Certified Ethical Hacker (CEH) Practice Question

The activity matches a domain generation algorithm (DGA). Malware that uses a DGA produces large numbers of pseudo-random domain names on a predictable schedule and tries to contact them until the attacker registers one as the current command-and-control (C2) server. Because defenders must discover and block or seize an ever-changing set of possible domains, simply blacklisting a few known C2 addresses or taking down one domain is rarely effective.

Fast-flux rotates IP addresses, not domain names; peer-to-peer C2 dispenses with domains altogether; and hard-coded IP lists do not generate new DNS lookups, so none of those alternatives fit the observed pattern.