Analyze DNS volatility and hosting churn fast. Compare TTL, ASN spread, countries, and uptime behavior. Reveal likely fast flux domains using transparent weighted scoring.
| Domain Sample | Unique IPs | ASNs | Avg TTL | Countries | IP Changes 24h | NS Changes 30d | Approx Score | Interpretation |
|---|---|---|---|---|---|---|---|---|
| alpha-check.example | 36 | 8 | 90 | 11 | 30 | 5 | 81.40 | Strong fast flux suspicion. |
| cdn-static.example | 12 | 3 | 3600 | 4 | 2 | 0 | 21.90 | Likely low concern. |
| mixed-host.example | 24 | 6 | 300 | 7 | 14 | 2 | 56.70 | Needs analyst validation. |
This calculator converts each signal into a normalized 0 to 100 risk value, then applies weighted scoring.
IP Diversity Risk = min(100, Unique IPs / 50 × 100)
ASN Dispersion Risk = min(100, Unique ASNs / 12 × 100)
TTL Risk = max(0, min(100, (3600 − Avg TTL) / 3600 × 100))
TTL Variability Risk = min(100, TTL Std Dev / 900 × 100)
Country Spread Risk = min(100, Countries / 15 × 100)
IP Churn Risk = min(100, IP Changes 24h / 60 × 100)
NS Change Risk = min(100, NS Changes 30d / 12 × 100)
Domain Age Risk = max(0, min(100, (365 − Domain Age Days) / 365 × 100))
Uptime Instability = min(100, (100 − Uptime %) × 2.5)
Reputation Risk = min(100, Reputation Flags / 10 × 100)
Overall Risk Score =
0.18 × IP Diversity
+ 0.12 × ASN Dispersion
+ 0.14 × TTL Risk
+ 0.06 × TTL Variability
+ 0.10 × Country Spread
+ 0.16 × IP Churn
+ 0.08 × NS Change
+ 0.08 × Domain Age
+ 0.04 × Uptime Instability
+ 0.04 × Reputation Risk
The model is intentionally transparent so teams can adjust weights to match internal telemetry and threat priorities.
Fast flux is a DNS technique where a domain rapidly rotates many IP addresses, often across different networks. Attackers use it to hide infrastructure, improve resilience, and make takedowns harder.
Low TTL values let operators swap IP answers quickly. That behavior is useful for malicious flux operations, although some legitimate services also tune TTL for performance or resilience.
Yes. CDNs, global load balancers, and Anycast-backed services can show multiple IPs and broad geography. Analysts should compare ownership, certificates, service purpose, and historical DNS patterns before blocking.
No. The score is a triage signal, not a final verdict. It highlights suspicious infrastructure patterns that deserve enrichment with passive DNS, WHOIS, content analysis, and endpoint telemetry.
Newly registered domains often appear in phishing, malware delivery, and disposable infrastructure. Domain age alone is not enough, but it becomes meaningful when combined with rapid DNS volatility.
Frequent nameserver changes may indicate unstable delegation, throwaway DNS providers, or evasive administration. This signal becomes stronger when paired with fast IP churn and low TTL values.
Yes. The weights and normalization caps are intentionally readable. Security teams can adjust them to match internal telemetry, threat intelligence, or environment-specific false-positive patterns.
Many teams start deeper review around 50 or higher, especially if TTL risk and IP churn are both elevated. Critical environments may choose lower thresholds for earlier escalation.
Important Note: All the Calculators listed in this site are for educational purpose only and we do not guarentee the accuracy of results. Please do consult with other sources as well.