1. A computing apparatus, comprising: a network interface operable for connecting to a data network; and one or more hardware and/or software logic elements comprising a detection engine operable for: inspecting a network packet provided on the network interface; identifying a domain name server (DNS) request associated with the network packet, the DNS request having a time-to-live; determining that the time-to-live of the DNS request is expired; and designating the network packet as suspicious.