thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Fast Flux

A DNS technique that rapidly changes the IP addresses associated with a domain to hide malicious infrastructure.

Definition

In single-flux, the A records for a domain point to many compromised hosts that change every few minutes with very short TTLs; double-flux also rotates the authoritative name servers. This makes takedowns and IP blocking difficult. Defenders watch for very low TTLs and many IPs across unrelated networks.

Example

A phishing domain whose A record resolves to a different residential IP every three minutes.

Exam tip

Fast flux rotates IPs for one domain; DGA rotates domain names.

Related terms