Domain Generation Algorithm (DGA).

A Domain Generation Algorithm is code embedded in malware that produces hundreds or thousands of pseudo-random domain names per day from a shared seed — typically the current date, sometimes salted with an unpredictable value such as a Twitter trending topic or exchange rate to defeat pre-registration. The bot and the operator run the same algorithm, so both compute the same day's list; the attacker registers only a handful, while the bot walks the list until one resolves. This "rendezvous" model defeats static blocklists, because defenders cannot enumerate every future C2 domain in advance, and it makes takedowns hard: seizing today's domain does nothing about tomorrow's.

Real families illustrate the scale. Conficker.C generated 50,000 domains a day across many TLDs in 2008–2009, prompting an unprecedented industry coalition (the Conficker Working Group) to pre-register or block them. Gameover Zeus fell back to a DGA of ~1,000 domains/day when its peer-to-peer layer was disrupted; CryptoLocker, Necurs, and Murofet/Licat used date-seeded generators. The 2016 USENIX Security study by Plohmann et al. reverse-engineered dozens of DGA families, showing how varied the seeding and encoding schemes are.

Because DGA lookups create a distinctive burst of NXDOMAIN responses (most generated names are unregistered), defences center on DNS telemetry: statistical or machine-learning classifiers on domain character n-grams and entropy, passive-DNS correlation, sinkholing newly observed algorithmic names, and EDR rules that flag processes issuing high-volume failed resolutions.

flowchart TD
  S[Shared seed<br/>date + salt] --> A[DGA in malware]
  S --> O[DGA run by operator]
  A --> L[1000s of candidate<br/>domains per day]
  O --> R[Operator registers<br/>a few domains]
  L --> Q{DNS lookup}
  Q -->|Most fail| N[NXDOMAIN burst]
  Q -->|One resolves| C[Connect to C2 server]
  N --> D[Detection: NXDOMAIN spike,<br/>n-gram/entropy ML, passive DNS]
  C --> E[Receive commands / exfiltrate]
  D --> F[Sinkhole / block domain]