FastFlux

Fast flux is a DNS technique used by botnets and criminal networks to maintain a resilient and hard-to-take-down command-and-control infrastructure by rapidly changing the IP addresses associated with a domain.

In a fast-flux setup, the domain’s A (and often AAAA) records point to a large pool of IP addresses, and the DNS responses vary over short periods. The pool is frequently rotated among compromised machines (zombies) or inexpensive hosting services, and DNS TTL values are typically very low to enable rapid changes. This results in a moving target for defenders who try to block or shut down the domain’s infrastructure.

A related variant, double flux, extends this approach by also rotating the domain’s WHOIS data and name servers, further complicating takedown efforts. The technique hides the true location of the command-and-control server, increases availability, and makes IP-based blocking more difficult.

Detection and analysis focus on patterns such as an unusually large and rapidly changing set of IP addresses for a single domain, consistently low DNS TTLs, and frequent IP changes across multiple domains sharing infrastructure. While fast flux is commonly associated with criminal activity like botnets, phishing, and spam campaigns, legitimate services such as content delivery networks or certain load balancers can exhibit similar DNS behavior. Therefore, additional indicators are typically required to establish malicious use.