Fast flux

Hosting method where a domain's IP address changes continuously

Fast flux is a technique where many computers in a botnet act as proxies to a domain serving malicious and/or illegal content. In fast flux hosting, many nodes on a botnet frequently register and de-register their addresses for a single DNS entry. A URL on that domain will therefore point to a continuously changing IP address.

Fast flux is used to prevent IP-based blacklisting. Because of the various proxy layers, it also helps to mask the attackers' system.

Fast flux has been known to security researchers since 2006 and started to be used frequently in 2007.