), updated its SPF IP, and got reclassified from unknown to direct hosting. And magiahotel.com lost its CNAME, MX, nameservers (db1.dobaydns.com, db2.dobaydns.com), and SPF record all together while jumping from AS206991 to AS34619 — another domain that looks like it's being torn down rather than tuned.