Fast-flux mechanics
The mothership and DNS: To cycle bot IP addresses and bypass caching features, fast-flux domains use short TTL (Time to live (TTL) values in the DNS to force clients to frequently query the name server for a new set of A addresses.
The bots and content: the bots act as reverse proxies by sending requests to the mothership and relaying the malicious content hosted by the mothership.
Multiple motherships: use of a single DNS server and mothership provides a single point to focus to stop the malicious action. Double or hydra flux addresses this “flaw” by providing multiple DNS, Domains, etc.