August 6, 2026

A Dangling CNAME, an Expired Shopify Store, and a Bank's New DNS

Out of roughly 15,170 DNS changes tracked across 13.5 million domains in the last 24 hours (plus 432,235 brand-new domains showing up for the first time), a few stood out for reasons beyond routine hosting churn.

A GitHub Pages CNAME gets a new life

www.avedok.ng used to point at davidsonezeala-del.github.io via CNAME — a classic personal GitHub Pages setup. In this window that CNAME was removed and replaced with a self-referencing record, the site moved from GitHub Pages onto Fastly (AS54113 → AS54113/AS397423), and a full set of CAA records (digicert.com, letsencrypt.org, sectigo.com, plus wildcard variants) were stripped out entirely. New NS records point to ns73/ns74.qservers.net and qserverscloud.com, a fresh MX to 36.qservers.net, and a new SPF record permitting 165.140.85.163. That's the fingerprint of an abandoned GitHub Pages hostname getting picked up and repointed to a completely different owner's infrastructure — a good reminder of why dangling CNAMEs to services like GitHub Pages are a known takeover vector.

An "expired" domain says so, in plain text

www.henaax.com dropped its Shopify CNAME (shops.myshopify.com) along with a stack of CAA records, and moved off Shopify's network (AS13335) onto AS47583. Its new TXT record doesn't leave much ambiguity: This domain is expired at Hostinger! — about as clear a status message as DNS ever gives you.

A bank's nameservers and SPF sender both change

karnabank.com and its www subdomain swapped nameservers from ns1/ns2.storyhost.xyz to a viphost-dns.com cluster (cns1–cns4), moved networks (AS48147 → AS216054), and updated their SPF record's permitted sending IP from 89.42.137.122 to 185.235.196.13. Nameserver and SPF-sender changes together on a financial-sounding domain are worth a second look — could be a legitimate infrastructure migration, or worth double-checking if you rely on this domain for anything.

Quick hits

  • zelim.com picked up CDN77 (AS60068) after previously sitting on AS212238 with no identified hosting provider.
  • dialpad.com added a google-site-verification TXT record, suggesting a new Google Workspace or Search Console tie-in.
  • www.ccdesignstudio.com had a large batch of records cleared — Google Workspace MX, Stripe and Google site-verification TXTs, CAA entries — while shifting its network footprint toward Cloudflare (AS13335), the kind of wholesale reset you'd see during a re-platforming.
  • www.razon.dev and www.queue-0.com both added fresh CNAMEs to vercel-dns-017.com with matching CAA records for Let's Encrypt, Sectigo, GlobalSign, and Google Trust Services — standard Vercel onboarding.