A Parking Lot Shuffle and Two Big Names Verify Themselves

Out of roughly 16 million tracked domains, today's window logged 32,109 changes and 548,016 freshly-seen domains. Most of the interesting stuff, as usual, is in the boring-looking infrastructure churn — parked domains getting shuffled between networks and a couple of big brands quietly adding verification records.

The AS30058 → AS16276 exodus

A cluster of unrelated-looking domains — atikahmed.online, refundagency.biz, funkiash.casa, ubit.co.in, blogjacklang.net, and twisp.ai — all flipped from AS30058 to AS16276 within the same few minutes. The clearest clue about what's going on sits in kidtocode.com: its nameservers swapped from registrar-servers.com forwarding to ns1.lander.d.parity.domains / ns2.lander.d.parity.domains, and its MX/SPF records tied to registrar email-forwarding disappeared entirely. That's a parking-page landing infrastructure move, and it looks like a batch of expired or up-for-sale domains got relocated onto the new parking network en masse.

Parking networks swapping tenants

Separately, rbrwt.com and a-bola.com both jumped from AS133618 to AS206834, dropping their ns1.abovedomains.com / ns2.abovedomains.com nameservers for ns1.parkingcrew.net / ns2.parkingcrew.net, swapping their parked MX from park-mx.above.com to mail.h-email.net, and each picking up a fresh CAA: 0 issue letsencrypt.org record. Same playbook, same timestamp pattern — a parking provider migration, not a coincidence.

A matching pair of hosting moves

chillyapparels.com and sudharmaknits.com — two seemingly unconnected sites — made the identical move at nearly the same moment: nameservers switched from ns1.linuxbox.info/ns2.linuxbox.info to ns1.linux555.com/ns2.linux555.com, network hopped from AS32244 to AS31898, and both SPF records grew an extra IP (ip4:66.116.238.74) alongside the old 67.225.161.150. Whoever runs the shared hosting behind these two clearly migrated their whole book of business at once.

Big names, small verification records

Not everything today was parking-lot noise. att.com added a twilio-domain-verification TXT record, and cnn.com (still fronted by Fastly) added five separate stripe-verification TXT entries in one go — the kind of housekeeping that usually means a new payment or messaging integration is being stood up behind the scenes.

Also worth a nod: leofoodslk.com left Vercel entirely, dropping its cname.vercel-dns.com CNAME and all four of its CAA entries (GlobalSign, Let's Encrypt, Google Trust Services, Sectigo) as its nameservers moved to the same parity.domains lander infrastructure showing up elsewhere in today's data — another domain apparently rolling off active hosting and into parking.