Investigate shows that a domain resolved to dozens of different IP addresses across many unrelated autonomous systems and countries during the last week, with short TTLs and records changing constantly. What does this DNS and IP history most strongly suggest?
Select an answer to reveal the explanation.
Short Explanation
Picture a getaway driver who swaps cars every few blocks: lots of addresses, all over the map, changing constantly. That's fast flux, and it's how criminals keep a domain alive while defenders block one IP at a time. A CDN can look busy too, but you won't see a CDN hop across dozens of unrelated networks.
Full Explanation
The DNS and IP history in Investigate shows which addresses a domain has resolved to over time and which networks those addresses belong to. Fast-flux infrastructure deliberately rotates a domain through many addresses, often compromised hosts in unrelated autonomous systems and countries, with short TTLs so that resolutions change continually. The goal is resilience against takedown and blocking: removing one address does nothing because the next resolution returns another. A large and rapidly changing set of addresses spread across many unrelated networks is therefore a strong malicious indicator, especially combined with other poor signals. A content delivery network also returns varied addresses, but they belong to that provider's own networks, and nothing about churn proves legitimacy. A misconfigured authoritative server produces errors or stale answers rather than a growing spread of foreign networks. Parked domains usually resolve to a small, stable set of parking-provider addresses. Exam caveat: geographic and network diversity is one indicator among several; legitimate global services can show diversity, so look at ownership of the networks and the domain's other scores. Operational check: review the domain's resolution history and ASN spread, compare with its risk score and co-occurrences, and block it if the indicators agree.