1. A method, comprising: monitoring, by a computing device, a plurality of domain name system (DNS) lookup requests to one or more DNS servers initiated by one or more network devices in a local area network (LAN) to a wide area network (WAN), the DNS lookup requests comprising a plurality of requests to resolve one or more uniform resource locators (URLs) to one or more received network addresses (IP); monitoring the one or more received network addresses (IP) resolved for the one or more URLs to provide a URL-to-IP associations list, wherein the URL-to-IP associations list is configured to store one or more suspicious URLs; generating a suspicious URL log based on the URL-to-IP associations list, wherein the suspicious URL log comprises a first suspicious URL; determining a list of client devices that queried the first suspicious URL during a first time period; and generating an event related to a single-flux action being active based on the list of client devices.