Fast-Flux Subdomain Rotation on Newly Registered Phishing Domains (BRE/Bluekit)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•6

This rule monitors network logs for potential malicious activity by analyzing subdomain cardinality and identifying known phishing domains. It flags apex domains that exhibit high subdomain rotation (5 or more distinct subdomains within an hour), indicative of fast-flux DNS techniques, or that match a static list of known malicious/phishing infrastructure.