October 22, 2026

Domains Lock Down, Afternic Flips a Flag

Out of roughly 42,650 DNS changes we clocked across the tracked universe in the last 24 hours (with about 230,000 brand-new domains showing up), a few stood out for telling a real story rather than just shuffling an IP.

A domain heads to the For-Sale rack

rd-media.com and its www twin just got the classic "going up for sale" treatment: nameservers flipped from ns1.dns-redirect.com / ns2.dns-redirect.com to ns1.afternic.com / ns2.afternic.com, the CAA records for Let's Encrypt and Sectigo vanished, old TXT verification strings (abuse-report, afternic-verification) were stripped, and SPF was rewritten to a flat v=spf1 -all — effectively "no mail allowed." That combination (Afternic NS + locked-down SPF + no CAA) is the fingerprint of a domain parked for sale rather than actively hosting anything.

Mail infrastructure shake-ups

pvhealth.com quietly moved its network from AS397423 to AS174 (Cogent) while tightening its SPF record to add a new sending IP (45.43.11.20) alongside its existing Outlook/Proofpoint mix — a sign of either a hosting migration or a new mail relay being folded in.

Meanwhile infiniteadvantageinc.com dropped its Google Workspace MX records (aspmx.l.google.com and friends) entirely, removed its rapid-ns.com nameservers for Network Solutions' dns1-5.name-services.com, and jumped from AS398101 to AS16509. Losing Google MX plus a registrar-DNS switch usually means a company is leaving Google Workspace behind as part of a bigger platform move.

A mini lockdown trend

Several domains tightened their security posture in the same window:

  • secrobotliability.org added a full CAA set restricting issuance to Amazon only (amazon.com, amazonaws.com, amazontrust.com, awstrust.com, plus wildcard variants) and set SPF to -all — a domain being hardened against unauthorized certs and mail spoofing.
  • woodedacrescampground.net dropped its Squarespace CNAME, moved off Google Cloud DNS onto ns1.pelland.com / ns2.pelland.com, added a Let's Encrypt-only CAA record, and set SPF to -all too.
  • ibora.nl didn't change issuers but expanded its existing Let's Encrypt and Google Trust Services CAA records to require dns-01 validation in addition to http-01 — a small but deliberate anti-takeover tweak.

Quick hits

  • avino.org and espangoperistaltikpompalar.com both landed on Hetzner's AS24940 after nameserver swaps (supporthost.com and enesi.srl respectively).
  • eltho.com, fox450.com, and gpsexpress.com.ar all hopped networks, with fox450.com and gpsexpress.com.ar both landing on AS398101.
  • www.abro.com.ar was today's flapper, racking up 3 changes in the window.