It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-Flux'. This technique is commonly used by advanced threat actors to enhance infrastructure resilience and avoid takedown or tracking.
The questions every analyst asks before acting on this signal.
It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-Flux'. This technique is commonly used by advanced threat actors to enhance infrastructure resilience and avoid takedown or tracking.
This refers to an extreme variant of double-flux behavior where NS and IP changes occur within very short intervals. Such rapid cycling often indicates a highly dynamic and evasive malicious infrastructure.
Legitimate domains rarely need to rotate NS and IP records frequently. Double-flux techniques are characteristic of botnets, malware delivery networks, and resilient C2 architectures designed to resist disruption.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "too_many_ns_change",
"name": "Double-Flux Behavior Detected",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "malicious",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
It indicates that the domain frequently changes its MX (Mail Exchange) records. Such behavior is often associated with s…
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…
It indicates that the domain relies on free or temporary mail providers. Such behavior is common among malicious or low-…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
birdseyewings[.]coSuspicious64Verified 2026-08-01atomload[.]toSuspicious72Verified 2026-08-01childrensdolls[.]comSuspicious63Verified 2026-08-01avmn99[.]comSuspicious63Verified 2026-08-01animesuge[.]ioSuspicious69Verified 2026-08-01arshera[.]techSuspicious72Verified 2026-08-01ahoravideo-chat[.]xyzSuspicious65Verified 2026-08-0140gmail[.]comSuspicious60Verified 2026-08-01gmeil[.]comSuspicious65Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.