Recognising a genuine rotation
Addresses being retired and replaced is maintenance rather than a warning sign. Knowing the normal shape of it makes an abnormal one visible.
Why rotations happen at all
An address that has absorbed sustained flooding keeps attracting it, because whoever aimed at it already knows where to aim. Retiring it resets that. Operators also cycle deliberately so no single address becomes the one everybody has bookmarked, which would rebuild the single point of failure the set exists to avoid.
The normal shape
- One or two entries change while the rest stay, rather than the whole set turning over at once.
- The announcement is signed with the same key as every previous one.
- Old addresses keep resolving for a period rather than disappearing the same hour.
- The wording and structure resemble previous announcements.
Patterns worth pausing over
An entire set replaced simultaneously. An announcement signed with a different key and no explanation signed by the old one. A rotation appearing first somewhere other than where the operator has always posted. None of these prove anything alone, and each is a reason to verify more carefully rather than less.
Timing against outages
A rotation announced during an outage is normal, because outages are often what prompt one. A rotation that only exists during an outage, unsigned, from a source that appeared alongside it, is the shape of a phishing operation rather than of maintenance.
What to do on any rotation
Verify the announcement, then update your saved list, then discard the retired entries so a stale bookmark cannot send you hunting later. The whole task takes a couple of minutes and it is the reason a rotation never has to be an emergency.
Why a rotation should never be an emergency
The entire reason the set has several entries is so that losing one is uneventful. If a rotation feels urgent, the urgency is coming from having kept a single address rather than from the rotation itself. Two minutes of maintenance on a quiet day removes that feeling permanently.