Fast Flux DNS - Rapid IP Changes on Same Domain

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.