Fast flux
A hostname whose A or NS answers keep rotating. A resilience trick used by some botnets. Short TTL plus churn.
Fast flux is a pattern: the same name returns a rapidly changing set of addresses, and sometimes nameservers. The aim is resilience. Sinkhole one IP and the name still lands somewhere else. Some botnets use it. CDNs and large anycast can also churn; context matters.
Detection is the combination, not one field: short TTL, rotating A or NS sets, addresses in mixed or consumer networks, and a name that has no other business looking like a CDN. Passive DNS history shows the churn. Blocking a single IP is not a strategy.
See also: A record, TTL, Botnet, Passive DNS.