Skip to content

IP Diversity & Rotation

How an IOC's IP set changes over time: fast-flux, geo-rotation, round-robin signatures. Each fires with named evidence and a 3-question analyst Q&A trail.

See 3 IP Diversity & Rotation signalsSee verdicts firing these
About

What IP Diversity & Rotation captures

How an IOC's IP set changes over time: fast-flux, geo-rotation, round-robin signatures. Tier-1 SOC analysts use them to cut triage time on suspicious dns history behavior; CTI teams pivot from them to the broader campaign graph.

Browse

3 signals in IP Diversity & Rotation

Each row opens a leaf page with the signal's direction, named evidence, and 3-question Q&A trail. Use them as audit anchors when a verdict surfaces this subgroup.

IP Diversity & Rotation3 signals
Verdict scenarios

How IP Diversity & Rotation shapes the call

Three real-world situations where IP Diversity & Rotation evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A domain whose IP set rotates daily across small allocations spread over multiple countries.

VerdictIQ explains

“Decline. The rotation cadence and geographic scatter match fast-flux operations used to keep malicious infrastructure resilient. Treat as hostile.”

Medium riskVERDICT · REVIEW
The situation

A domain rotating IPs every few weeks across a small CDN edge pool, with no operator-level explanation.

VerdictIQ explains

“Send to analyst review. The rotation is mild but consistent enough to warrant verification; could be legitimate CDN behavior or staged failover for abuse.”

Low riskVERDICT · ALLOW
The situation

A domain whose IP set stays anchored on a single CDN provider with predictable round-robin behavior.

VerdictIQ explains

“Allow. The rotation pattern is the well-understood signature of mainstream CDN traffic. No diversity reason to delay.”

See full Verdict Gallery
Sibling subgroups

Other subgroups in DNS History

6 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail

See IP Diversity & Rotation signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.

Start FreeBack to DNS History