A Skyscanner Lookalike, Two Shopify Exits, and a .edu Migration

Only 18,806 changes rippled across the ~20 million domains we track today — a quiet window, but a few stories stood out.

A Skyscanner-shaped mystery

skyscanner-booking.com swapped one full set of Route53 nameservers for another (ns-1333.awsdns-38.org and friends out, ns-1354.awsdns-41.org and friends in), while its hosting classification flipped from unknown to direct. It's still parked squarely on AWS infrastructure — nothing scandalous in the DNS itself — but a domain name riffing on a major travel brand rotating AWS delegation sets is exactly the kind of thing worth a second glance if you're doing brand-protection monitoring.

Winecellarspec.com leaves Microsoft 365 behind

Both winecellarspec.com and its www twin made a clean, multi-record jump: nameservers moved from ns11.websitewelcome.com/ns12.websitewelcome.com to GoDaddy's ns25.domaincontrol.com/ns26.domaincontrol.com, the network shifted from AS31898 onto Cloudflare's AS209242, and the MX record pointing at winecellarspec-com.mail.protection.outlook.com (along with its matching Outlook SPF include) disappeared entirely. That's a textbook "moving off Microsoft 365 email and onto Cloudflare-fronted GoDaddy DNS" migration — mail and hosting changing in the same breath.

Park University swaps Pantheon for more.net

park.edu (running on Fastly) dropped its CNAME to live-park.pantheonsite.io and pointed it straight at park.edu, while nameservers ns1.more.net/ns2.more.net were added — that's the Missouri Research and Education Network, a common choice for .edu institutions. The change came bundled with new MX records into park-edu.mail.protection.outlook.com and a pile of fresh verification TXT records (Zoom, Google, Apple), suggesting a broader platform consolidation rather than a simple DNS tweak.

Two Shopify stores quietly exit

www.lactaglow.com and www.vinzi.in both dropped their shops.myshopify.com CNAMEs and, notably, lost every CAA record they had (DigiCert, GlobalSign, Let's Encrypt, pki.goog, ssl.com all removed). Both also moved off Shopify's AS13335 — lactaglow.com landed on AS22612/AS49981, vinzi.in on AS16509, the latter re-pointing its CNAME to domain.zepio.io. Losing CAA restrictions right as a domain leaves a CDN isn't inherently malicious, but it does mean the certificate issuance guardrails those sites had are gone until someone sets new ones — worth flagging if you're tracking e-commerce migrations.

Small oddity: an ENS record in the wild

0001vip.com picked up fresh CAA entries for Let's Encrypt and ZeroSSL, plus a TXT record reading ENS1 dnsname.ens.eth tied to an Ethereum address — a reminder that Ethereum Name Service bridges are increasingly showing up as plain TXT records inside traditional DNS.