Rotating domains is an attacker tactic in which malicious operators frequently change the hostnames or IP-backed domains used for delivery, command-and-control, or data exfiltration. The goal is to make security blocks, takedowns, and attribution less effective by treating infrastructure as disposable.
This matters because a domain-based blocklist can become obsolete quickly: once one hostname is flagged, the campaign can move to another. Rotating domains are common in phishing, malware staging, and infostealer operations, where infected hosts repeatedly contact new endpoints. Defenders respond by hunting for patterns that survive hostname changes, such as DNS query behavior, URL paths, certificate reuse, infrastructure overlap, and endpoint process activity. Security teams may also use reputation feeds, sinkholing, and DNS monitoring, but behavioral detection is usually more durable than blocking a single known domain.