Skip to content

What is DNS Fast Flux?

Get the latest news, invites to events, and much more

DNS fast flux is a type of DNS-masking technique used by phishers to host links to websites for phishing purposes while remaining untraceable. Botnets or automated processes are often made use of. It is run by cybercriminals who take advantage of their network of previous victims.

Multiple IP addresses are associated with one domain name by rapidly changing the DNS records associated with that domain name. Attackers use their compromised hosts as proxies to disguise their identities and shift between them to avoid detection.

Cybercriminals can rapidly move between networks thanks to the computing power of botnets or malicious code execution using compute from others. Because they relocate their malicious services from one legitimate IP address to another legitimate IP address with familiar domains, they are difficult to detect.

DNS fast flux attacks can use hundreds or thousands of IP addresses in a short period which helps maximize their uptime and makes them much more difficult to block. In essence,

“DNS fast fluxing turns malicious domains into a moving target.”

Careful filtering can help prevent or block these attacks. However, they remain a significant threat despite developing techniques that are meant to stop them.

To properly understand the dangers posed by DNS fast flux, consider the real-world analogy of a getaway car. In most cases, police can identify a vehicle based on description and behavior and then identify its plates.

The plates, tied to a specific owner, make the car easy to track and capture (provided there’s no additional legwork by the criminals).

But if the bank robber can change their plates every few miles, they make it next to impossible to properly identify and track their vehicle. DNS fast flux works the same way - with an address that changes hundreds or thousands of times a minute, systems must work overtime to filter or block it.

Double fast fluxing is an enhanced version of DNS fast fluxing, making it even more difficult to track down the origin of malicious activity. With double fast fluxing, the delegation of the authoritative nameserver is changed rapidly as well (basically the address and nameserver records).

So this would be the same getaway car, but as well as the license-plates being changed, the car itself is also continuously swapped out.

Learn More

IDC 2023 Global Network Automation Report
Reports & Surveys
IDC 2023 Global Network Automation Report
Explore
EfficientIP Network Object Manager Product Teaser
Videos
Network Object Manager Product Teaser
Explore
EfficientIP Cloud Observer Product Overview Teaser
Videos
Cloud Observer Product Overview Teaser
Explore
Networkshop 2023
Events
Networkshop 2023
Explore
Case Studies
Super-Pharm: Improving Revenue Protection by Replacing Microsoft DHCP With SOLIDserver
Explore
Case Studies
University of Grenoble Alpes: Simplifying the IT merger of its entities with DDI
Explore
Case Studies
Société Générale: Ensuring Business Continuity and Efficiency with Proven DDI, APIs and Automation
Explore
Infosecurity Europe
Events
Infosecurity Europe 2023
Explore
News
EfficientIP Launches Free Tool to Detect Enterprises Risk of Data Exfiltration
Explore
News
New Release SOLIDserver 8.2: Cloud Observer and Network Object Manager
Explore