DGA

Download Feeds

After 6 years of providing free service, we regretfully decide to end the free DGA feeds as the current practice is not sustainable. If your business needs commercial license, please contact netlab@360.cn for pricing information. Thanks.


Changelog

2023-02-23 :

+1 new family MetaStealer. Thanks to WangHao.

2023-02-06 :

+1 new seed of Symmi. Thanks to WangHao.

2022-12-30 :

+1 new family Uid0js. Thanks to HeZiqian.

2022-12-28 :

+1 new family Mykings.

2022-12-07 :

+1 new seed of Antavmu(AKA Orchard). Thanks to RenDaji.

2022-11-08 :

+2 new seeds of Ranbyus. Thanks to Lvxing.

2022-09-07 :

+1 new family Ares. Thanks to Liuya and Zscaler.

2022-08-22 :

+1 new family Zloader. Thanks to Lvxing and Baderj.

2022-08-05 :

+1 new seed of Antavmu(AKA Orchard). Thanks to RenDaji.

2022-08-01 :

+1 new family BazarDoor. Thanks to WangHao.

2022-07-05 :

+1 new seed of Antavmu(AKA Orchard). Thanks to RenDaji.

2022-07-04 :

+1 new seed of Ramnit.

+1 new seed of Qadars. Thanks to Alex.Turing.

2022-05-24 :

+1 new seed of Tempedreve. Thanks to WangHao.

2022-05-06 :

+2 new seeds of Tinba. Thanks to WangHao.

2022-03-30 :

+2 new seeds of Ranbyus.

+2 new seeds of Locky. Thanks to WangHao.

2022-03-23 :

+1 new family Wauchos. Thanks to Alex.Turing.

+1 new family DMSniff. Thanks to RenDaji and FlashPoint.

2022-03-23 :

+1 new seed of Tinba.

+1 new seed of Ramnit. Thanks to WangHao.

2022-03-15 :

+1 new seed of Necro. Thanks to Xuyang.

2022-01-05 :

+1 new family M0yv. Thanks to WangHao.

2021-12-28 :

+1 new family Qakbot. Thanks to WangHao.

2021-11-18 :

+1 new family Tordwm. Thanks to Alex.Turing.

2021-11-15 :

+1 new family Abcbot. Thanks to Alex.Turing.

2021-09-08 :

+1 new seed of Antavmu. Thanks to RenDaji.

2021-09-02 :

+1 new seed of Mydoom(time independent DGA). Thanks to RenDaji.

2021-08-27 :

+1 new seed of Ngioweb. Thanks to Alex.Turing.

2021-08-24 :

+1 new family CopperStealer. Thanks to ChaiLinyuan and ProofPoint.

2021-08-23 :

+1 new family Monerominer. Thanks to RenDaji.

2021-07-28 :

+1 new seed of Necro. Thanks to Xuyang.

2021-06-17 :

+1 new family Flubot. The Python code comes from prodaft's Github, thanks for sharing.

2021-05-13 :

+1 new seed of Necro. Thanks to Xuyang.

2021-04-16 :

+1 new seed of Simda.

2021-04-15 :

+1 new family Antavmu. Thanks to RenDaji.

2021-04-12 :

+1 new seed of Simda.

2021-04-06 :

+1 new family Kfos. Thanks to Liuya.

+3 new seeds of Simda.

2021-03-12 :

+1 new seed of Necro. Thanks to Jinye.

2021-01-21 :

+1 new family Necro. Thanks to Jinye.

2021-01-07 :

+1 new seed of Ngioweb.

2020-11-20 :

+1 new seed of Banjori.

2020-11-16 :

+1 new seed of Banjori.

2020-11-13 :

+1 new family Ngioweb. Thanks to Alex.Turing.

2020-07-28 :

+1 new seed of Simda.

2020-07-10 :

+1 new family Bigviktor. Thanks to Alex.Turing.

2020-01-17 :

+1 new seed of Ramnit.

2019-11-21 :

+1 new seed of Ramnit.

2019-10-18 :

+1 new seed of Ramnit.

2019-10-08 :

+3 new seeds of Ramnit.

2019-09-12 :

+2 new seeds of Ramnit.

2019-09-06 :

+2 new seeds of Ramnit.

2019-09-03 :

+1 new family Enviserv. Details in issue #53.

+1 new seed of Tinba.

2019-09-02 :

+1 new seed of Ramnit.

2019-08-21 :

+1 new seed of Ramnit.

2019-04-28 :

+1 new seed of Ramnit.

2019-04-25 :

+1 new seed of Feodo.

2019-04-09 :

+1 new seed of Ramnit.

2019-04-02 :

+1 new seed of Ramnit.

2019-03-25 :

+1 new seed of Ramnit.

2019-03-13 :

+1 new seed of Ramnit.

2019-03-05 :

+1 new family Shiotob. Details in issue #51.

2019-02-28 :

+1 new seed of Ramnit.

+1 new seed of Locky.

2019-02-25 :

+1 new seed of Nymaim.

2019-02-18 :

+1 new seed of Ramnit.

2019-01-31 :

+1 new seed of Ranbyus.

+1 new seed of Ramnit.

2019-01-29 :

+1 new seed of Ramnit.

2019-01-22 :

+1 new seed of Tinba.

2019-01-14 :

+2 new seeds of Ramnit.

2019-01-08 :

+1 new family Feodo.

+1 new seed of Ramnit.

2019-01-07 :

+1 new family Mydoom. Details in issue #49.

2018-11-22 :

+1 new seed of Tinba.

2018-11-19 :

+2 new seeds of Ramnit.

2018-11-15 :

+1 new seed of Murofet.

2018-11-12 :

+1 new seed of Vawtrak.

2018-11-07 :

+2 new seeds of Vawtrak.

+1 new seed of Ramnit.

2018-11-05 :

+1 new seed of Dircrypt.

+1 new seed of Banjori.

2018-10-29 :

+1 new seed of Vawtrak.

+1 new seed of Omexo.

2018-10-24 :

+1 new seed of Dircrypt.

+1 new seed of Ramnit.

2018-10-23 :

+1 new seed of Ramnit.

2018-10-22 :

+1 new seed of Dircrypt.

+2 new seeds of Ramnit.

2018-10-17 :

+1 new seed of Ramnit.

+1 new seed of Qadars.

+1 new family Omexo.

2018-10-15 :

+1 new seed of Tinba.

+1 new seed of Ranbyus.

2018-10-10 :

+1 new seed of Tinba.

+5 new seeds of Dircrypt.

2018-10-09 :

+1 new seed of Nymaim.

+1 new seed of Murofet.

+1 new seed of Banjori.

2018-05-04 :

+1 new seed of Dircrypt. Thanks Baderj. Details in issue #12.

2018-04-10 :

+2 new seeds of Murofet. Details in issue #43.

+9 new seeds of Ramnit.

2018-04-08 :

+3 new seeds of Tinba.

+3 new seeds of Ranbyus.

2018-03-02 :

+1 new family Tinynuke.

2018-01-12 :

+18 new seeds of Ramnit.

2018-01-11 :

+3 new seeds of Locky.

+4 new seeds of Ramnit.

2017-11-08 :

+3 new seeds of Banjori. Details in issue #39.

2017-10-17 :

+15 new seeds of Ramnit. Extracted from CERT.PL blog, thanks for sharing.

2017-09-20 :

+1 new family CCleaner. Thanks to 360CERT.

2017-08-28 :

+2 new seeds of Tinba.

2017-08-23 :

+2 new seeds of Tinba.

+4 new seeds of Dircrypt.

2017-08-14 :

+1 new family XshellGhost. Details in issue #38.

2017-07-27 :

+3 new seeds of Locky.

2017-06-30 :

+1 new seed of Ramnit.

2017-05-18 :

+1 new seed of Padcrypt. Details in issue #34.

+1 new family Padcrypt. The Python code comes from baderj's Github, thanks for sharing.

2017-05-11 :

+1 new seed of Locky. Extracted from Nominum blog, thanks for sharing.

2017-05-04 :

+1 new seed of Qadars.

+1 new seed of Simda.

+1 new seed of Tinba.

2017-04-13 :

+1 new seed of Qadars.

+2 new seed of Simda.

+1 new seed of Ramnit.

2017-04-11 :

+1 new family Blackhole.

2017-03-21 :

+1 new family Matsnu.

2017-03-09 :

+37 seeds of Locky. Thanks to John Bambenek for providing these Locky V3 seeds.

2017-03-07 :

+1 new family Emotet.

+1 new seed of Locky.

+1 new seed of Nymaim.

+1 new seed of Ramnit.

2017-02-23 :

+1 new seed of Qadars.

2017-01-20 :

+3 new seeds of Ramnit; +1 new seed of Tinba.

2017-01-18 :

+1 new seeds of Locky.

+1 new seed of Qadars.

+1 new seed of Nymaim.

2017-01-06 :

+2 new seeds of Shifu; +1 new seed of Murofet.

2017-01-05 :

+7 new seeds of Tinba; +3 new seeds of Banjori.

2017-01-04 :

+25 new seeds of Banjori.

2016-12-30 :

+1 new family Gspy and 2 seeds.

+6 new seeds of Tinba.

+1 new family Tofsee. The implementation comes from GovCERT.ch blog, thanks for sharing.

2016-12-22 :

+1 new family Vidro. Details in issue #31.

2016-12-16 :

+1 new seed of Mirai.

2016-12-12 :

+1 new family Mirai. More details, please go to our blog: Now Mirai Has DGA Feature Built in.

2016-12-02 :

+1 new seed of Murofet. Details in issue #30.

2016-11-29 :

+16 new seeds of Rovnix. Bruteforce reverse engineering these Rovnix seeds, through PDNS clues.

2016-11-25 :

+1 new seed of Rovnix; +3 new seeds of Locky

2016-11-23 :

+1 new family Rovnix

2016-11-15 :

+1 new seed of Qadars; +1 new seed of Tinba; +1 new family Vawtrak and 2 seeds

2016-11-11 :

+1 new seed of Locky v3

2016-11-10 :

+1 new version of Suppobox. For more details, please go to issue #29 at Github

2016-11-08 :

+1 new seeds of Banjori and opened issue #28 for more details

2016-11-07 :

+1 new seeds of Necurs

2016-11-04 :

+4 new seeds of Nymaim

2016-10-28 :

+2 new seeds of Qadars

+1 new seeds of Gameover

2016-10-27 :

+4 new seeds of Simda

2016-10-26 :

+4 new seeds of Tinba

2016-10-24 :

+1 new family Chinad and updated details in issue 1

2016-10-14 :

+1 new seed of Simda and updated details of this seed in issue 3

2016-10-11 :

+1 new seed of Murofet and updated details of this seed in issue 11

2016-10-10 :

+1 new seed of Ranbyus

Opened issue 27 for some details of this new seed

2016-09-28 :

+new family Ranbyus and 3 seeds

2016-09-26 :

opened issues 26 at Github

2016-09-22 :

+1 new seed of Banjori

opened 4 new issues at Github

2016-09-21 :

+2 new seeds of Tinba

opened 5 new issues at Github

2016-09-13 :

+new family Murofet

2016-09-08 :

+new family Proslikefan

2016-09-06 :

+new family Cryptolocker

2016-09-01 :

+new family Qadars

...

abcbot

tld: [tk, com, pages.dev]
sld: A fix length of 9, a-z chars; 27 domains per month
time dependent: Yes
e.g:
nerjyzkup.com
knjpeuzyr.tk
zrkyenupj.pages.dev

antavmu

tld: [com, net, org, duckdns.org]
sld: A fix length of 8, hexadecimal notation; 16 domains per day
time dependent: Yes
e.g:
2c2b3749.com
4933c012.net
c92e3378.duckdns.org

ares

tld: [com, net, org, info, biz]
sld: A length of 8-25, a-z; 50 domains per 10 days
time dependent: Yes
e.g:
lsuliwpuhovocjeyjxlggotft.info
affptoavdvnmqyf.biz
jsnrmrzwiulbmjpniafmbsheu.com

bamital

tld: [co.cc, cz.cc, info, org]
sld: Like md5 hash value; 26 domains per day
time dependent: Yes
e.g:
cd8f66549913a78c5a8004c82bcf6b01.info
aa24603b0defd57ebfef34befde16370.cz.cc
5e6efdd674c134ddb2a7a2e3c603cc14.org

banjori

tld: Same as seed domain
sld: Only change the first 4 letters of the seed domain; 2196 or 15372 domains in total
time dependent: No
e.g:
earnestnessbiophysicalohax.com
kwtoestnessbiophysicalohax.com
rvcxestnessbiophysicalohax.com

bazardoor

tld: [bazar]
sld: A fix length of 12; 2160 domains per month
time dependent: Yes
e.g:
aceijlahgijp.bazar
acfiimahhiiq.bazar
efhijkekjijo.bazar

bigviktor

tld: [art, click, club, com, fans, futbol, in, info, link, net, nl, observer, one, org, pictures, realty, rocks, tel, top, xyz]
sld: Combined 3~4 words from four predefined dictionaries; 1000 new domains per month
time dependent: Yes
e.g:
support.showremote-conclusion.fans
turntruebreakfast.futbol
speakoriginalworld.one

blackhole

tld: [ru]
sld: Fix length of 16, a-z, 2 domains per day
time dependent: Yes
e.g:
mkjdkbwuxcnuxtqd.ru
ppxhzopqbiykuucv.ru
tmlrjxvvrvkyxofn.ru

ccleaner

tld: [com]
sld: A length of 11-13, mix a-f and 0-9; 1 domain per month
time dependent: Yes
e.g:
ab1145b758c30.com
ab890e964c34.com
ab3d685a0c37.com

chinad

tld: [com, org, net, biz, info, ru, cn]
sld: A fix length of 16, mix a-z and 0-9; 1000 domains per day
time dependent: Yes
e.g:
qowhi81jvoid4j0m.biz
29cqdf6obnq462yv.com
5qip6brukxyf9lhk.ru

conficker

conficker.a

tld: [com, net, org, info, biz]
sld: A length of 5-11, a-z chars; 250 domains per day
time dependent: Yes
e.g:
gfedo.info
ydqtkptuwsa.org
bnnkqwzmy.biz

conficker.b

tld: [cc, cn, ws, com, net, org, info, biz]
sld: A length of 5-11, a-z chars; 250 domains per day
time dependent: Yes
e.g:
glrmwqh.net
ibymtpyd.info
bxyozfikd.ws

copperstealer

tld: [com, club, xyz]
sld: A fix length of 16, hexadecimal notation; 11 domains per month or 1 domain per day
time dependent: Yes
e.g:
7f11c4618671a7a1.com
1cd81defbab5fc17.xyz
6105cd51cc90af7b.club

cryptolocker

tld: [com, net, biz, ru, org, co.uk, info]
sld: A length of 12-15, a-y; 1000 domains per week
time dependent: Yes
e.g:
nvjwoofansjbh.ru
qgrkvevybtvckik.org
eqmbcmgemghxbcj.co.uk

dircrypt

tld: [com]
sld: A length of 8-20, a-z chars; 30 domains in total
time dependent: No
e.g:
rauggyguyp.com
mycojenxktsmozzthdv.com
hpaxgpkteomjaxywwelr.com

dmsniff

tld: [com, org, net, ru, in]
sld: A fix length of 8, a-z chars; 50 domains in total
time dependent: No
e.g:
kojnwyop.org
albdfhln.com
enmspvru.net

dyre

tld: [cc, ws, to, in, hk, cn, tk, so]
sld: Fix length of 34, 1 char[a-z] + 33 characters from SHA256; 1000 domains per day
time dependent: Yes
e.g:
l54c2e21e80ba5471be7a8402cffb98768.so
wdd7ee574106a84807a601beb62dd851f0.hk
jaa12148a5831a5af92aa1d8fe6059e276.ws

emotet

tld: [eu]
sld: Fix length of 16, a-y; 96 new domains per day
time dependent: Yes
e.g:
grdawgrcwegpjaoo.eu
mcfpeqbotiwxfxqu.eu
adgxwxhqsegnrsih.eu

enviserv

tld: [com, net, org, info, biz, in]
sld: A fix length of 10, hexadecimal notation; 500 domains in total
time dependent: No
e.g:
fe28753777.com
9dcd84b090.net
02261e64b3.org

feodo

tld: [ru]
sld: A length of 16|18, a-z; 97|65 domains in total
time dependent: No
e.g:
dvyfuaopltfxjzsp.ru
fzcnuyiqrrkriwex.ru
anidgwelnidmzueoyl.ru

flubot

tld: [ru, com, cn, su]
sld: A length of 15, a-y; 5000 domains per month
time dependent: Yes
e.g:
bsgejiagbavgavk.cn
jnouayonvoquria.ru
dmbwqpsdokcreiw.ru

fobber

fobber_v1

tld: [net]
sld: Fix length of 17, a-z; 300 domains in total
time dependent: No
e.g:
zzwzzqmihkfdevymi.net
twkpwfuecvvzcincq.net
oasmavkjmcxctdkit.net

fobber_v2

tld: [com]
sld: Fix length of 10, a-z; 300 domains in total
time dependent: No
e.g:
fmrehxdqmf.com
aqihsbqhwl.com
sxtolapbbm.com

gameover

tld: [com, org, biz, net]
sld: A length of 20-28, mix a-z and 0-9; 1000 domains per day
time dependent: Yes
e.g:
14dtuor1aubbmjhgup7915tlinc.net
2id0lapmam6w1799w7315zaqj5.com
uhjmkm1i7oih11i3wxl71kcf7x6.org

gspy

tld: [net|info], depend on seed
sld: Fix length of 16, hexadecimal notation; 50 domains in total
time dependent: No
e.g:
484b072f94637588.net
3164168f83658393.net
abfb8a26a85ff915.info

kfos

tld: [com, ml, net, ru, tw]
sld: 135 domains in total
time dependent: No
e.g:
service-goole.tw
mails-googles.ml
apks-google.net

locky

locky_v1

tld: [ru, pw, eu, in, yt, pm, us, fr, de, it, be, uk, nl, tf]
sld: A length of 5-15, a-y; 6 domains per two days
time dependent: Yes
e.g:
lpfpdovapot.ru
yffgcbcmffuaus.pw
tdgwenunlerl.tf

locky_v2

tld: [ru, pw, eu, in, yt, pm, us, fr, de, it, be, uk, nl, tf]
sld: A length of 5-15, a-y; 8 domains per two days
time dependent: Yes
e.g:
nspxuqqsb.de
qidvccmulectbc.yt
ralqmyajrtuffli.pm

locky_v3

tld: [ru, info, biz, click, su, work, pl, org, pw, xyz]
sld: A length of 7-17, a-y; 12 domains per two days
time dependent: Yes
e.g:
uxesqomhp.ru
btqeesfxslmmhumv.xyz
itqjkdhhtnmw.click

m0yv

tld: [biz]
sld: A length of 5-9, a-z; 128 domains in total
time dependent: No
e.g:
saytjshyf.biz
oshhkdluh.biz
sxmiywsfv.biz

madmax

tld: [com, org, info, net]
sld: Fix length of 10, mix a-z and 0-9, prefixed with www; 1 domain per week
time dependent: Yes
e.g:
www.avuhtrgawe.org
www.s82r4luxrw.com
www.9varj35nsb.net

matsnu

tld: [com]
sld: Combined 2~3 words from two predefined dictionaries; 10 new domains per day
time dependent: Yes
e.g:
world-bite-care.com
activitypossess.com
mattermiss-type.com

metastealer

tld: [xyz]
sld: Fix length of 16, ["acegikmoqsuwy"]; 10000 domains in total
time dependent: No
e.g:
aaeisaeeuwmywqau.xyz
cessskcmkiuouoqc.xyz
eiemmwcssigogsuc.xyz

mirai

tld: [tech, online, support]
sld: Fix length of 12, a-y; at most 1 domain per day
time dependent: Yes
e.g:
divitpvjexxh.tech
xvrvdsuhphjg.online
ycydknpltoff.support

monerominer

tld: [org, tickets, blackfriday, hosting, feedback]
sld: Fix length of 13, hexadecimal notation; 2495 domains per day
time dependent: Yes
e.g:
5c95f79304b49.org
8f0861affbe07.tickets
b6db582042a16.blackfriday

murofet

tld: [biz, info, org, net, com]
sld: A length of 8-16, a-z; 1020 domains per day
time dependent: Yes
e.g:
uqiqvqylwlhutwvh.info
hwpouvoxrtsdb.org
vwuqskjnuorzwy.net

mydoom

tld: [com, biz, us, net, org, ws, info, in]
sld: A length of 10, ["aehmnpqrsw"]; 51 domains per day
time dependent: Yes
e.g:
wmhmqsqsqa.in
awrapnpaqn.com
swaqwnhnhs.biz

mykings

tld: [pw]
sld: Fix length of 10, hexadecimal notation; 81 domains per month
time dependent: Yes
e.g:
5d024b15b7.pw
dddee683c2.pw
192cbd00c4.pw

necro

tld: [xyz]
sld: A fix length of 16, a-z; 2048 domains in total
time dependent: No
e.g:
aveixucyimxwcmph.xyz
aormvwoatoggyqbk.xyz
masedcnvywedjwvd.xyz

necurs

tld: [tj, in, jp, tw, ac, cm, la, mn, so, sh, sc, nu, nf, mu, ms, mx, ki, im, cx, cc, tv, bz, me, eu, de, ru, co, su, pw, kz, sx, us, ug, ir, to, ga, com, net, org, biz, xxx, pro, bit]
sld: A length of 7-21, a-y; 2048 domains per three days
time dependent: Yes
e.g:
wiyqgyiwgm.ga
otenbmgbpuskiasvehxm.ki
mgvnbuxoab.su

ngioweb

tld: [net, info, com, biz, org, name]
sld: Combined words from three wordlists; 300|1024 domains in total
time dependent: No
e.g:
overecobism-revacidom-ultrasaxeship.org
rexarurission.biz
monosideless-disogupic.com

nymaim

tld: [com, org, biz, net, info, ru, in, xyz, pw]
sld: A length of 5-12, a-z; 30|128 domains per day
time dependent: Yes
e.g:
onrfza.info
zzayzoabsi.net
msfctioj.biz

omexo

tld: [net]
sld: A fix length of 32, hexadecimal notation; 20 domains in total
time dependent: No
e.g:
eef795a4eddaf1e7bd79212acc9dde16.net
fff1834cbcd5ba96ca75fdae9c44cf5d.net
35262768764bd6c908c386b532a3dc2f.net

padcrypt

tld: [com, co.uk, de, org, net, eu, info, online, co, cc, website, tk, ga]
sld: A fix length of 16, [abcdefklmno]; 24 or 72 domains per day
time dependent: Yes
e.g:
mdadbfcmnelbfbac.website
adbbfbdnddbodacd.online
nnfbcfbdeacnabca.de

proslikefan

tld: [eu, biz, se, info, com, net, org, ru, in, name]
sld: A length of 6-13, a-z; 100 domains per day
time dependent: Yes
e.g:
nuipkjqarq.in
batvyct.name
ucjxkkdl.eu

pykspa

pykspa_v1

tld: [biz, com, net, org, info, cc]
sld: A length of 6-15, a-z; 5000 domains per two days
time dependent: Yes
e.g:
agadss.biz
ynrvwgfqbex.org
ssegsguiwcymao.biz

pykspa_v2_fake

tld: [com, net, org, info]
sld: A length of 6-12, a-z; 800 domains per day
time dependent: Yes
e.g:
xipbnmewshm.com
vgzmmusmr.org
fuvqigsobkt.info

pykspa_v2_real

tld: [com, net, org, info]
sld: A length of 6-12, a-z; 200 domains per nearly 20 days
time dependent: Yes
e.g:
zyvitnfjqobf.net
kwukwsgcyemi.org
qzutfvvmvs.info

qadars

tld: [com, org, net]
sld: Fix length of 12, mix a-z and 0-9; 200 domains per week
time dependent: Yes
e.g:
4lazgdincdaf.org
lmjwd6fs9ur4.com
3slanc9aj4hy.net

qakbot

tld: [com, net, org, info, biz]
sld: A length of 8-25, a-z; 5000 domains per 10 days
time dependent: Yes
e.g:
tzlpfigcxloxv.org
ukhbrsxwk.com
zxfgrqpcyz.biz

ramnit

tld: [com]
sld: A length of 8-19, a-y; 500|1000 domains in total, depend on seed
time dependent: No
e.g:
jrkaxdlkvhgsiyknhw.com (seed 01)
mtsoexdphaqliva.com (seed 02)
knpqxlxcwtlvgrdyhd.com (seed 03)

ranbyus

tld: [in, me, cc, su, tw, net, com, pw, org]
sld: A fix length of 14|17, a-y; 40 new domains per day
time dependent: Yes
e.g:
oswwsbsmibofdi.net
nslxbdyiofityx.com
pnejirjyxjmycx.pw

rovnix

tld: [ru, com, net, biz, cn]
sld: A fix length of 18, mix a-z and 1-8; Generated 10000 domains, actually infinity in theory
time dependent: No
e.g:
rc7thuhy8agn43zzgi.biz
aby71fqwc3ai12wseh.com
lryja5lrm835m7byr8.ru

shifu

tld: [info]
sld: Fix length of 7, a-y; 1000 domains in total
time dependent: No
e.g:
urkaelt.info
nqqxqdg.info
rsymdhk.info

shiotob

tld: [com, net]
sld: A length of 10-15, mix a-z and [1-5, 9]; 2000 domains in total
time dependent: No
e.g:
qq3adkdlzbcq43u.com
wwdnioqno3p9k2x.com
wfm1h3eo95gc.net

simda

tld: [eu | com | info], depend on seed
sld: The length of SLD depend on seed, mix ["eyuioa"] and ["qwrtpsdfghjklzxcvbnmv"]; the number of domains in total range from 1500 to 2500 in general
time dependent: No
e.g:
digivehusyd.eu (seed 01)
puvecyq.info (seed 02)
lymylur.com (seed 03)

suppobox

suppobox_v1

tld: [net]
sld: Combined two words from the wordlist; ~254 domains per day
time dependent: Yes
e.g:
sharmainewestbrook.net (from wordlist 3)
tablethirteen.net (from wordlist 2)
childrencatch.net (from wordlist 1)

suppobox_v2

tld: [net, ru]
sld: Combined two words from the wordlist; ~783 domains per day
time dependent: Yes
e.g:
stephaniebernadine.ru (from wordlist 3)
arivenice.ru (from wordlist 2)
thinkgoodbye.ru (from wordlist 1)

symmi

tld: [ddns.net]
sld: A length of 8-15, mix ["aeiouy"] and ["bcdfghklmnpqrstvwxz"]; 64 domains per half of month
time dependent: Yes
e.g:
ikogrihaa.ddns.net
ukbounapimusamx.ddns.net
kuinechivuonlo.ddns.net

tempedreve

tld: [net, org, info, com]
sld: A length of 7-11, a-z; 204 domains in total
time dependent: No
e.g:
mjmlivmvulk.com
ahskjnrhueg.net
qpedefirs.org

tinba

tld: variant, depend on seed
sld: Fix length of 12, a - y;100 | 200 | 1000 domains in total, depend on seed
time dependent: No
e.g:
nvfowikhevmy.com
oykjietwrmlw.ru
oqxvkgnpxhyi.in

tinynuke

tld: com
sld: Fix length of 32, 32 domains per day
time dependent: Yes
e.g:
8c28b41611c50aa0494df096e4d0444b.com
e8d1e174d60449c80a849936eff4fe9e.com
3ce623333166e4a227d5eb2fef098f60.com

tofsee

tld: [biz, ch]
sld: Fix length of 7, a-z; 20 domains per week
time dependent: Yes
e.g:
dqhdqhd.biz
dqgdqga.ch
dqgdqgj.biz

tordwm

tld: [top]
sld: A fix length of 8, hexadecimal notation; 510 domains per day
time dependent: Yes
e.g:
f0fe6744.top
5cac9065.top
bfdb1290.top

uid0js

tld: [xyz]
sld: A length of 4-8, hexadecimal notation; 500 domains per day
time dependent: Yes
e.g:
15736cd4.xyz
5b5b312.xyz
65ceb.xyz

vawtrak

tld: variant, depend on seed
sld: A length of 7-11, a-z; 150 domains in total
time dependent: No
e.g:
kdcbwvehop.top
wxcjqzqp.top
fwxcrqdsrs.ru

vidro

tld: [dyndns.org, com, net]
sld: A length of 7-12, a-z; 100 domains per week
time dependent: Yes
e.g:
jfxetiogrvo.dyndns.org
ckdypldcxi.com
ilaalsylt.net

virut

tld: [com]
sld: Fix length of 6, a-z; 10000 domains per day
time dependent: Yes
e.g:
hgznsb.com
yvvioe.com
zuzmoq.com

wauchos

tld: [com, net, org, ru, tv]
sld: Fix length of 10, a-z; 5940 domains in total
time dependent: No
e.g:
ohgzincfkp.org
olofapmxgl.net
pqxgtujorq.com

xshellghost

tld: [com]
sld: A length of 10-15, a-z; 1 domain per month
time dependent: Yes
e.g:
huxerorebmzir.com
nylalobghyhirgh.com
zgjevclifqpexor.com

zloader

tld: [com]
sld: Fix length of 20, a-y; 32 domains per day
time dependent: Yes
e.g:
qbhxqjlphxqfxmruxupd.com
gucdhwpcfjmmcefypliv.com
kffunqtohreoaejntwov.com

Want to make contributions?

Our DGA Detecting System sifts through our massive pdns data and malware samples for the latest suspicious DGAs in real time. And we come across interesting domain names and/or MD5 samples all the time.

We would encourage fellow security researchers to provide their insights and contribute their ideas on our GitHub Repo , where we list some of the uncertain dns and md5 samples for further analysis.