Fast flux
Fast flux is a DNS technique that rotates the IP addresses behind a domain every few minutes across many compromised hosts, so taking one server down does not take the site offline.
How it works
Very short TTLs and large pools of proxy hosts (often a botnet) mean every lookup can return different addresses; double flux rotates the name servers as well.
It shifts the effective takedown point from the hosting provider to the registrar or registry.
How to protect yourself
- Watch for very low TTLs and many unrelated IP addresses in DNS answers.
- Report fast-flux domains to the registrar, since hosting takedowns will not stick.