Malware
Domain generation algorithm
Also called DGA.
Domain generation algorithm is code in malware that produces a long list of pseudo-random domain names, so the controller can register a few and the infected machines can find them. Blocking yesterday's domain does not stop tomorrow's.
How it is measured
A DGA shows up as a burst of DNS lookups for names that look random, like `xk3jq9ztvb.com`, most returning NXDOMAIN. Defenders flag high NXDOMAIN rates from one host, entropy in the label, and domains registered on the same day at the same registrar.
Reverse-engineering the algorithm gives the full future list. Researchers then pre-register or sinkhole those names.
Worked example
A DNS log on a small office network shows one workstation making 340 lookups in ten minutes for names like `qwpzmrlk.net` and `hdtvbx0a.org`. 337 fail. Three succeed, all pointing to the same IP in a hosting range.
The admin isolates the machine, finds a scheduled task running a renamed DLL, and adds the three working domains to the blocklist. The next day the malware tries a fresh set, and the lookups keep failing until the file is removed.
How it differs
A DGA is a way of choosing where to phone home. C2 is the server at the end. A static blocklist can stop a fixed C2 address, but it lags behind a DGA by design, so defenders watch behavior such as repeated NXDOMAIN instead. A sinkhole takes the domain and redirects infected machines to a harmless server where they can be counted.
Common errors
Blocking the three domains that resolved and stopping. Treating all random-looking domains as malicious when some CDNs use them. Ignoring failed DNS. Filtering only by domain age. Not checking the host making the lookups.
In practice
Log DNS at the resolver and alert on a single host producing many failed lookups for unfamiliar names. When you find one, treat the host as compromised: isolate it, find the process, and clean it, rather than trying to chase every domain.