Research Spotlight: Detecting Algorithmically Generated Domains
Summary: Cisco Talos researchers Mahdi Namazifar and Yuxi Pan described a DGA detection component that scores domain-name randomness using over 60 language dictionaries plus US 1990 census names, Scrabble words, Alexa 1000 domains and texting acronyms. Running on their private cluster, it analyzes up to 200,000 newly registered domains daily and flags 6,000 as suspicious DGA domains, and it identified all 13 Cryptolocker C&C domain names in a cited tcpdump.
What you should know: Attackers register only a few of the many pseudo-random domains their DGA produces, so blocklisting collapses under the volume; the alternative - reverse-engineering each algorithm - is resource- and time-consuming, and the authors note DGAs are becoming more complicated.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026