Cloudflare exits, a mystery AS shuffle, and Intuit's stray "test" TXT

Out of roughly 17.1 million tracked domains, DNS watchers logged 13,364 changes and 179,052 freshly-seen domains in the last 24 hours. Most of it is routine SPF tweaks and nameserver churn, but a few patterns stood out.

Leaving the orange cloud

Two sites dropped off Cloudflare entirely today. www.tatvanetworks.com had its Cloudflare CDN nameservers, Google Workspace MX records, and SPF record all removed in one shot, landing on AS16509 (Amazon) with hosting flipping from Cloudflare's cdn class to "unknown" — the signature of a full teardown rather than a simple provider swap. Meanwhile www.yuugado.org also exited Cloudflare (AS13335 → AS30058) and picked up a CNAME to parkingpage.namecheap.com, which reads like a domain that's been let go and is now just parked.

A same-day AS30058 → AS16276 shuffle

A handful of unrelated-looking domains — www.swannanoanc.com, www.brewfather.org, www.indsoft.store, and lealalmeida.studio (plus its www) — all moved from AS30058 to AS16276 within minutes of each other. Different domains, different topics, same origin and destination ASN on the same day is usually the fingerprint of a shared hosting or reseller platform migrating its customer base behind the scenes rather than four owners independently deciding to move.

Parking service spring cleaning

Several parked-looking domains quietly lost their CAA issue letsencrypt.org records today, and a couple of them — www.arabholiday.com / arabholiday.com and www.biyogaz.com — also dropped ns1.parkingcrew.net / ns2.parkingcrew.net as their nameservers. babykaarten.nl lost its CAA record too. Pulling a CAA record generally means "we're no longer planning to issue TLS certs here," which tracks with domains sliding into parked/inactive status rather than active hosting.

And one for the "huh" file

Amid all that, intuit.com — sitting on Akamai — picked up a new TXT record whose value is simply test. Harmless, almost certainly an internal verification step, but a nice reminder that even Fortune 500 DNS zones get the occasional stray scratch note left in production.

Smaller but tidy: nex.ai added a hubspot-developer-verification TXT record and flipped from "unknown" to "direct" hosting, while ntsmiamit.com (and its www) swapped nameservers from ns1/ns2.intodomain.net to a cp20.intodomain.net pair and widened its SPF record with an extra +ip4:23.111.178.102 — a small but classic hosting-panel-migration signature.