Rotating hosts is an attacker infrastructure tactic where domains, IP addresses, or servers are swapped frequently to keep a malicious service reachable. Instead of relying on one fixed site, the operator moves traffic across many hosts or reuses the same content on new infrastructure. This makes simple blocklists, shutdowns, and domain takedowns less effective because defenders are always chasing a moving target.
In cyber security, rotating hosts is common in phishing kits, malware loaders, exploit delivery pages, and command-and-control setups. It helps attackers stay online, spread traffic, and recover quickly after exposure. Defenders look for patterns that stay constant even when the host changes, such as reused certificates, page templates, DNS behavior, or shared tracking IDs. Detection often depends on fast reputation updates, sinkholing, and monitoring for newly registered domains or sudden host changes associated with a campaign.