Lion Cipher Lab

Detect fast-flux DNS infrastructure from scratch (ASN churn, the CDN false positive, and a double-flux evasion)

• Threat Intel Analyst
• Advanced
• ~85 min
• Free · no account required

Why it matters

When a botnet hosts C2, phishing, or malware-download infrastructure, its weakest link is the IP address: block the one server and the operation goes dark. Fast flux erases that weakness. The attacker points a domain at a large pool of compromised hosts and rapidly rotates which addresses the domain resolves to -- returning a fresh handful of A records every minute or two, each with a very low TTL so caches never hold a stale answer. Take down one IP and the domain is already answering from ten others. In DOUBLE-flux the operator rotates the NS records (the authoritative name servers) the…

What you'll learn

• what fast flux is and why blocking individual A-record IPs cannot keep up (MITRE ATT&CK T1568.001; CISA AA25-093A)
• generating a self-contained, deterministic dataset: benign sites, ONE CDN, and fast-flux C2 domains, each with multiple resolutions, TTLs, and per-IP ASN/country/rDNS -- written purely as BENIGN test data
• engineering fast-flux signals from scratch: distinct A-record IP count over a window, minimum TTL, ASN/network diversity, country spread, IP-set churn (Jaccard distance), and residential-rDNS fraction
• hand-tuning a weighted scorer and reporting precision, recall, and a confusion matrix on data you can inspect line by line
• meeting the CDN as the HONEST #1 false positive, and proving that ASN CONCENTRATION (not IP count or low TTL) is the discriminator that clears it
• playing the adversary: single-flux vs DOUBLE-flux (NS records rotate too) and low-and-slow flux that lengthens TTL, and measuring recall collapse from 1.00 to 0.60
• re-tuning with a longer observation window plus an NS-rotation signal to recover 1.00 recall without breaking the original case
• the judgment: fast flux (infrastructure churn) vs DGA (string randomness), the base-rate trap, and where passive-DNS platforms (DNSDB) and ML classifiers fit as the productionised form

Steps in this lab

1. What fast flux is, and why blocking IPs loses the race
2. Generate a self-contained dataset (benign sites, ONE CDN, and fast-flux C2)
3. Build the fast-flux signals from scratch
4. Score, classify, and print precision / recall + a confusion matrix
5. Meet the CDN false positive -- and prove ASN concentration is what defeats it
6. The adversary round: double-flux and low-and-slow flux
7. Re-tune: a longer window plus an NS-rotation signal
8. The judgment: infrastructure vs string, the base-rate trap, and where passive DNS fits

Open the full interactive lab →