3 ms·
> spike in NXDOMAIN DNS responses NXDOMAIN is watched because known malware has been observed to use it. But I tell you: malware can just as easily utilize a
by inetknght 6y ago
> spike in NXDOMAIN DNS responses
NXDOMAIN is watched because known malware has been observed to use it.
But I tell you: malware can just as easily utilize a valid DNS response.
- duskwuff 6y agoDomain-generation algorithms work along the lines of: seed a random number generator with the current date. Spit out a handful of domain names, and try contacting each of those a couple times each day. This way, the malware isn't tied down to a specific domain or set of domains; the bot herder just has to register any one of the domains in the current day's set, and if they lose the domain, they can repeat the process the next day. The downside is that all the bots will generate a lot of DNS traffic checking for those domains. That's what's being detected here -- the NXDOMAIN responses don't carry any desired data, but the malware can't avoid generating them while it's looking for its owner.