This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →


Web sources:

Book source:


Organized crime constantly has to adapt to the world it operates in. Traditionally, for fraud and malware distribution, its players used a small group of computers that victims connected to directly. Those computers held all the logistics needed to carry out a given operation. The problem with this setup is that it isn't reliable and, being too "centralized", it's easy for law enforcement to shut down a network built this way. So, just as legitimate networks require a minimum of redundancy, illicit networks have also moved toward much more reliable architectures on which criminal groups can run longer-term operations.

What is it?:


A Fast-Flux Service Network is a DNS domain made up of compromised computers that the DNS records point to. DNS queries made by clients can reach all of the infected hosts thanks to the "Round-Robin" load-balancing techniques offered by DNS servers. As a result, an invalid node in the chain (a computer that is no longer infected, for example) won't cause any major availability problem for the network. In addition, the DNS records have a very short TTL to allow a faster "flux" on the domain, and the IP addresses the DNS records point to change over time. This way, attackers make sure the DNS records are constantly changing and that the entry node into their network is a "moving target". Since these records keep changing, such a network is hard to trace.

The following two diagrams illustrate how DNS record rotation works:

Diagram 1:

                                         / 10.0.0.1 (premier hôte du round robbin)

                                        /

 ***************                       /

 * Serveur DNS *-------------------------- 10.0.0.2 (deuxième hôte du round robbin)

 ***************                       \

                                        \

                                         \ 10.0.0.3 (troisième hôte du round robbin)

                                           10.0.0.4 (hôte en attente)

                                           10.0.0.5 (hôte en attente)

                                           10.0.0.6 (hôte en attente)

Diagram 2:

                                         / 10.0.0.4 (premier hôte du round robbin)

                                        /

 ***************                       /

 * Serveur DNS *-------------------------- 10.0.0.5 (deuxième hôte du round robbin)

 ***************                       \

                                        \

                                         \ 10.0.0.6 (troisième hôte du round robbin)

                                           10.0.0.1 (hôte en attente)

                                           10.0.0.2 (hôte en attente)

                                           10.0.0.3 (hôte en attente)

So when a DNS query is made for the www.test.com record, the answer can potentially point to any host in the "Zombie" network.

How do these networks work?:


Since the goal of an FF network is to provide access to resources through multiple entry points, FF networks are often partitioned to limit the exposure of the criminal network's "critical" resources. "Zombie" computers (Flux-Agents) are used to provide access to the network's central servers (MotherShip). It's important to note that in some cases the central server(s) can also move around, to reduce the chances of them being seized by law enforcement. The layout of such a network is shown in diagram 3.

Diagram 3:

 *******************************

 * Groupe d'ordinateurs zombie *

 *          Flux-Agent         *

 *******************************

                |

                |            **********************

                |----------->* Serveur(s) Backend *

                             *     MotherShip     *

                             **********************

With this layout, a group of zombie computers (Flux-Agents) made up of various infected machines handles the requests routed to them through DNS record rotation and the DNS system's round-robin process. It's important to note that "Flux-Agent" groups are usually made up of home computers infected so they can take part in an organized group's criminal activities. These computers redirect the traffic they receive to a smaller group of "backend" servers. This technique, also used in legitimate networks for redundancy, has been adapted by criminal groups so they can centralize their communications while decentralizing the entry points into their infrastructure as much as possible. This way, criminal groups manage to build highly mutating networks that are very hard to trace for those responsible for taking them down.

Broadly speaking, there are two types of fast-flux networks.

Single-flux networks:


The single-flux network (diagram 4) seems to be the classic case. In this kind of network, a victim makes a request (B) to get some information, a website for example. Because of DNS resolution (A), the request is directed to a Flux-Agent (B) taking part in the single-flux network. The Flux-Agents, which are really acting as proxies, forward the request to the Mothership (C). When the Mothership responds (D), the Flux-Agent sends the information back to the client (E), who thus falls victim to the fast-flux network. So if an entry node is removed from the network, the network's architecture means it won't have any major long-term impact on how the network operates.

Diagram 4:

    **************

    * MotherShip *

 |->**************->|

 |                  |

C|                  |D

 |                  |

 |-<**************<-|

    * Flux-Agent *

 |->**************>-|

 |                  |

B|                  |E

 |                  |

 |  **************<-|          ***************

 |-<*  Victime   *             * Serveur DNS *

    **************             ***************

         |-----------------------------|

                       A

Double-flux networks:


In a double-flux network (diagram 5), the network itself is responsible for answering DNS queries. This is done by rapidly changing not only the "A" records on the public DNS servers, but also the "NS" records. The "NS" records then point to the double-flux network's entry points. The Flux-Agents thus answer as the authoritative DNS server for the domain (A). The Flux-Agents queried this way redirect the requests to the Mothership (B). The Mothership then answers the query with an address that is part of the network. From there, the same process as in single-flux networks applies (C, D, E, F). Researchers' observations show that most of the time, a single Mothership is used to answer both DNS queries and HTTP requests in this kind of network. Depending on the network, however, this Mothership may move around.

Diagram 5:

    **************

    * MotherShip * <----------\

 |->**************->|          \

 |                  |           \

D|                  |E           \

 |                  |             \

 |-<**************<-|              \B

    * Flux-Agent *                  \

 |->**************>-|                \

 |                  |                 \

C|                  |F                 \

 |                  |                   \

 |  **************  |               **************

 |-<*   Victime  *<-|               * Flux-Agent *

    **************                  **************

           |-----------------------------|

                          A

What are the advantages of Fast-Flux networks?

  1. Simplicity: Since the mothership is usually unique, criminals only have one server to manage. However, since the entry points are many and independent, the resulting network is highly organic, and failover when something goes wrong can often happen faster than on most corporate networks. This makes it easier for criminals to distribute illicit content efficiently.
  2. Dynamism: Since there are many entry nodes and the network is highly adaptable, losing a node doesn't pose a threat to the network. In the worst case, a small percentage of requests made over a short period will hit an invalid node. The situation resolves itself when the DNS information rotates or when the host is deregistered from the network.
  3. Lifespan: These networks generally last longer. They can also use multiple levels of "Fast-flux", making analysis of such a network more complex and making any law enforcement intervention exponentially harder. For a criminal group, building such a network could practically be seen the same way a legitimate organization sees building its website: in short, something every "good" organization should do.

What are these networks used for?


In the real world, organized crime uses this kind of network to carry out various activities such as:


Criminals could also use these networks to set up hard-to-trace email communication systems.

Detecting Fast-Flux networks:


Detecting a Fast-Flux network is not an exact science. To uncover a fast-flux network, you first have to notice that there are a number of irregularities in DNS queries. Furthermore, once the network has been found, taking it down requires either blocking communications with the Mothership or taking the Mothership out of circulation... In any case, depending on how the network works internally, it could theoretically be possible for a network to "come back to life" if all the infected hosts aren't properly cleaned up.

Important considerations:


Victims who use the entry nodes are not "aware" that they are being redirected to the Mothership. The Mothership is completely hidden from clients.

It could theoretically be possible for a Mothership to communicate with its Flux-Agents through a network like TOR (diagram 6) to make Motherships even harder to trace. Here is a diagram showing how the TOR network might be used to make law enforcement's job even more complicated

Diagram 6:

      **************     TOR + VPN     **************************

      * Mothership * ==================* FF Registration server *

      **************                   **************************

                                                   |

                                                   |

                                                   |

                                                   |

                                                   |

                                                   |

      **************                               |

      * Flux-Agent *--------------------------------

      **************

Diagram 6 shows how a criminal group could set up a fast-flux network using the anonymizing features of the TOR network. To pull this off, the group has to set up a "registration" server. This server runs a "VPN server". The Mothership, needing anonymity, connects to the registration server over VPN through the TOR network. This makes it impossible to trace the Mothership's physical location. When a host gets infected, the infected host contacts the registration server to start taking part in the network, and the registration server communicates with the Mothership to let it know a new host has joined the network.

In this case, however, the network becomes dependent on the registration server. That said, the fast-flux concept could be used to build a second fast-flux network between the Flux-Agents and the registration server, so as to have several "resilient" registration servers, in the same way that Flux-Agents are resilient to law enforcement intervention. The automated infection of several new "Registration servers" could even be reported to the Mothership using a communication channel that goes through the Flux-Agents and back up to the mothership via the existing network infrastructure (through the Flux-Agents).

Of course, putting this concept into practice requires significant manual work early on to build the network. However, an organization could very well start building the network using a preparatory Mothership to gather all the data needed for the network to operate. Once all the information is ready and the network is big enough, a second Mothership, the operational Mothership, comes into play and all communications are now covered as shown in diagram 6. This way, as soon as enough hosts have joined the network, the network's mode of operation changes to the TOR-based one. The preparatory Mothership is then sacrificed in favor of the operational Mothership, which can now operate anonymously, since all its communications go through the registration servers and are covered by VPN.

Conclusion:


In the end, it seems clear that using a Fast-flux network makes it easier for criminal groups to maintain a presence in cyberspace. Using these networks for illicit purposes is also much more "reliable" than the techniques used in the past.

Unfortunately, it's relatively easy to think up various techniques that could be used to "secure" such networks even further, making law enforcement intervention difficult, if not practically impossible, in such scenarios.

Unfortunately, setting up these networks is mostly possible because of the laxity of many hosting providers, Internet service providers and governments that don't really want to get involved in the issue of organized groups in cyberspace.