Cloudflare One adds fast flux detection

DNS behavior joins risk assessment

Fast flux is a technique involving rapid changes to the IP addresses returned in a domain’s DNS responses. Attackers can use it to make malicious infrastructure harder to track and take down.

Cloudflare says the new detection is offered as a predefined risk behavior. Once enabled, detections contribute to the user risk score. The announcement limits availability to Enterprise plans.

Quad Bilişim commentary

Considering DNS behavior alongside user context provides security teams with an additional investigation signal. A risk score and a confirmed security incident are different things; the announcement should not be read as evidence of an attack at any particular organization.