166 terms · 75/46/45
Technique № 041 · class: C2

Fast-Flux DNS

Rapid rotation of IP addresses associated with a C2 domain.

Term

description · examples · notes

Rapid rotation of IP addresses associated with a C2 domain.

Description

DNS records change every few minutes to new IP addresses.

Compromised devices serve as proxies for the real C2 server.

Makes blocking difficult since there is no stable IP for blacklisting.

Used for botnet infrastructure and phishing campaigns.

Examples

  • Storm botnet used fast-flux for C2
  • Avalanche infrastructure for phishing with fast-flux DNS

Notes

  • Differs from domain fronting in mechanism — DNS rotation vs CDN abuse.
tags
dns botnet rotation resilience
◳Composite

Threats

used by 4

Threats that use it. Select one to open its page.

Defenses

countered by 4

How it is countered. Select one to open its page.