An adversary can create and configure multiple domains pointing to the same host, allowing rapid switching between domains to avoid detection.

An adversary can create and configure multiple domains pointing to the same host, allowing rapid switching between domains to avoid detection.

• A. Use of Domain Redirects
• B. Unspecified Proxy Activities
• C. Internal Reconnaissance
• D. Use of PowerShell

Answer: (B)

Rotating through multiple domains that all point to the same host is a way to hide where traffic is really coming from and to dodge domain- or IP-based detection. By having different domains resolve to the same server, an adversary can switch which domain appears to be the source, effectively using intermediaries to mask origin and complicate blocking efforts. This proxy-like approach gives stealth and persistence because defenses can’t rely on a single domain or IP to identify the activity. Domain redirects rely on HTTP-level redirects to move users from one domain to another and aren’t the same as DNS-level domain-to-host mappings that enable rapid domain switching for source masking. Internal reconnaissance and PowerShell don’t describe this technique of rotating domains to evade detection.

Rotating through multiple domains that all point to the same host is a way to hide where traffic is really coming from and to dodge domain- or IP-based detection. By having different domains resolve to the same server, an adversary can switch which domain appears to be the source, effectively using intermediaries to mask origin and complicate blocking efforts. This proxy-like approach gives stealth and persistence because defenses can’t rely on a single domain or IP to identify the activity.

Domain redirects rely on HTTP-level redirects to move users from one domain to another and aren’t the same as DNS-level domain-to-host mappings that enable rapid domain switching for source masking. Internal reconnaissance and PowerShell don’t describe this technique of rotating domains to evade detection.