November 6, 2026

Palerain's Great Cloudflare Exodus, and Two Domains Head to the Lot

Across the roughly 43 million domains we watch, we logged 54,008 DNS changes in the last 24 hours, plus about 200,000 freshly-seen domains. Most of it is routine SPF housekeeping — but a few records tell real stories.

When Cloudflare isn't enough anymore

palerain.com had a rough day. It dropped off Cloudflare entirely — nameservers brit.ns.cloudflare.com and roman.ns.cloudflare.com were swapped out for a stack of byet.org and infinityfree.com servers, the free-hosting duo. The network hop matches: AS13335 (Cloudflare) to AS34119. Along the way its CAA record ballooned from a tight list (Let's Encrypt, DigiCert, Google's pki.goog) to a sprawling set covering Amazon, GoDaddy, Microsoft, Sectigo and more — basically the default policy InfinityFree hands out. Mail moved from mail.palerain.com to mx.palerain.com, and its old Google site-verification TXT and SPF record both vanished. Add it up and it reads like a CDN-protected site getting migrated onto bare free hosting — worth a look if you depended on that domain staying put.

Two domains, two different flavors of parking

  • afbforum.com (and its www) swapped nameservers from changchang.ns.giantpanda.com / yangguang.ns.giantpanda.com over to ns1.parkingcrew.net / ns2.parkingcrew.net — ParkingCrew is a well-known domain-parking NS, and the site picked up a fresh CAA record and a new MX (mail.h-email.net) in the same pass. Network moved from AS63949 to AS206834.
  • likeeagle.com went a different route: its nameservers (previously ns1.atom.com / ns2.atom.com) were replaced with ns1.afternic.com / ns2.afternic.com — Afternic being GoDaddy's domain-resale marketplace. A fresh v=spf1 -all TXT record (mail explicitly disallowed) rounds out the classic "this domain is for sale" signature. Network hop: AS14618 to AS16509.

Different outcomes, same underlying pattern: when a domain stops being actively used, the first things to change are usually the nameservers.

Quick hits

  • 18860.cc left Cloudflare's edge (AS13335/AS135074/AS211392) for AS4907, flipping its hosting classification from CDN to unknown — another site stepping off Cloudflare's network.
  • essentialerp.at switched CDN labels from BunnyCDN to CDN77 while sitting on the same ASNs (AS60068, AS200325, AS212238) — a reminder that CDN branding can shift even when the underlying network paths don't.
  • A handful of hosting migrations crossed shared-hosting boundaries, like drrungsima.com picking up a WebsiteWelcome/cPanel-style SPF record (ip4:192.185.4.29) as it settled into direct hosting.

Nothing alarming in the window overall — just the usual churn of sites moving hosts, getting parked, or quietly tightening (and loosening) their CAA policies.