3 ms·
It's called a DGA or domain generation algorithm, I believe Conficker was one of the first botnet's to use this approach about 10 years ago, it's pretty standar
by clwg 9y ago
It's called a DGA or domain generation algorithm, I believe Conficker was one of the first botnet's to use this approach about 10 years ago, it's pretty standard trade craft nowadays.
https://en.wikipedia.org/wiki/Domain_generation_algorithm https://en.wikipedia.org/wiki/Domain_generation_algorithm
- ehsankia 9y agoWell this is slightly different. DGA seems to actually use it as a rendez-vous host, whereas in this case, it literally is a dummy domain that they didn't even bother registering, with the only purpose of checking if they were in a VM. In which case, generating any long hash domain would most likely not be registered and would do the job.