DGA (Domain Generation Algorithm)
A domain generation algorithm is code inside malware that produces a large list of domain names from a seed such as the date, so that the infected host can find its command server by trying names until one resolves. The operator, who knows the algorithm, registers only a few of the day’s names, and defenders cannot block a list they cannot predict.
Hard-coding a C2 domain into malware is fragile: once the domain is seized or blocked, every infected machine goes silent. A DGA removes that single point of failure. Each day the implant computes, say, a thousand candidate names from a shared seed and queries them in turn; the operator registers one or two of them in advance and the botnet reconverges.
The cost to the attacker is noise, and the noise is the tell. An infected host generates hundreds of DNS queries for names that do not exist, with high entropy, unusual lengths and consonant clusters no human would choose, and a burst of NXDOMAIN answers in the resolver log. That pattern is detectable without knowing the algorithm.
Intelligence adds two things. Reverse-engineered algorithms let trackers pre-compute the names for months ahead and publish them as indicators, and sinkholes registered on those names capture the victims that call in. A domain that matches a known DGA family is a strong indicator even on the day it is born.
Example
A resolver log shows one host querying 340 domains in ten minutes, all 16 to 20 characters of random-looking letters under the same two top-level domains, 338 of them returning NXDOMAIN. The two that resolved point at a sinkhole run by a research team, which is how the family gets a name.
In isMalicious
A domain report on isMalicious shows whether a name is listed by the DGA and sinkhole sources it aggregates, and the DNS history at /threat-intel/dns-history shows whether the domain resolved to a sinkhole or to live C2 infrastructure, which tells the responder whether the host is talking to an attacker or to a researcher.
Frequently asked questions
What is DGA (Domain Generation Algorithm)?
A domain generation algorithm is code inside malware that produces a large list of domain names from a seed such as the date, so that the infected host can find its command server by trying names until one resolves. The operator, who knows the algorithm, registers only a few of the day’s names, and defenders cannot block a list they cannot predict.
How is DGA (Domain Generation Algorithm) related to Fast Flux?
Fast Flux in short: Fast flux is a DNS technique used by attackers to rapidly change the IP addresses associated with a domain — sometimes cycling through hundreds of IPs within minutes. It is used to make C2 servers and phishing sites resistant to IP-based blocking and takedowns.
Related terms
Fast Flux
Fast flux is a DNS technique used by attackers to rapidly change the IP addresses associated with a domain — sometimes cycling through hundreds of IPs within minutes. It is used to make C2 servers and phishing sites resistant to IP-based blocking and takedowns.
Sinkhole
A sinkhole is a controlled destination that security researchers or law enforcement redirect malicious traffic to — often for botnet takedowns. Sinkholed domains and IPs may still appear on threat feeds during transition periods; enrichment context helps avoid blocking legitimate sinkhole operators.
C2 Infrastructure
Command-and-control (C2) infrastructure is the server, domain, or cloud resource malware uses to receive instructions and exfiltrate data. Blocking C2 IPs and domains at the firewall and DNS layer disrupts active infections before lateral movement.
NRD (Newly Registered Domain)
A Newly Registered Domain is a domain registered within the past 30–90 days. NRDs are a key risk signal because the vast majority of phishing campaigns, malware distribution, and spam infrastructure uses freshly registered domains to evade blocklists.
Try it on a real indicator
Look up any IP, domain, URL or file hash in the indexed records.