Fast-flux types
Single-flux: utilizes static name servers to update DNS records, as seen in previous image.
Double-flux and hydra-flux: include two or multiple motherships managing the rotating IP numbers, services and content.
Mothership protection: The infected computers (botnet) form a protective barrier in front of the motherships. The only visible part of the attack are the bots.
Fast-Flux Domains: to be able to change DNS records the motherships need to be located in Domains owned by the attackers. Only their domain Registrar can remove access to the Domain, but the Domain could easily be created in another Registrar.
Possible attacks: phishing campaigns, bot recruiting malware, e-mail spam campaigns, etc.