# Fast flux

Fast flux is a DNS technique that rotates the IP addresses behind a domain every few minutes across many compromised hosts, so taking one server down does not take the site offline.

## How it works

Very short TTLs and large pools of proxy hosts (often a botnet) mean every lookup can return different addresses; double flux rotates the name servers as well.

It shifts the effective takedown point from the hosting provider to the registrar or registry.

## How to protect yourself

- Watch for very low TTLs and many unrelated IP addresses in DNS answers.
- Report fast-flux domains to the registrar, since hosting takedowns will not stick.

## Related tools

- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)

## Related terms

- [Bulletproof hosting](https://phishdestroy.io/glossary/bulletproof-hosting/)
- [Domain generation algorithm (DGA)](https://phishdestroy.io/glossary/dga/)

## Further reading

- [Phishing Takedowns: Detect, Verify, Report](https://phishdestroy.io/takedown-anatomy)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/fast-flux/