Domain Generation Algorithm (DGA).

An algorithm used by malware to deterministically generate large numbers of candidate domain names so infected hosts can find their command-and-control server. It belongs to the Attacks & Threats category of cybersecurity.

An algorithm used by malware to deterministically generate large numbers of candidate domain names so infected hosts can find their command-and-control server.

A Domain Generation Algorithm is code embedded in malware that produces hundreds or thousands of pseudo-random domain names per day, seeded by the date or another shared value. Infected hosts try the day's domains in sequence; the attacker only needs to register a few of them to rendezvous with the botnet. DGAs defeat static blocklists because defenders cannot enumerate every possible C2 domain in advance. Conficker famously generated 50,000 domains a day, and Necurs, Murofet, and Mirai variants have used the technique. Defences include DGA classifiers on DNS logs, passive DNS lookups, sinkholing newly observed algorithm-generated names, and EDR detection of bursty NXDOMAIN traffic.

Defences for Domain Generation Algorithm (DGA) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: DGA, Algorithmic C2 domains.