Detect domain flux from source pcap