Detecting Fast Flux with Sysdig Secure and VirusTotal

This article explains the Fast Flux DNS technique used by attackers to rapidly rotate IP addresses, cites an April 2025 NSA advisory warning of its national security implications, and shows how Sysdig Secure detects low-TTL, multi-IP domain resolutions at runtime. It also demonstrates how to use VirusTotal queries to surface suspected Fast Flux domains and recommends layered defenses, including protective DNS, to mitigate risk.