It indicates that the domain frequently changes its associated IP addresses, a known technique used by threat actors to evade detection, takedown, and blocking mechanisms. This pattern is typical in botnet infrastructures, phishing campaigns, and malware C2 systems.
Three questions every analyst asks before acting on this signal.
It indicates that the domain frequently changes its associated IP addresses, a known technique used by threat actors to evade detection, takedown, and blocking mechanisms. This pattern is typical in botnet infrastructures, phishing campaigns, and malware C2 systems.
Standard Fast-Flux involves periodic IP changes, while Aggressive Fast-Flux Activity refers to extremely rapid IP rotation — sometimes every few minutes or seconds — making it nearly impossible for traditional defense systems to track or blacklist the infrastructure effectively.
Because legitimate services rarely need such frequent IP rotation. Attackers use this technique to hide behind a large pool of compromised hosts or proxy nodes, spreading malicious traffic across dynamic networks.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "too_many_ip_change",
"name": "Fast-Flux Behavior Detected",
"group": "relational_intelligence",
"subgroup": "dns_relational_infra",
"direction": "malicious",
"evidence": {
"shared_ip_domain_count": 1247,
"ns_overlap_with": [
"bad-domain-1.tld",
"bad-domain-2.tld"
],
"proximity_score": 0.84,
"rapid_ip_change_count_30d": 38
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that a single IP address is used by a significantly large number of domains. This assessment is based on a …
It shows that the domain uses a rarely seen or low-visibility public nameserver provider. Such providers often lack stro…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.