Fast Flux DNS - Rapid IP Rotation on Single Domain

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.