A Domain Dies, a CDN Swap, and a Mystery Move to AS49100

Out of 23.1 million tracked domains, 24,380 changed hands (DNS-wise) in the last 24 hours, alongside 312,681 brand-new registrations. Most of it is routine — but a few records tell real stories.

Watching a domain die in real time

apri2018.org gave us a textbook look at what happens after a domain lapses. Its nameservers flipped from dns1/dns2.namecheaphosting.com to expired1.namebrightdns.com / expired2.namebrightdns.com, the CNAME on www now points to expired.namebright.com, and the old Outlook MX/SPF records were stripped out entirely. The ASN hop from AS22612 to AS14618/AS16509 confirms it: this is the standard NameBright "your domain has expired" parking pattern, not a migration.

Tightening the locks

faintechsolutions.com had a genuine security glow-up. It moved its nameservers off nxthost.io and onto Cloudflare (dante.ns.cloudflare.com, karina.ns.cloudflare.com), then added a full CAA policy covering Comodo, DigiCert, Let's Encrypt, Google Trust Services, and SSL.com — including cansignhttpexchanges=yes for all of them. SPF got simplified too, dropping a handful of raw IPs in favor of include:_spf.google.com -all, suggesting a move to Google Workspace for mail.

nws.edu made a smaller but notable tweak: its CAA record swapped from allowing only digicert.com to allowing pki.goog, right as the domain's nameservers shifted to Cloudflare. Its Outlook-hosted MX record stayed put, just with the priority renumbered from 10 to 0.

CDN musical chairs

www.aerodecapage-var.com hopped CDNs, moving off BunnyCDN and onto CDN77 (picking up AS60068 in the process while keeping some shared ASNs). Meanwhile 78198.vip and its www counterpart went from an unclassified host on AS152194 straight onto Cloudflare's edge (AS209242) — a fresh "hosting: unknown → Cloudflare (cdn)" flip that's about as clean a CDN onboarding as you'll see in the logs.

Three strangers, one ASN

Here's a fun coincidence: 8ahan.com, mymaral.com, and berefood.com — three domains with nothing obviously in common — all left AS34918 or AS48147 and landed on AS49100 within the same window, each keeping its www and apex records in lockstep. Could be three unrelated customers on the same reseller platform, or one hosting provider consolidating client blocks onto a new AS. Either way, when unrelated domains converge on the same ASN like that, it's usually a sign of infrastructure consolidation happening one layer below the domains themselves.