FastFluxDomains

Fast Flux Domains are domain names used in a DNS technique known as fast flux, employed by organized cybercrime to preserve online infrastructure while evading takedowns. In a fast flux setup, the DNS A records for a domain are assigned to a rotating set of IP addresses, typically across many compromised machines or rented servers distributed worldwide. The Time-to-Live values are kept very low to enable rapid changes, so the domain can resolve to a large pool of active nodes in minutes or seconds.

The infrastructure is often composed of compromised hosts acting as proxies or reflectors, which relay traffic to a central command-and-control (C2) server or hosting service. Because the pool of IPs changes frequently, seizing a single machine or blocking a single IP has little effect on availability. Fast flux can be used for botnet C2, phishing sites, or other criminal services that require resilient hosting.

Detection and mitigation rely on traffic and DNS analysis: unusually large numbers of A records for a domain, rapid changes in IP mappings, low TTLs, or many domains sharing the same set of IPs. Threat intelligence teams also monitor registration patterns, hosting histories, and sinkholing opportunities. Preventative approaches include network-level filtering, domain takedown, and cooperation with registrars and ISPs to interrupt the underlying botnet infrastructure.

There are related concepts such as double flux and flux service networks, which add additional layers of DNS rotation or proxying, increasing the complexity of takedown efforts.