1&1 to Nowhere: A DNS Hijack Smell Test

Out of 25,371 changes tracked across the last 24 hours (and 260,790 freshly-registered domains), a few stood out for reasons ranging from "that's a migration" to "wait, why would you do that?"

The one that made us raise an eyebrow

scw.com swapped its nameservers from ns29.1and1.com / ns30.1and1.com (IONOS) to a set of four servers at ns.ui-global-dns.biz, .com, .de, and .org — while also adding fresh CAA records authorizing letsencrypt.org to issue certs. Generic, brand-new-looking nameserver names replacing a known registrar's infrastructure, paired with a CAA change that opens the door for a new CA, is exactly the pattern you'd watch closely if you owned this domain: either a legitimate provider switch, or someone quietly repointing DNS ahead of a cert grab. Worth a second look if you know this name.

Cloudflare: come and go

Cloudflare picked up topka.bg, which dropped its old lonex.com mail and nameservers in favor of Cloudflare's aaden.ns.cloudflare.com / eloise.ns.cloudflare.com — a clean CDN onboarding.

Going the other direction, medgeaccessories.com left Cloudflare (AS13335) entirely, landing on AS49981 with its MX records stripped and nameservers replaced by ns1.lander.d.parity.domains / ns2.lander.d.parity.domains — the signature of a domain being parked rather than actively hosted. www.caagex.com also exited Cloudflare for AS399629, dropping into "unknown" hosting.

Tightening — and loosening — the cert rules

medlineplus.gov added an extensive CAA record list, explicitly authorizing amazon.com, amazontrust.com, awstrust.com, digicert.com, entrust.net, and sectigo.com (plus wildcard equivalents) as the only CAs allowed to issue for the domain — solid hygiene for a U.S. government health site. sutd.edu.sg, sitting behind Imperva, added a CAA entry for amazon.com too.

Meanwhile shawnhillary.my went the opposite way: it lost its entire CAA policy (Comodo, DigiCert, Let's Encrypt, Google, SSL.com — all removed), dropped its Zoho MX records, and had its site-verification and SPF TXT records wiped. That's the DNS footprint of a domain being decommissioned or handed off, not hardened.

Domains heading for the parking lot

A handful of names got the classic "drop everything and park" treatment today. japanblox.com lost its mail server, its own nameservers, and its SPF record, landing on ns1.lander.d.parity.domains. aaaspaces.com and cinnaai.xyz both moved off Afternic's nameservers — one to Spaceship's launch1/2.spaceship.net, the other to dns1.onamae-expired.com / dns2.onamae-expired.com, a name that pretty much tells you the story: an expired registration entering its post-life parking phase.

Small stuff in the grand scheme of 20.5 million tracked domains, but each of these is a little signal of ownership changing hands, sites winding down, or someone tightening — or loosening — the screws on their DNS.