What is a fast flux network and how do you detect it?

A fast flux network keeps changing the IP addresses that a single domain name points to, so the servers behind it are hard to find and block. Attackers use it to keep command and control channels, phishing sites and malware downloads online. Defenders look for abnormal DNS churn and block at the domain level.

What exactly changes?

CISA and partner agencies from the United States, Australia, Canada and New Zealand published joint advisory AA25-093A in April 2025. It describes fast flux as a domain-based technique where DNS records, such as IP addresses, for a single domain change rapidly. MITRE tracks it as sub-technique T1568.001 under Dynamic Resolution.

The advisory describes two common variants. In single flux, one domain name links to many IP addresses that change often. In double flux, the name servers that answer for the domain also rotate. The advisory also says the technique helps attackers build resilient, highly available command and control, and it calls the gap in many networks a defensive blind spot.

Why does it work?

Blocking an IP address is quick, but when the domain maps to a different address next minute, the block is stale. Often the addresses belong to compromised devices acting as relays, so the real server stays hidden behind them.

The advisory also notes that most malicious activity on these domains happens within a few days of first use, so early discovery and sharing matter. Slow processes lose.

Is every rotating domain malicious?

No, and this is where false positives come from. The advisory warns that legitimate content delivery network behavior can look like fast flux, and recommends allowlisting expected CDN services so legitimate content is not blocked.

A constructed example: a domain returns 40 different addresses over an hour with a TTL of 60 seconds, and the address owners are scattered across residential networks in many countries. That pattern is suspicious. Another domain returns a few addresses in one provider's range, which fits a CDN. Domain age, hosting diversity and TTL together say more than any single number.

What signals help?

Watch for low TTL values, a large number of distinct IP addresses for one domain over a short time, addresses spread across many unrelated networks, newly registered domains, and name servers that also change. Treat these as inputs to scoring, not rules by themselves.

What does the advisory recommend?

The listed mitigations include blocking and sinkholing malicious fast flux domains and IPs, reputation filtering, more logging and monitoring of DNS and network traffic with automated alerts, information sharing with trusted partners, and phishing awareness training, since many fast flux domains support phishing.

Sinkholing redirects traffic from a bad domain to a server you control, which both stops the callback and shows which internal hosts tried to reach it.

Who can actually stop it?

Mostly resolver operators, registrars and network providers, since they see the DNS traffic and control the domains. The joint advisory is aimed at those providers for that reason, and encourages protective DNS services to build accurate detection. As an organization, your lever is to use a resolver that blocks known bad domains and to log your own queries.

How to check or apply this

1. Send DNS logs from resolvers to central storage, including query name, answers and TTL.
2. Build a query that counts distinct answers per domain per hour and flag high outliers.
3. Cross-check flagged domains against registration age and your CDN allowlist before blocking.
4. Use a protective DNS service or your resolver's policy to block confirmed domains by name, not only by IP.
5. Sinkhole confirmed domains and investigate any internal host that asks for them.
6. Share confirmed indicators with your sector group, and set expiry on indicators you add.
7. Review phishing reports for domains that match the pattern.

Quick check

Sources

• CISA, Fast Flux: A National Security Threat (AA25-093A)
• MITRE ATT&CK T1568.001, Dynamic Resolution: Fast Flux DNS

Last reviewed: 18 October 2026.