TechKnowSurge
TechKnowSurge Catalog Videos Stealth Technique: Fast-Flux
VideoSecurityFree

Stealth Technique: Fast-Flux

Fast flux is a DNS-based evasion technique that rapidly cycles traffic through a pool of rotating proxy servers to conceal an attacker's true location and maintain persistent command-and-control communication.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Fast flux is a DNS-based technique used by attackers to hide the origin of malicious traffic and maintain reliable command-and-control communication with compromised systems. At its core, the method exploits two properties: an extremely short DNS time-to-live, which forces the victim machine to repeatedly re-resolve the attacker's domain in rapid succession, and a constantly rotating set of proxy server IP addresses returned with each resolution. The result is that traffic is continuously redirected through different proxies, making it difficult for defenders to block communication simply by blacklisting a single IP address. The resilience of fast flux increases significantly when the proxy pool consists of compromised third-party machines rather than infrastructure the attacker controls directly. Because these machines belong to unwitting victims, the attacker has no meaningful exposure if individual proxies are discovered and blocked — there are simply more machines in the pool to cycle through. The actual traffic between the victim and the attacker always passes through one of these intermediary nodes, meaning the attacker's true IP address is never directly visible to the target network or its defenses. From a defensive standpoint, fast flux presents challenges on multiple fronts. Standard IP-based blocking is largely ineffective given the rapid rotation, and tracing the attack back to its true origin requires cutting through multiple layers of indirection across machines the attacker does not own. Recognizing the pattern — unusually short DNS TTL values, high-frequency re-resolution of a single domain, and IP addresses that change with nearly every query — is a key indicator of this technique and a critical skill for threat detection and network defense.

What you'll learn

What's covered

Fast Flux Attacks

Key terms

Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
Time to Live
TTL
A value in a packet that limits its lifespan on a network, preventing it from circulating indefinitely.
Proxy Server
An intermediary server that handles requests between clients and other servers, providing anonymity and content filtering.
Botnet
A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Threat Actor
An individual or group responsible for a security incident or attack.
Fast Flux
A DNS evasion technique that uses extremely short TTL values and rapidly rotating IP addresses—often pointing to compromised proxy nodes—to obscure adversary command-and-control infrastructure.
Command and Control
C2
Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.

Topics

Fast Flux Dns Evasion Command And Control Threat Actor Techniques Proxy Networks Cybersecurity

Transcript

Fast flux is a way that we can use many different proxy servers to hide our tracks. If we're tunneling traffic out to us as the adversary, then those IP addresses are going to be tunneled directly back to us. That's a sign of who we are; somebody can tie all that traffic back to us based off of an IP address. Proxy servers help, because now all these IP addresses are pointing to this proxy server and not directly to us. So it adds an extra layer of security.

There are still two problems, though. This proxy server could possibly be tied back to us, and then we would be compromised. The other thing too is that this organization could just block the IP address to this proxy server, and then we're shut down and we no longer can get our communication in or out of this network.

Using a domain instead of an IP address

Instead of using IP addresses, we could use a domain. So in this example right here, we're using C2, so this is some sort of command and control or C2 attack, and we could do malware us.com. What's going to happen is it's going to be sent to the DNS server, an IP address is going to come back, and then that is going to be directed towards this proxy server.

What this actually allows us to do is now have multiple proxy servers. This will get resolved to one of these proxy servers to carry out our attack. So it's an extra layer: if they block one proxy server, we still have multiple proxy servers.

Fast and flux

That's where fast flux comes into place. We can point this machine to this domain right here, and so it will resolve back, but then the time to live will be really short. So it'll ask again, and then again and again. It'll ask many times in just a short period of time. That's the fast part of this. The flux part of this is that the IP address that gets returned back is going to change every time. It'll point to this proxy server, then this proxy server, then this proxy server, and then back to the first one. It's constantly changing. It's constantly fluxing.

We still do have a couple of problems here. Number one is they could block all of the IP addresses to our proxies. And these still could be tied back to us.

Using compromised machines as the proxy pool

So there is still another solution here that allows us to change things up quickly, but not to servers that belong to us. If we compromised other machines out there, and it didn't really matter what kind of machines those were, and turned them into proxy servers, then we could still do fast flux and use all of these machines and constantly cycle through them. But if they were to be blocked for any reason, it doesn't really matter. The machine doesn't belong to us; it's a compromised machine anyway. So we just use the rest of the pool that we have, whatever number is in the rest of the pool.

The actual communication that's happening here is going from the machine to the proxy server, coming to us, and then maybe we're communicating back through that proxy server. This is an extra layer of security, because the data coming to and from us as the adversary is never actually seen by the end user or by the end device.

The idea, number one, is that the fast side of this is that the time to live is very short. When this machine does a DNS resolution towards the attacking domain, it's going to get a response back, but then it's not going to save it for very long. It'll need to query that again, because the time to live is very short. So it's constantly changing, and that's the fast part of it. The flux part is the fact that it's constantly changing and pointing to different IP addresses constantly. Often these machines are compromised machines, so that way if something gets blocked or goes offline, we still have a pool of resources, a pool of proxies that really are not tied to us, that we can continue using.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →