What fast flux is

Every domain name points to one or more numeric IP addresses, and the Domain Name System (DNS) is the directory that connects the two. When a security tool blocks a malicious server, it usually blocks that address. Fast flux gets around the block by changing the addresses. The advisory describes two versions:

Single flux: one domain name is tied to many IP addresses that are rotated constantly, so if one address is blocked or taken down, the domain is still reachable through the others.

Double flux: the name servers that answer for the domain change frequently as well, which adds another layer of cover.

The pace is what makes it work. According to the advisory, a typical fast flux domain may change its address every 3 to 5 minutes and cycle through tens or hundreds of addresses in a day. Those addresses usually belong to other people's compromised devices, which sit in front of the attacker's real server and pass traffic along to it.

Who uses it

The advisory gives examples. Fast flux has been used in Hive and Nefilim ransomware attacks. The group known as Gamaredon uses it to limit the effectiveness of IP blocking. Some “bulletproof” hosting companies, which ignore abuse notices and law enforcement requests, sell it as a service. It also keeps phishing websites online after the first attempts to block them.

Why it matters to a small firm

Nobody aims fast flux at a law office or a dental practice in particular. It is plumbing: the thing that keeps a phishing page or a ransomware control server reachable after its first addresses have been blocked. The practical consequence is that a defense built only on blocking known bad addresses falls behind, because the address has changed by the time the block is in place. The judgment has to be made about the domain and how it behaves. That is the job of a DNS filtering service, which the advisory calls Protective DNS, or PDNS.

What the advisory tells organizations to do

It lists five measures, to be put in place with your internet provider, your security provider or your DNS filtering service:

Block domains and IP addresses identified as fast flux, and consider redirecting that traffic to a controlled server to find the computers trying to reach them.

Block traffic to and from domains and addresses with poor reputations.

Increase logging and monitoring of DNS traffic, with automated alerts.

Share what is found with trusted partners and information-sharing groups.

Train staff to recognize phishing, and have a procedure for handling it.

The question to ask

The most useful sentence in the advisory is a caution: “some PDNS providers may not detect and block malicious fast flux activities.” It goes on to say that organizations should not assume their provider blocks fast flux automatically, and should contact the provider to confirm.

So put three questions to whoever runs DNS filtering for your office, whether that is an IT provider, a firewall vendor or a standalone service:

Do you detect and block fast flux domains specifically, and how?

Are our DNS queries logged, and how long are the logs kept?

If one of our computers tried to reach a blocked domain, who would be told?

Every client we manage has DNS filtering turned on. If nobody can say who runs DNS filtering for your office, that is the first thing to find out. And if you want to know what your own network would and would not catch, a security assessment is where that conversation starts.

This article was rewritten on October 12, 2026 and replaces an earlier version.