What is Fast Flux?

Fast flux is a DNS abuse pattern where a domain’s A or AAAA records change rapidly, often with very low TTL values, so the hostname maps to many different IPs over a short window. Criminals use it to keep phishing pages, malware loaders, or C2 front ends online while defenders chase moving addresses.

Single flux, double flux, and proxies

In single flux, only the web front IPs rotate while nameservers stay put. Double flux rotates both the address records and the authoritative NS records, sometimes hosted on the same bot-compromised pool, which makes takedowns harder. Proxies in the pool forward to a hidden backend, so the victim connects to a disposable node.

Low TTL forces resolvers to refresh often, pulling fresh answers from attacker-controlled DNS. Passive DNS databases help researchers spot domains with abnormal churn rates compared to legitimate sites that also use short TTL for load balancing but with stable provider ranges.

Fast flux and the ad ecosystem

Ad fraud operations sometimes hide fraudulent inventory or redirect chains behind fluxing domains to evade domain blocklists. IP blocklists also fail when addresses rotate hourly. Detection shifts to DNS graph features, registrar actions, and combined signals with bot traffic and suspicious clicks.

Legitimate marketers should ensure partners do not monetize anonymous “pop under” networks that exhibit flux patterns. For buyers, align with ad fraud education and detection practices. Technical readers can compare fast flux with proxy layering and review botnet detection writeups for SOC parallels.