October 3, 2026

A CDN Swap, a Parking Lot Rush, and gov.uk Gets Jumpy

Out of roughly 53,848 changes spotted across the ~34 million domains who.is watches today, the most charming one is a two-for-one swap: hemea.com moved from BunnyCDN to CDN77, while franekeractueel.frl moved the opposite direction, from CDN77 to BunnyCDN, in the same window. Same two providers, same AS set (AS60068, AS200325, AS212238), opposite outcomes — a nice reminder that CDN migrations aren't a one-way ratchet toward any single winner.

Mail quietly changes hands

A few domains swapped out their mail stacks today:

  • nuos.edu.ua dropped the classic Google Workspace MX fan-out (aspmx.l.google.com and friends) in favor of the newer unified smtp.google.com record — Google's been consolidating legacy MX records like this.
  • nortec.net added nortec-net.mail.protection.outlook.com and an SPF entry for spf.protection.outlook.com, a textbook sign of a fresh Microsoft 365 onboarding.
  • negos.ru ditched its Russian registrar nameservers (dnsproxy1.fm.nic.ru, dnsproxy2.fm.nic.ru) for Cloudflare's (blair.ns.cloudflare.com, jasper.ns.cloudflare.com), and its network home flipped from AS48287 to Cloudflare's AS396982 — a full infrastructure exit, not just a DNS tweak.

Two domains head to the parking lot

generatorsecurity.com lost its Afternic nameservers in favor of ns1.abovedomains.com / ns2.abovedomains.com, picked up an Above.com parking MX (park-mx.above.com), and jumped from AS16509 to AS133618 — classic signs of a domain being actively monetized while it waits for a buyer. blmroofnrepair.com took a similar path, moving to ns1.dns-redirect.com / ns2.dns-redirect.com with new TXT records referencing redirhub.com and an Afternic verification string. Meanwhile virtualassistus.com had its nameservers and SOA stripped outright, along with its SPF and CAA records — that domain looks like it's simply going dark.

Certificate authorities getting pickier

CAA records — the ones that say "only these CAs may issue certs for me" — saw some action. davinhanif.com, sitting on Cloudflare, locked itself down to a full slate: comodoca.com, digicert.com, letsencrypt.org, pki.goog, and ssl.com, including wildcard and HTTPS-exchange permissions. www.giorgadze.art, on Fastly, added a shorter list (certainly.com, digicert.com, letsencrypt.org, sectigo.com). On the flip side, 0x007.click and www.chalu.fr both removed their Let's Encrypt CAA entries — worth a glance if you run either.

The flapper of the day

gov.uk logged 4 changes in the window — nothing in the detail feed tells us what moved, but any UK government domain shifting four times in 24 hours is worth keeping an eye on if you're monitoring that zone.