Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Fast flux rapidly changes the DNS IP addresses returned for a domain; Cloudflare One treats it as a UEBA risk behavior to support investigation of potentially risky activity.
- Cloudflare's general documentation says predefined behaviors are disabled by default and continuously evaluate organization users when enabled; availability of the new control in a particular account still needs confirmation.
- A user's Low, Medium, or High score reflects the highest-level triggered behavior, not a sum; enabling detection does not itself block all access.
- Disabling a behavior stops future monitoring, but previous detections remain in logs and associated with the user; resetting a user's score is a separate action and does not disable the behavior.
Fast flux is a new UEBA risk behavior
On November 6, 2026, Cloudflare announced fast flux detection as a new predefined risk behavior for user and entity behavior analytics (UEBA) in Cloudflare One. Fast flux is a DNS technique that rapidly changes the IP addresses returned for a domain; threat actors may use it to make malicious infrastructure harder to track and take down.
Cloudflare says detections contribute to a user’s risk score when the behavior is enabled, helping security teams identify and investigate potentially risky activity. The feature is available on Enterprise plans.
Separate general defaults from account rollout
The announcement says fast flux detection is available on Enterprise plans and gives the control path as Risk score > Risk behaviors. Cloudflare's general user risk score documentation says all predefined behaviors are disabled by default; enabling a behavior causes the system to continuously evaluate organization users for it.
That overview is dated October 12, 2026, before the November 6 fast flux announcement, and its older predefined behavior table does not include fast flux. Do not borrow prerequisites, risk levels, or evaluation timing from other rows. The available materials also do not confirm whether the new control has reached every account.
Risk scoring and Access enforcement are separate
Cloudflare One represents user risk as Low, Medium, or High. A score equals the highest-level risk behavior a user triggers; behavior levels are not added together. When a behavior is triggered, the system compares the current level with that behavior's level and uses the higher one. The announcement and overview do not specify fast flux's default level or its detection threshold.
To use a score for access control, an administrator separately adds a User Risk Score condition to a Cloudflare Access policy and selects Low, Medium, High, or Unscored. Whether a request is allowed or blocked depends on that application's policy action and other rules. Turning on fast flux does not create a blanket block for every application.
Inspect a behavior instance and its detection log
The general risk score guide lists this path for review: Zero Trust > Teams & Resources > Users > Risk score, then Risk scoring and the user's record. The user's triggered behavior instances are shown there, and selecting an instance opens its associated detection log. The reviewed materials do not specify new fast flux log fields or retention periods.
The announcement places the fast flux control under Risk score > Risk behaviors; its availability in a specific account still needs confirmation. If the control is absent, the sources provide no per-account rollout schedule, so that alone does not establish that the plan is unsupported.
Disabling monitoring does not reset a user's score
Disabling a risk behavior stops monitoring for future activity. Previously detected behavior remains in the logs and associated with the user, so turning off fast flux is not a way to erase historical detections.
Resetting a user's risk score is a separate management action. After a reset, the user no longer appears in the associated risk table until another behavior is triggered; the reset itself does not turn off fast flux monitoring. Treat stopping future monitoring and resetting a current user score as separate decisions.
Sources
Frequently Asked Questions
Does a fast flux detection prove that a domain with changing IP addresses is malicious?
No. Cloudflare presents fast flux as a potentially risky behavior that can help teams investigate activity; the source does not claim every rapidly changing DNS address is malicious.
Does Enterprise availability mean there is no extra charge or country restriction?
The announcement and reviewed risk score documentation establish Enterprise plan availability but give no fast flux price, additional purchasing terms, or country list. They do not establish that it is free or available everywhere without conditions; check your organization’s contract and the settings actually available in its account.