Blocking an IP address works only if the address stays put. MITRE T1568.001, Fast Flux DNS, is a way for adversaries to hide a command and control channel behind many rapidly changing addresses. It falls under command and control and applies to Linux, macOS, Windows and ESXi.
How attackers use it
One fully qualified domain name is given many IP addresses, which are swapped at high frequency using round robin addressing and a short TTL on the DNS record.
MITRE describes two forms. In single flux, addresses are registered and removed from the A record list for a single DNS name, with an average lifespan of about five minutes. In double flux, addresses are registered and removed from the name server record list for the zone, adding resilience, and extra hosts can act as proxies to the real C2 host.
How to detect it
MITRE points to repeated resolutions where the same name returns multiple IPs in quick succession, low TTL values and high query volume from unusual processes. Resolver logs, auditd events, unified logs on macOS and ESXi syslog all work. Correlate with the process making the queries, such as Office apps or non-browser tools like python and curl, and confirm with outbound traffic.
A read-only way to look at one name's TTL and answers is:
dig +noall +answer example.com A
Run it twice a minute apart and compare. A legitimate CDN may also rotate, so judge by process and context.
How to reduce the risk
MITRE lists no specific mitigation for this subtechnique. The parent technique suggests network signatures and DNS sinkholes, covered in the T1568 guide.
Quick check
What two DNS properties define single flux?
Many IPs rotating in the A record list for one name, and a short TTL so the set changes constantly.
