Tracking email senders with a history of frequently rotating IPs
Australian organisations have spent recent years dealing with a steady rise in business email compromise, and the Australian Cyber Security Centre regularly flags campaigns that rotate infrastructure faster than defenders can block it. Inboxes from Sydney to Perth see the same pattern: a sender looks legitimate on Monday, then reappears behind a fresh IP on Wednesday. Spotting that movement early is what stops a spoofed invoice or a fake ATO notice from costing a business thousands of dollars.
Sender reputation rarely shifts on its own. When a domain hops between hosting providers or cloud regions in short windows, the operator is usually trying to outrun blocklists or stretch a single campaign across disposable infrastructure. Behaviour-based reputation data matters more than static filter rules for catching these operators.
Trusted Sender Score pulls together historical sending patterns, DNS records, and authentication results into a single profile you can query per domain. Instead of relying on a single blacklist at one moment, you can look across months of activity and see whether a sender has been cycling through IPs faster than a legitimate business would need to.
This guide walks through how to use that aggregated data to flag senders with rapidly changing IPs, cross-check authentication signals, and wire the findings into your own ongoing monitoring.
Reading IP movement against trust signals
A sudden jump in distinct sending IPs is one of the strongest early indicators that a domain is being operated in a campaign-friendly way. Legitimate Australian businesses sending through Telstra, Optus, or Microsoft 365 tend to use a small, predictable pool of outbound servers. Anything outside that pattern is worth pulling up and reviewing.
Comparing stable senders against frequent IP rotators surfaces the key differences worth checking:
| Trust signal | Stable sender | Frequent IP rotator |
|---|---|---|
| Unique sending IPs (30 days) | 1 to 4 | 15+ |
| Reverse DNS records | Matched to organisation | Generic or mismatched |
| DKIM key rotation | Rare, documented | Frequent, unexplained |
| Country of origin | Consistent, mostly AU | Spans many regions |
| Authentication failures | Low and stable | Spikes after each rotation |
If a domain checks most of the right-hand column, treat it as suspicious even if its current DKIM and DMARC checks pass cleanly. You can dig into what a low trust score reveals when authentication results are otherwise healthy.
Walking through bulk domain history
When you have a list of domains to assess, the bulk checking tools let you compare IP rotation patterns across hundreds of records in one pass. Export the results and sort by the number of historical A records, MX hosts, or observed sending IPs. Domains with the widest spread across providers inside a short window are the ones to triage first.
Look closely at the timeline of DNS changes. A Melbourne-based SaaS startup might reasonably add a second mail provider over a quarter, but it would not cycle through five hosting regions in three weeks. Cross-reference any anomalies against WHOIS creation dates, since very young domains with rich sending history are a classic setup for the short-lived phishing kits reported to Scamwatch.
Spotting authentication drift after IP changes
Authentication records are supposed to travel with the sender. When a domain moves IPs but leaves its DKIM keys, SPF entries, and DMARC policies unchanged, that is healthy. When those records churn as well, or when the published keys stop aligning with new sending infrastructure, you are looking at a sender whose operators are reconfiguring on the fly.
Pay attention to the gap between a rotation event and an authentication failure spike. A consistent lag often means the operator is testing what slips through the filters before tightening configuration. Capture the domain in your watchlist at this point, because the next iteration often produces the malicious payload.
Building a detector through the API
For security teams wanting to automate this logic, the developer API exposes historical sending-IP data, authentication results, and trust scores behind each lookup. Pull the full record for a domain, then flag any whose unique-IP count over the last 30 days crosses a threshold you set for your own risk appetite.
A practical approach is to combine the IP history with DMARC aggregate reports from your own mail gateway, catching both inbound impersonation and outbound patterns from senders you have not yet blocked. Walk through the build in the custom phishing detector guide and adapt the thresholds to your sector.
Watching for newly registered lookalike domains
Rotating IPs is often paired with registering fresh domains that mimic a trusted brand. Australian businesses are routinely impersonated this way, with copycat .au names appearing weeks after a campaign starts and slipping past busy staff.
Configure notifications for new registrations close to your own domain so you can pre-empt them. The automated alerts guide walks through keyword matching and TLD filtering tuned to the local market.
Acting on the findings
A flagged domain does not need to be banned instantly. Add it to a watchlist, alert the relevant team lead, and compare its behaviour against the next rotation cycle. If the pattern continues, escalate to blocking at the gateway and report it to Scamwatch or the ACSC's ReportCyber portal.
The real value of the platform's data is the longitudinal context it provides. Senders that rotate IPs quickly leave a hard-to-forge trail, and once you know how to read it, rapid IP changes become one of the clearest signals you can rely on.