Identifying a Fast Flux Techniques

Fast Flux is another technique widely used by threat actors and cybercriminal groups to hide their digital fingerprints or traces.

We’ve previously discussed Domain Generation Algorithms (DGA) in detail. If you haven't read that yet, I strongly recommend checking it out first:
DGA Blog: Identifying Domain Generation Algorithm (DGA)

Now, what exactly is Fast Flux?

In simple terms, a Fast Flux network (or just Fast Flux) is a technique commonly used by cybercriminals to obscure the location of their malicious infrastructure. It works by rapidly changing the IP addresses associated with a domain name, often within minutes or seconds. You can think of it as an automated IP rotation system, where traffic is continuously redirected to different IP addresses making it difficult to track down or block the true source.

There are a lot of tools available to monitor Fast Flux networks but once again, I’m not a big fan of automated tools. I prefer hunting manually; that way, the knowledge stays with me for a long time, even without revisiting the topic.

So, how can we identify Fast Flux mechanisms deployed by threat actors?

There are several indicators, but one of the most important signs especially when monitoring network traffic is rapid IP address changes. For example, in Wireshark, you can look at the Source label to see IP addresses. If you notice the IPs changing frequently within 30 seconds or even less that's a suspicious sign and could indicate Fast Flux behavior.

Another traditional method is using the dig utility. But what exactly is dig?

dig stands for Domain Information Groper. It's a command-line tool used to query DNS name servers and retrieve domain-related information. It’s extremely useful for manually inspecting DNS behavior and spotting signs of Fast Flux, such as multiple IPs being returned for the same domain or a short TTL (Time To Live) on DNS records.

Signs of Fast Flux:

Rapid IP Address Changes
The domain resolves to different IP addresses in quick succession sometimes every few seconds. This rotation helps obscure the true origin of malicious servers.
Very Low TTL (Time To Live)
DNS records have unusually low TTL values, often 30 seconds or less. This forces frequent DNS lookups and enables rapid IP switching.
Name Servers Return IP Addresses Instead of Hostnames
In a normal setup, name servers typically resolve to hostnames. In Fast Flux configurations, you may see raw IP addresses instead, which is unusual and suspicious.

Useful `dig` Commands for Fast Flux Analysis:

dig +short domain.com
Displays the current IP address (A record) of the domain. Useful for quickly checking what IP a domain resolves to.
→ Example Output: 192.0.2.15
dig NS domain.com
Shows the authoritative name servers for the domain. This can help detect anomalies, such as IP addresses being used directly instead of hostnames.
dig +ttlunits domain.com
Displays how long the IP address is cached (TTL – Time To Live), including time units (e.g., 30s). Useful for spotting low TTL values typical in Fast Flux networks.
dig domain.com
Shows the full DNS response, including A records, TTL values, and additional information. Ideal for a detailed inspection of DNS behavior.

Practical Exercise :

Task: Fast Flux Analysis for `http://fillettx.[xin]`

Our goal is to analyze the domain http://fillettx.[xin] to detect possible Fast Flux behavior.

Steps:

Identify TTL Units

Use the dig +ttlunits command to retrieve the TTL (Time To Live) value for the domain. This tells us how long the DNS response is cached. Fast Flux domains often use very low TTL values (e.g., 30 seconds or less).

Inspect Name Servers:

2- Use dig NS to identify the domain’s authoritative name servers. Look for the following red flags:

Name servers listed as IP addresses instead of hostnames.
Unusual or frequently changing name servers.

(Optional) Query the A Record for Current IPs :

3- Check if the domain resolves to multiple different IP addresses over short periods.

Reverse The Malware