Fast flux

DNS fast flux is a technique where the resource records of a domain are rapidly updated to avoid detection and takedown. "Double fast flux" is where both A/AAAA and NS records are updated to further hide malicious activity. Fast flux is used by botnets, command and control servers, to hide phishing sites, and generally to provide resilience to malicious resources.

Note: there are sometimes legitimate reasons for the use of fast flux, for example with CDNs or load balancers, but here we assume that the intent is malicious.

IP reputation can be affected by fast flux. As an example, when a fully qualified domain name (FQDN) using fast flux resolves to IP addresses of well-known service providers, the domain gains a positive reputation score and is less likely to be blocked by DNS firewalls or other filtering techniques. The malware controllers can then temporarily resolve the FQDN to the IP address they use for their attack.

Fast flux is commonly used with other techniques such as CNAME chaining to create a malware distribution network or as a backup command and control (C2) server to regain control of their malware. Fast flux has some technical characteristics similar to valid DNS uses such as content distribution networks (CDNs) and other types of load balancing. However, there are certain technical features that are almost exclusively used in fast flux as opposed to similar benign use cases.

For example, fast flux networks use IP addresses on a variety of autonomous systems (AS) and effective second level domains whereas CDNs tend to own all the IP addresses they use, and therefore the IP addresses are in a small number of AS’s. Similarly, CDNs use a relatively small number of effective second level domains. Furthermore, the IP addresses in a CDN or load balancing setup are usually all active and not parked, whereas a fast flux network tends to use a large number of parked IP addresses. A parked domain is one on which no services are actually available on the target of the resource record.