An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of compromised bots. In this particular technique, a single domain name consists of multiple IP addresses. Which of the following technique is used by the attacker?

Fast-Flux DNS is a technique used by botnets to hide malicious servers behind a constantly changing network of compromised hosts (bots) acting as proxies. A single malicious domain name resolves to numerous IP addresses, which are swapped in and out of the DNS A records with high frequency (a short Time-to-Live, or TTL). This makes it difficult for security systems to block the malicious infrastructure by IP address, effectively camouflaging the true location of the phishing or malware command-and-control servers.

A. DNS zone transfer: This is a legitimate DNS operation for replicating records between servers. Attackers abuse it for reconnaissance to map a network, not to hide infrastructure.
B. Dynamic DNS: This service maps a domain name to a changing (dynamic) IP address, but typically involves one IP at a time and is not characterized by the rapid, multi-IP shuffling of Fast-Flux.
C. DNS interrogation: This is a general term for querying DNS for information. It is a method used by attackers for reconnaissance, not a technique for hiding their assets.

1. National Institute of Standards and Technology (NIST). (2013). NIST Special Publication 800-81-2: Secure Domain Name System (DNS) Deployment Guide. Section 3.5.3, "Fast-Flux DNS," p. 3-16. The document defines Fast-Flux as a technique that "repeatedly and quickly changes the IP address associated with a domain name."

2. Holz, T., Gorecki, C., Rieck, K., & Freiling, F. C. (2008). Measuring and Detecting Fast-Flux Service Networks. In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS). This academic paper provides a foundational analysis of Fast-Flux networks, describing their use in malware and phishing campaigns. DOI: https://www.ndss-symposium.org/ndss2008/measuring-and-detecting-fast-flux-service-networks/

3. Geffner, L., & Stover, T. (2007). Know Your Enemy: Fast-Flux Service Networks. The Honeynet Project & Research Alliance. This whitepaper details how Fast-Flux is used to "hide the location of phishing and malware delivery sites."