TechKnowSurge
TechKnowSurge Catalog Videos Stealth Technique: Double-Flux
VideoSecurityFree

Stealth Technique: Double-Flux

Double flux is an advanced fast flux technique that continuously rotates both proxy servers and DNS servers, making command-and-control infrastructure nearly impossible to block or trace. It builds on single flux by eliminating the single point of failure that a static authoritative DNS server creates.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Fast flux is a DNS evasion strategy used in command-and-control operations where the time-to-live on a domain's resolved IP address is kept extremely short. Every time a compromised machine needs to communicate, it queries DNS again and receives a different proxy server address, constantly shifting the network path and making it difficult to block any single IP. This foundational technique is known as single flux, and while effective, it has a critical structural weakness: the authoritative DNS server responsible for resolving the malicious domain remains fixed and can be identified and blocked, collapsing the entire communication chain. Double flux addresses this vulnerability by applying the same rotation logic to the DNS layer itself. Rather than pointing to a single authoritative DNS server, the infrastructure cycles through a pool of DNS servers that are also constantly changing. A compromised machine resolves the malicious domain, gets directed to one of many rotating DNS servers, receives a proxy address from that server, and communicates through the proxy—with both the DNS server and the proxy potentially changing on the next request. This two-layer rotation eliminates any single point of failure and forces defenders to pursue a large number of hosts that may appear to be ordinary, legitimate machines. Because the rotating nodes in a double flux network are typically compromised endpoints operating as part of a botnet, attribution and takedown become substantially more resource-intensive. The technique is designed specifically to frustrate IP blocklisting, DNS sinkhling, and other common mitigation approaches by ensuring that no individual address or server remains constant long enough to be acted upon effectively.

What you'll learn

What's covered

Fast Flux Networks

Key terms

Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
Time to Live
TTL
A value in a packet that limits its lifespan on a network, preventing it from circulating indefinitely.
Proxy Server
An intermediary server that handles requests between clients and other servers, providing anonymity and content filtering.
Botnet
A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Single Flux
A fast flux technique that rapidly rotates proxy server IP addresses associated with a domain by keeping DNS TTL values very short, making it difficult to block any single IP.
Double Flux
An advanced fast flux technique that rapidly rotates both proxy server IP addresses and the authoritative DNS servers for a domain, adding a second layer of evasion against blocking and detection.
Fast Flux
A DNS evasion technique that uses extremely short TTL values and rapidly rotating IP addresses—often pointing to compromised proxy nodes—to obscure adversary command-and-control infrastructure.

Topics

Dns Security Fast Flux Double Flux Command And Control Threat Evasion Cybersecurity

Transcript

Why Single Flux Is Not Enough

Just a typical single flux network might not be enough to really do what we want to do, and that's where a double flux comes into play.

If we have a compromised machine here and we're carrying out some sort of command and control on it — so C2, that we are controlling this from the adversary machine — we need that communication to go back and forth. One of the ways that protects us is using fast flux. This domain gets resolved and comes back with one of the IP addresses of these proxies.

The idea behind fast flux is that the time to live of this resolved IP address is very short. So every time it communicates, it goes back out to the DNS server and says, "What is the IP address for this domain?" And it gets a new proxy server. So it's constantly fluxing, it's constantly changing. This does a few things. It makes it much harder to block any one IP address, and these are compromised machines, so it adds this level of protection from us getting discovered.

There are a few different versions of fast flux. There's the single flux, there's the double flux, and there's a domain flux.

Adding a Layer of DNS

I'm going to add an extra layer of DNS servers in here. Really, there are many different layers of DNS doing this, but essentially what needs to happen is this malware rs.com needs to be resolved, and so it's going to go to a server and resolve that and find out what DNS server it's going to.

What I've already described was single flux, and there's a problem with it. To describe what the problem is, I'm adding an extra DNS server. Just realize there are actually probably many DNS servers in here and we're just adding one here — really the DNS is a little more complex than that.

This domain gets looked up and says, okay, who's the authoritative server for malware rs.com? And it gets responded back and says, look at this server right here. So then it goes and looks at that server right there, and then gets a response back from that server, and then it's going to these different proxies. But the problem is that now we have a single DNS server that can get blocked, and if that DNS server gets blocked, this whole system comes crumbling down.

Double Flux

But who's to say that we couldn't change the DNS server, making it harder to be blocked as well? So here we have DNS and proxy servers, and maybe these are a different set of machines, or maybe it's the same set of machines — it doesn't really matter too much for this double flux.

Essentially what happens is that this machine goes and resolves this domain and figures out what the DNS server is, and then it points to one of these machines and gets resolved and figures out what the IP address of the proxy server is, and then goes to the proxy server and then returns, and so now we can communicate through that. But both the DNS is constantly changing as well as the proxy server. So it makes, once again, an extra layer of security, so that they can't just block one DNS or one proxy. It's going to take them quite a few of what would rather be legitimate machines, because they're compromised and we've got some sort of botnet going on.

So here's the attack card on that double flux. The idea behind that is we're using the domain name system, the DNS system, to change both proxies and DNS servers, and they're constantly changing, so you can't pin anything down. It allows us to create that extra layer of security from us being discovered.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →