If code validates the answer of one DNS lookup and then connects by name, a second lookup can return another address. The defense is to resolve once and connect to the validated IP. See TOCTOU.
DNS rebinding
A name that resolves to a harmless address for the check and to an internal one for the connection.