After 6 years of providing free service, we regretfully decide to end the free DGA feeds as the current practice is not sustainable. If your business needs commercial license, please contact netlab@360.cn for pricing information. Thanks.
2023-02-23 : |
+1 new family MetaStealer. Thanks to WangHao. |
|
2023-02-06 : |
+1 new seed of Symmi. Thanks to WangHao. |
|
2022-12-30 : |
+1 new family Uid0js. Thanks to HeZiqian. |
|
2022-12-28 : |
+1 new family Mykings. |
|
2022-12-07 : |
+1 new seed of Antavmu(AKA Orchard). Thanks to RenDaji. |
|
2022-11-08 : |
+2 new seeds of Ranbyus. Thanks to Lvxing. |
|
2022-09-07 : |
+1 new family Ares. Thanks to Liuya and Zscaler. |
|
2022-08-22 : |
+1 new family Zloader. Thanks to Lvxing and Baderj. |
|
2022-08-05 : |
+1 new seed of Antavmu(AKA Orchard). Thanks to RenDaji. |
|
2022-08-01 : |
+1 new family BazarDoor. Thanks to WangHao. |
|
2022-07-05 : |
+1 new seed of Antavmu(AKA Orchard). Thanks to RenDaji. |
|
2022-07-04 : |
+1 new seed of Ramnit. +1 new seed of Qadars. Thanks to Alex.Turing. |
|
2022-05-24 : |
+1 new seed of Tempedreve. Thanks to WangHao. |
|
2022-05-06 : |
+2 new seeds of Tinba. Thanks to WangHao. |
|
2022-03-30 : |
+2 new seeds of Ranbyus. +2 new seeds of Locky. Thanks to WangHao. |
|
2022-03-23 : |
+1 new family Wauchos. Thanks to Alex.Turing. +1 new family DMSniff. Thanks to RenDaji and FlashPoint. |
|
2022-03-23 : |
+1 new seed of Tinba. +1 new seed of Ramnit. Thanks to WangHao. |
|
2022-03-15 : |
+1 new seed of Necro. Thanks to Xuyang. |
|
2022-01-05 : |
+1 new family M0yv. Thanks to WangHao. |
|
2021-12-28 : |
+1 new family Qakbot. Thanks to WangHao. |
|
2021-11-18 : |
+1 new family Tordwm. Thanks to Alex.Turing. |
|
2021-11-15 : |
+1 new family Abcbot. Thanks to Alex.Turing. |
|
2021-09-08 : |
+1 new seed of Antavmu. Thanks to RenDaji. |
|
2021-09-02 : |
+1 new seed of Mydoom(time independent DGA). Thanks to RenDaji. |
|
2021-08-27 : |
+1 new seed of Ngioweb. Thanks to Alex.Turing. |
|
2021-08-24 : |
+1 new family CopperStealer. Thanks to ChaiLinyuan and ProofPoint. |
|
2021-08-23 : |
+1 new family Monerominer. Thanks to RenDaji. |
|
2021-07-28 : |
+1 new seed of Necro. Thanks to Xuyang. |
|
2021-06-17 : |
+1 new family Flubot. The Python code comes from prodaft's Github, thanks for sharing. |
|
2021-05-13 : |
+1 new seed of Necro. Thanks to Xuyang. |
|
2021-04-16 : |
+1 new seed of Simda. |
|
2021-04-15 : |
+1 new family Antavmu. Thanks to RenDaji. |
|
2021-04-12 : |
+1 new seed of Simda. |
|
2021-04-06 : |
+1 new family Kfos. Thanks to Liuya. +3 new seeds of Simda. |
|
2021-03-12 : |
+1 new seed of Necro. Thanks to Jinye. |
|
2021-01-21 : |
+1 new family Necro. Thanks to Jinye. |
|
2021-01-07 : |
+1 new seed of Ngioweb. |
|
2020-11-20 : |
+1 new seed of Banjori. |
|
2020-11-16 : |
+1 new seed of Banjori. |
|
2020-11-13 : |
+1 new family Ngioweb. Thanks to Alex.Turing. |
|
2020-07-28 : |
+1 new seed of Simda. |
|
2020-07-10 : |
+1 new family Bigviktor. Thanks to Alex.Turing. |
|
2020-01-17 : |
+1 new seed of Ramnit. |
|
2019-11-21 : |
+1 new seed of Ramnit. |
|
2019-10-18 : |
+1 new seed of Ramnit. |
|
2019-10-08 : |
+3 new seeds of Ramnit. |
|
2019-09-12 : |
+2 new seeds of Ramnit. |
|
2019-09-06 : |
+2 new seeds of Ramnit. |
|
2019-09-03 : |
+1 new family Enviserv. Details in issue #53. +1 new seed of Tinba. |
|
2019-09-02 : |
+1 new seed of Ramnit. |
|
2019-08-21 : |
+1 new seed of Ramnit. |
|
2019-04-28 : |
+1 new seed of Ramnit. |
|
2019-04-25 : |
+1 new seed of Feodo. |
|
2019-04-09 : |
+1 new seed of Ramnit. |
|
2019-04-02 : |
+1 new seed of Ramnit. |
|
2019-03-25 : |
+1 new seed of Ramnit. |
|
2019-03-13 : |
+1 new seed of Ramnit. |
|
2019-03-05 : |
+1 new family Shiotob. Details in issue #51. |
|
2019-02-28 : |
+1 new seed of Ramnit. +1 new seed of Locky. |
|
2019-02-25 : |
+1 new seed of Nymaim. |
|
2019-02-18 : |
+1 new seed of Ramnit. |
|
2019-01-31 : |
+1 new seed of Ranbyus. +1 new seed of Ramnit. |
|
2019-01-29 : |
+1 new seed of Ramnit. |
|
2019-01-22 : |
+1 new seed of Tinba. |
|
2019-01-14 : |
+2 new seeds of Ramnit. |
|
2019-01-08 : |
+1 new family Feodo. +1 new seed of Ramnit. |
|
2019-01-07 : |
+1 new family Mydoom. Details in issue #49. |
|
2018-11-22 : |
+1 new seed of Tinba. |
|
2018-11-19 : |
+2 new seeds of Ramnit. |
|
2018-11-15 : |
+1 new seed of Murofet. |
|
2018-11-12 : |
+1 new seed of Vawtrak. |
|
2018-11-07 : |
+2 new seeds of Vawtrak. +1 new seed of Ramnit. |
|
2018-11-05 : |
+1 new seed of Dircrypt. +1 new seed of Banjori. |
|
2018-10-29 : |
+1 new seed of Vawtrak. +1 new seed of Omexo. |
|
2018-10-24 : |
+1 new seed of Dircrypt. +1 new seed of Ramnit. |
|
2018-10-23 : |
+1 new seed of Ramnit. |
|
2018-10-22 : |
+1 new seed of Dircrypt. +2 new seeds of Ramnit. |
|
2018-10-17 : |
+1 new seed of Ramnit. +1 new seed of Qadars. +1 new family Omexo. |
|
2018-10-15 : |
+1 new seed of Tinba. +1 new seed of Ranbyus. |
|
2018-10-10 : |
+1 new seed of Tinba. +5 new seeds of Dircrypt. |
|
2018-10-09 : |
+1 new seed of Nymaim. +1 new seed of Murofet. +1 new seed of Banjori. |
|
2018-05-04 : |
+1 new seed of Dircrypt. Thanks Baderj. Details in issue #12. |
|
2018-04-10 : |
+2 new seeds of Murofet. Details in issue #43. +9 new seeds of Ramnit. |
|
2018-04-08 : |
+3 new seeds of Tinba. +3 new seeds of Ranbyus. |
|
2018-03-02 : |
+1 new family Tinynuke. |
|
2018-01-12 : |
+18 new seeds of Ramnit. |
|
2018-01-11 : |
+3 new seeds of Locky. +4 new seeds of Ramnit. |
|
2017-11-08 : |
+3 new seeds of Banjori. Details in issue #39. |
|
2017-10-17 : |
+15 new seeds of Ramnit. Extracted from CERT.PL blog, thanks for sharing. |
|
2017-09-20 : |
+1 new family CCleaner. Thanks to 360CERT. |
|
2017-08-28 : |
+2 new seeds of Tinba. |
|
2017-08-23 : |
+2 new seeds of Tinba. +4 new seeds of Dircrypt. |
|
2017-08-14 : |
+1 new family XshellGhost. Details in issue #38. |
|
2017-07-27 : |
+3 new seeds of Locky. |
|
2017-06-30 : |
+1 new seed of Ramnit. |
|
2017-05-18 : |
+1 new seed of Padcrypt. Details in issue #34. +1 new family Padcrypt. The Python code comes from baderj's Github, thanks for sharing. |
|
2017-05-11 : |
+1 new seed of Locky. Extracted from Nominum blog, thanks for sharing. |
|
2017-05-04 : |
+1 new seed of Qadars. +1 new seed of Simda. +1 new seed of Tinba. |
|
2017-04-13 : |
+1 new seed of Qadars. +2 new seed of Simda. +1 new seed of Ramnit. |
|
2017-04-11 : |
+1 new family Blackhole. |
|
2017-03-21 : |
+1 new family Matsnu. |
|
2017-03-09 : |
+37 seeds of Locky. Thanks to John Bambenek for providing these Locky V3 seeds. |
|
2017-03-07 : |
+1 new family Emotet. +1 new seed of Locky. +1 new seed of Nymaim. +1 new seed of Ramnit. |
|
2017-02-23 : |
+1 new seed of Qadars. |
|
2017-01-20 : |
+3 new seeds of Ramnit; +1 new seed of Tinba. |
|
2017-01-18 : |
+1 new seeds of Locky. +1 new seed of Qadars. +1 new seed of Nymaim. |
|
2017-01-06 : |
+2 new seeds of Shifu; +1 new seed of Murofet. |
|
2017-01-05 : |
+7 new seeds of Tinba; +3 new seeds of Banjori. |
|
2017-01-04 : |
+25 new seeds of Banjori. |
|
2016-12-30 : |
+1 new family Gspy and 2 seeds. +6 new seeds of Tinba. +1 new family Tofsee. The implementation comes from GovCERT.ch blog, thanks for sharing. |
|
2016-12-22 : |
+1 new family Vidro. Details in issue #31. |
|
2016-12-16 : |
+1 new seed of Mirai. |
|
2016-12-12 : |
+1 new family Mirai. More details, please go to our blog: Now Mirai Has DGA Feature Built in. |
|
2016-12-02 : |
+1 new seed of Murofet. Details in issue #30. |
|
2016-11-29 : |
+16 new seeds of Rovnix. Bruteforce reverse engineering these Rovnix seeds, through PDNS clues. |
|
2016-11-25 : |
+1 new seed of Rovnix; +3 new seeds of Locky |
|
2016-11-23 : |
+1 new family Rovnix |
|
2016-11-15 : |
+1 new seed of Qadars; +1 new seed of Tinba; +1 new family Vawtrak and 2 seeds |
|
2016-11-11 : |
+1 new seed of Locky v3 |
|
2016-11-10 : |
+1 new version of Suppobox. For more details, please go to issue #29 at Github |
|
2016-11-08 : |
+1 new seeds of Banjori and opened issue #28 for more details |
|
2016-11-07 : |
+1 new seeds of Necurs |
|
2016-11-04 : |
+4 new seeds of Nymaim |
|
2016-10-28 : |
+2 new seeds of Qadars +1 new seeds of Gameover |
|
2016-10-27 : |
+4 new seeds of Simda |
|
2016-10-26 : |
+4 new seeds of Tinba |
|
2016-10-24 : |
+1 new family Chinad and updated details in issue 1 |
|
2016-10-14 : |
+1 new seed of Simda and updated details of this seed in issue 3 |
|
2016-10-11 : |
+1 new seed of Murofet and updated details of this seed in issue 11 |
|
2016-10-10 : |
+1 new seed of Ranbyus Opened issue 27 for some details of this new seed |
|
2016-09-28 : |
+new family Ranbyus and 3 seeds |
|
2016-09-26 : |
opened issues 26 at Github |
|
2016-09-22 : |
+1 new seed of Banjori opened 4 new issues at Github |
|
2016-09-21 : |
+2 new seeds of Tinba opened 5 new issues at Github |
|
2016-09-13 : |
+new family Murofet |
|
2016-09-08 : |
+new family Proslikefan |
|
2016-09-06 : |
+new family Cryptolocker |
|
2016-09-01 : |
+new family Qadars |
|
... |
tld: | [tk, com, pages.dev] |
sld: | A fix length of 9, a-z chars; 27 domains per month |
time dependent: | Yes |
e.g: |
nerjyzkup.com
knjpeuzyr.tk
zrkyenupj.pages.dev
|
tld: | [com, net, org, duckdns.org] |
sld: | A fix length of 8, hexadecimal notation; 16 domains per day |
time dependent: | Yes |
e.g: |
2c2b3749.com
4933c012.net
c92e3378.duckdns.org
|
tld: | [com, net, org, info, biz] |
sld: | A length of 8-25, a-z; 50 domains per 10 days |
time dependent: | Yes |
e.g: |
lsuliwpuhovocjeyjxlggotft.info
affptoavdvnmqyf.biz
jsnrmrzwiulbmjpniafmbsheu.com
|
tld: | [co.cc, cz.cc, info, org] |
sld: | Like md5 hash value; 26 domains per day |
time dependent: | Yes |
e.g: |
cd8f66549913a78c5a8004c82bcf6b01.info
aa24603b0defd57ebfef34befde16370.cz.cc
5e6efdd674c134ddb2a7a2e3c603cc14.org
|
tld: | Same as seed domain |
sld: | Only change the first 4 letters of the seed domain; 2196 or 15372 domains in total |
time dependent: | No |
e.g: |
earnestnessbiophysicalohax.com
kwtoestnessbiophysicalohax.com
rvcxestnessbiophysicalohax.com
|
tld: | [bazar] |
sld: | A fix length of 12; 2160 domains per month |
time dependent: | Yes |
e.g: |
aceijlahgijp.bazar
acfiimahhiiq.bazar
efhijkekjijo.bazar
|
tld: | [art, click, club, com, fans, futbol, in, info, link, net, nl, observer, one, org, pictures, realty, rocks, tel, top, xyz] |
sld: | Combined 3~4 words from four predefined dictionaries; 1000 new domains per month |
time dependent: | Yes |
e.g: |
support.showremote-conclusion.fans
turntruebreakfast.futbol
speakoriginalworld.one
|
tld: | [ru] |
sld: | Fix length of 16, a-z, 2 domains per day |
time dependent: | Yes |
e.g: |
mkjdkbwuxcnuxtqd.ru
ppxhzopqbiykuucv.ru
tmlrjxvvrvkyxofn.ru
|
tld: | [com] |
sld: | A length of 11-13, mix a-f and 0-9; 1 domain per month |
time dependent: | Yes |
e.g: |
ab1145b758c30.com
ab890e964c34.com
ab3d685a0c37.com
|
tld: | [com, org, net, biz, info, ru, cn] |
sld: | A fix length of 16, mix a-z and 0-9; 1000 domains per day |
time dependent: | Yes |
e.g: |
qowhi81jvoid4j0m.biz
29cqdf6obnq462yv.com
5qip6brukxyf9lhk.ru
|
tld: | [com, net, org, info, biz] |
sld: | A length of 5-11, a-z chars; 250 domains per day |
time dependent: | Yes |
e.g: |
gfedo.info
ydqtkptuwsa.org
bnnkqwzmy.biz
|
tld: | [cc, cn, ws, com, net, org, info, biz] |
sld: | A length of 5-11, a-z chars; 250 domains per day |
time dependent: | Yes |
e.g: |
glrmwqh.net
ibymtpyd.info
bxyozfikd.ws
|
tld: | [com, club, xyz] |
sld: | A fix length of 16, hexadecimal notation; 11 domains per month or 1 domain per day |
time dependent: | Yes |
e.g: |
7f11c4618671a7a1.com
1cd81defbab5fc17.xyz
6105cd51cc90af7b.club
|
tld: | [com, net, biz, ru, org, co.uk, info] |
sld: | A length of 12-15, a-y; 1000 domains per week |
time dependent: | Yes |
e.g: |
nvjwoofansjbh.ru
qgrkvevybtvckik.org
eqmbcmgemghxbcj.co.uk
|
tld: | [com] |
sld: | A length of 8-20, a-z chars; 30 domains in total |
time dependent: | No |
e.g: |
rauggyguyp.com
mycojenxktsmozzthdv.com
hpaxgpkteomjaxywwelr.com
|
tld: | [com, org, net, ru, in] |
sld: | A fix length of 8, a-z chars; 50 domains in total |
time dependent: | No |
e.g: |
kojnwyop.org
albdfhln.com
enmspvru.net
|
tld: | [cc, ws, to, in, hk, cn, tk, so] |
sld: | Fix length of 34, 1 char[a-z] + 33 characters from SHA256; 1000 domains per day |
time dependent: | Yes |
e.g: |
l54c2e21e80ba5471be7a8402cffb98768.so
wdd7ee574106a84807a601beb62dd851f0.hk
jaa12148a5831a5af92aa1d8fe6059e276.ws
|
tld: | [eu] |
sld: | Fix length of 16, a-y; 96 new domains per day |
time dependent: | Yes |
e.g: |
grdawgrcwegpjaoo.eu
mcfpeqbotiwxfxqu.eu
adgxwxhqsegnrsih.eu
|
tld: | [com, net, org, info, biz, in] |
sld: | A fix length of 10, hexadecimal notation; 500 domains in total |
time dependent: | No |
e.g: |
fe28753777.com
9dcd84b090.net
02261e64b3.org
|
tld: | [ru] |
sld: | A length of 16|18, a-z; 97|65 domains in total |
time dependent: | No |
e.g: |
dvyfuaopltfxjzsp.ru
fzcnuyiqrrkriwex.ru
anidgwelnidmzueoyl.ru
|
tld: | [ru, com, cn, su] |
sld: | A length of 15, a-y; 5000 domains per month |
time dependent: | Yes |
e.g: |
bsgejiagbavgavk.cn
jnouayonvoquria.ru
dmbwqpsdokcreiw.ru
|
tld: | [net] |
sld: | Fix length of 17, a-z; 300 domains in total |
time dependent: | No |
e.g: |
zzwzzqmihkfdevymi.net
twkpwfuecvvzcincq.net
oasmavkjmcxctdkit.net
|
tld: | [com] |
sld: | Fix length of 10, a-z; 300 domains in total |
time dependent: | No |
e.g: |
fmrehxdqmf.com
aqihsbqhwl.com
sxtolapbbm.com
|
tld: | [com, org, biz, net] |
sld: | A length of 20-28, mix a-z and 0-9; 1000 domains per day |
time dependent: | Yes |
e.g: |
14dtuor1aubbmjhgup7915tlinc.net
2id0lapmam6w1799w7315zaqj5.com
uhjmkm1i7oih11i3wxl71kcf7x6.org
|
tld: | [net|info], depend on seed |
sld: | Fix length of 16, hexadecimal notation; 50 domains in total |
time dependent: | No |
e.g: |
484b072f94637588.net
3164168f83658393.net
abfb8a26a85ff915.info
|
tld: | [com, ml, net, ru, tw] |
sld: | 135 domains in total |
time dependent: | No |
e.g: |
service-goole.tw
mails-googles.ml
apks-google.net
|
tld: | [ru, pw, eu, in, yt, pm, us, fr, de, it, be, uk, nl, tf] |
sld: | A length of 5-15, a-y; 6 domains per two days |
time dependent: | Yes |
e.g: |
lpfpdovapot.ru
yffgcbcmffuaus.pw
tdgwenunlerl.tf
|
tld: | [ru, pw, eu, in, yt, pm, us, fr, de, it, be, uk, nl, tf] |
sld: | A length of 5-15, a-y; 8 domains per two days |
time dependent: | Yes |
e.g: |
nspxuqqsb.de
qidvccmulectbc.yt
ralqmyajrtuffli.pm
|
tld: | [ru, info, biz, click, su, work, pl, org, pw, xyz] |
sld: | A length of 7-17, a-y; 12 domains per two days |
time dependent: | Yes |
e.g: |
uxesqomhp.ru
btqeesfxslmmhumv.xyz
itqjkdhhtnmw.click
|
tld: | [biz] |
sld: | A length of 5-9, a-z; 128 domains in total |
time dependent: | No |
e.g: |
saytjshyf.biz
oshhkdluh.biz
sxmiywsfv.biz
|
tld: | [com, org, info, net] |
sld: | Fix length of 10, mix a-z and 0-9, prefixed with www; 1 domain per week |
time dependent: | Yes |
e.g: |
www.avuhtrgawe.org
www.s82r4luxrw.com
www.9varj35nsb.net
|
tld: | [com] |
sld: | Combined 2~3 words from two predefined dictionaries; 10 new domains per day |
time dependent: | Yes |
e.g: |
world-bite-care.com
activitypossess.com
mattermiss-type.com
|
tld: | [xyz] |
sld: | Fix length of 16, ["acegikmoqsuwy"]; 10000 domains in total |
time dependent: | No |
e.g: |
aaeisaeeuwmywqau.xyz
cessskcmkiuouoqc.xyz
eiemmwcssigogsuc.xyz
|
tld: | [tech, online, support] |
sld: | Fix length of 12, a-y; at most 1 domain per day |
time dependent: | Yes |
e.g: |
divitpvjexxh.tech
xvrvdsuhphjg.online
ycydknpltoff.support
|
tld: | [org, tickets, blackfriday, hosting, feedback] |
sld: | Fix length of 13, hexadecimal notation; 2495 domains per day |
time dependent: | Yes |
e.g: |
5c95f79304b49.org
8f0861affbe07.tickets
b6db582042a16.blackfriday
|
tld: | [biz, info, org, net, com] |
sld: | A length of 8-16, a-z; 1020 domains per day |
time dependent: | Yes |
e.g: |
uqiqvqylwlhutwvh.info
hwpouvoxrtsdb.org
vwuqskjnuorzwy.net
|
tld: | [com, biz, us, net, org, ws, info, in] |
sld: | A length of 10, ["aehmnpqrsw"]; 51 domains per day |
time dependent: | Yes |
e.g: |
wmhmqsqsqa.in
awrapnpaqn.com
swaqwnhnhs.biz
|
tld: | [pw] |
sld: | Fix length of 10, hexadecimal notation; 81 domains per month |
time dependent: | Yes |
e.g: |
5d024b15b7.pw
dddee683c2.pw
192cbd00c4.pw
|
tld: | [xyz] |
sld: | A fix length of 16, a-z; 2048 domains in total |
time dependent: | No |
e.g: |
aveixucyimxwcmph.xyz
aormvwoatoggyqbk.xyz
masedcnvywedjwvd.xyz
|
tld: | [tj, in, jp, tw, ac, cm, la, mn, so, sh, sc, nu, nf, mu, ms, mx, ki, im, cx, cc, tv, bz, me, eu, de, ru, co, su, pw, kz, sx, us, ug, ir, to, ga, com, net, org, biz, xxx, pro, bit] |
sld: | A length of 7-21, a-y; 2048 domains per three days |
time dependent: | Yes |
e.g: |
wiyqgyiwgm.ga
otenbmgbpuskiasvehxm.ki
mgvnbuxoab.su
|
tld: | [net, info, com, biz, org, name] |
sld: | Combined words from three wordlists; 300|1024 domains in total |
time dependent: | No |
e.g: |
overecobism-revacidom-ultrasaxeship.org
rexarurission.biz
monosideless-disogupic.com
|
tld: | [com, org, biz, net, info, ru, in, xyz, pw] |
sld: | A length of 5-12, a-z; 30|128 domains per day |
time dependent: | Yes |
e.g: |
onrfza.info
zzayzoabsi.net
msfctioj.biz
|
tld: | [net] |
sld: | A fix length of 32, hexadecimal notation; 20 domains in total |
time dependent: | No |
e.g: |
eef795a4eddaf1e7bd79212acc9dde16.net
fff1834cbcd5ba96ca75fdae9c44cf5d.net
35262768764bd6c908c386b532a3dc2f.net
|
tld: | [com, co.uk, de, org, net, eu, info, online, co, cc, website, tk, ga] |
sld: | A fix length of 16, [abcdefklmno]; 24 or 72 domains per day |
time dependent: | Yes |
e.g: |
mdadbfcmnelbfbac.website
adbbfbdnddbodacd.online
nnfbcfbdeacnabca.de
|
tld: | [eu, biz, se, info, com, net, org, ru, in, name] |
sld: | A length of 6-13, a-z; 100 domains per day |
time dependent: | Yes |
e.g: |
nuipkjqarq.in
batvyct.name
ucjxkkdl.eu
|
tld: | [biz, com, net, org, info, cc] |
sld: | A length of 6-15, a-z; 5000 domains per two days |
time dependent: | Yes |
e.g: |
agadss.biz
ynrvwgfqbex.org
ssegsguiwcymao.biz
|
tld: | [com, net, org, info] |
sld: | A length of 6-12, a-z; 800 domains per day |
time dependent: | Yes |
e.g: |
xipbnmewshm.com
vgzmmusmr.org
fuvqigsobkt.info
|
tld: | [com, net, org, info] |
sld: | A length of 6-12, a-z; 200 domains per nearly 20 days |
time dependent: | Yes |
e.g: |
zyvitnfjqobf.net
kwukwsgcyemi.org
qzutfvvmvs.info
|
tld: | [com, org, net] |
sld: | Fix length of 12, mix a-z and 0-9; 200 domains per week |
time dependent: | Yes |
e.g: |
4lazgdincdaf.org
lmjwd6fs9ur4.com
3slanc9aj4hy.net
|
tld: | [com, net, org, info, biz] |
sld: | A length of 8-25, a-z; 5000 domains per 10 days |
time dependent: | Yes |
e.g: |
tzlpfigcxloxv.org
ukhbrsxwk.com
zxfgrqpcyz.biz
|
tld: | [com] |
sld: | A length of 8-19, a-y; 500|1000 domains in total, depend on seed |
time dependent: | No |
e.g: |
jrkaxdlkvhgsiyknhw.com (seed 01)
mtsoexdphaqliva.com (seed 02)
knpqxlxcwtlvgrdyhd.com (seed 03)
|
tld: | [in, me, cc, su, tw, net, com, pw, org] |
sld: | A fix length of 14|17, a-y; 40 new domains per day |
time dependent: | Yes |
e.g: |
oswwsbsmibofdi.net
nslxbdyiofityx.com
pnejirjyxjmycx.pw
|
tld: | [ru, com, net, biz, cn] |
sld: | A fix length of 18, mix a-z and 1-8; Generated 10000 domains, actually infinity in theory |
time dependent: | No |
e.g: |
rc7thuhy8agn43zzgi.biz
aby71fqwc3ai12wseh.com
lryja5lrm835m7byr8.ru
|
tld: | [info] |
sld: | Fix length of 7, a-y; 1000 domains in total |
time dependent: | No |
e.g: |
urkaelt.info
nqqxqdg.info
rsymdhk.info
|
tld: | [com, net] |
sld: | A length of 10-15, mix a-z and [1-5, 9]; 2000 domains in total |
time dependent: | No |
e.g: |
qq3adkdlzbcq43u.com
wwdnioqno3p9k2x.com
wfm1h3eo95gc.net
|
tld: | [eu | com | info], depend on seed |
sld: | The length of SLD depend on seed, mix ["eyuioa"] and ["qwrtpsdfghjklzxcvbnmv"]; the number of domains in total range from 1500 to 2500 in general |
time dependent: | No |
e.g: |
digivehusyd.eu (seed 01)
puvecyq.info (seed 02)
lymylur.com (seed 03)
|
tld: | [net] |
sld: | Combined two words from the wordlist; ~254 domains per day |
time dependent: | Yes |
e.g: |
sharmainewestbrook.net (from wordlist 3)
tablethirteen.net (from wordlist 2)
childrencatch.net (from wordlist 1)
|
tld: | [net, ru] |
sld: | Combined two words from the wordlist; ~783 domains per day |
time dependent: | Yes |
e.g: |
stephaniebernadine.ru (from wordlist 3)
arivenice.ru (from wordlist 2)
thinkgoodbye.ru (from wordlist 1)
|
tld: | [ddns.net] |
sld: | A length of 8-15, mix ["aeiouy"] and ["bcdfghklmnpqrstvwxz"]; 64 domains per half of month |
time dependent: | Yes |
e.g: |
ikogrihaa.ddns.net
ukbounapimusamx.ddns.net
kuinechivuonlo.ddns.net
|
tld: | [net, org, info, com] |
sld: | A length of 7-11, a-z; 204 domains in total |
time dependent: | No |
e.g: |
mjmlivmvulk.com
ahskjnrhueg.net
qpedefirs.org
|
tld: | variant, depend on seed |
sld: | Fix length of 12, a - y;100 | 200 | 1000 domains in total, depend on seed |
time dependent: | No |
e.g: |
nvfowikhevmy.com
oykjietwrmlw.ru
oqxvkgnpxhyi.in
|
tld: | com |
sld: | Fix length of 32, 32 domains per day |
time dependent: | Yes |
e.g: |
8c28b41611c50aa0494df096e4d0444b.com
e8d1e174d60449c80a849936eff4fe9e.com
3ce623333166e4a227d5eb2fef098f60.com
|
tld: | [biz, ch] |
sld: | Fix length of 7, a-z; 20 domains per week |
time dependent: | Yes |
e.g: |
dqhdqhd.biz
dqgdqga.ch
dqgdqgj.biz
|
tld: | [top] |
sld: | A fix length of 8, hexadecimal notation; 510 domains per day |
time dependent: | Yes |
e.g: |
f0fe6744.top
5cac9065.top
bfdb1290.top
|
tld: | [xyz] |
sld: | A length of 4-8, hexadecimal notation; 500 domains per day |
time dependent: | Yes |
e.g: |
15736cd4.xyz
5b5b312.xyz
65ceb.xyz
|
tld: | variant, depend on seed |
sld: | A length of 7-11, a-z; 150 domains in total |
time dependent: | No |
e.g: |
kdcbwvehop.top
wxcjqzqp.top
fwxcrqdsrs.ru
|
tld: | [dyndns.org, com, net] |
sld: | A length of 7-12, a-z; 100 domains per week |
time dependent: | Yes |
e.g: |
jfxetiogrvo.dyndns.org
ckdypldcxi.com
ilaalsylt.net
|
tld: | [com] |
sld: | Fix length of 6, a-z; 10000 domains per day |
time dependent: | Yes |
e.g: |
hgznsb.com
yvvioe.com
zuzmoq.com
|
tld: | [com, net, org, ru, tv] |
sld: | Fix length of 10, a-z; 5940 domains in total |
time dependent: | No |
e.g: |
ohgzincfkp.org
olofapmxgl.net
pqxgtujorq.com
|
tld: | [com] |
sld: | A length of 10-15, a-z; 1 domain per month |
time dependent: | Yes |
e.g: |
huxerorebmzir.com
nylalobghyhirgh.com
zgjevclifqpexor.com
|
tld: | [com] |
sld: | Fix length of 20, a-y; 32 domains per day |
time dependent: | Yes |
e.g: |
qbhxqjlphxqfxmruxupd.com
gucdhwpcfjmmcefypliv.com
kffunqtohreoaejntwov.com
|
Our DGA Detecting System sifts through our massive pdns data and malware samples for the latest suspicious DGAs in real time. And we come across interesting domain names and/or MD5 samples all the time.
We would encourage fellow security researchers to provide their insights and contribute their ideas on our GitHub Repo , where we list some of the uncertain dns and md5 samples for further analysis.