An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of…

Fast-Flux DNS is a technique used by attackers to hide phishing and malware distribution sites behind

an ever-changing network of compromised hosts acting as proxies. It involves rapidly changing the

association of domain names with multiple IP addresses, making the detection and shutdown of

malicious sites more difficult. This technique contrasts with DNS zone transfers, which involve the

replication of DNS data across DNS servers, or Dynamic DNS, which typically involves the automatic

updating of DNS records for dynamic IP addresses, but not necessarily for malicious purposes. DNS

interrogation involves querying DNS servers to retrieve information about domain names, but it does

not involve hiding malicious content. Fast-Flux DNS specifically refers to the rapid changes in DNS

records to obfuscate the source of the malicious activity, aligning with the scenario described.

Reference:

SANS Institute InfoSec Reading Room

ICANN (Internet Corporation for Assigned Names and Numbers) Security and Stability Advisory

Committee