What is DNS Fast Flux?

DNS fast flux is a type of DNS-masking technique used by phishers to host links to websites for phishing purposes while remaining untraceable. Botnets or automated processes are often made use of. It is run by cybercriminals who take advantage of their network of previous victims.

Multiple IP addresses are associated with one domain name by rapidly changing the DNS records associated with that domain name. Attackers use their compromised hosts as proxies to disguise their identities and shift between them to avoid detection.

Cybercriminals can rapidly move between networks thanks to the computing power of botnets or malicious code execution using compute from others. Because they relocate their malicious services from one legitimate IP address to another legitimate IP address with familiar domains, they are difficult to detect.

DNS fast flux attacks can use hundreds or thousands of IP addresses in a short period which helps maximize their uptime and makes them much more difficult to block. In essence,

“DNS fast fluxing turns malicious domains into a moving target.”

Careful filtering can help prevent or block these attacks. However, they remain a significant threat despite developing techniques that are meant to stop them.

To properly understand the dangers posed by DNS fast flux, consider the real-world analogy of a getaway car. In most cases, police can identify a vehicle based on description and behavior and then identify its plates.

The plates, tied to a specific owner, make the car easy to track and capture (provided there’s no additional legwork by the criminals).

But if the bank robber can change their plates every few miles, they make it next to impossible to properly identify and track their vehicle. DNS fast flux works the same way - with an address that changes hundreds or thousands of times a minute, systems must work overtime to filter or block it.

Double fast fluxing is an enhanced version of DNS fast fluxing, making it even more difficult to track down the origin of malicious activity. With double fast fluxing, the delegation of the authoritative nameserver is changed rapidly as well (basically the address and nameserver records).

So this would be the same getaway car, but as well as the license-plates being changed, the car itself is also continuously swapped out.