4 ms·

Exercise to Detect Algorithmically Generated Domain Names

• kenny_r 12y ago
  In the output of line 85 there two punycoded[1] domain names: xn--g5t518j which is actually 微風 and xn--42cgk1gc8crdb1htg3d which is actually มอไซค์มือสอง. As a result of the encoding, the domain names look junky while perhaps they aren't. [1]: https://en.wikipedia.org/wiki/Punycode https://en.wikipedia.org/wiki/Punycode
  • mbenjaminsmith 12y ago
    มอไซค์มือสอง is, informally, second-hand motorcycles (or parts).
• nightcracker 12y ago
  Really cool presentation.
• AlyssaRowan 12y ago
  Awesome. Statistics are fun. One little issue is that's assuming techniques like this aren't used to generate the domains, which is not only an obvious 'next step', but thanks to the 'weird' domains and the find-web-online-lol.info type results which look incredibly spammy, is probably already happening and has probably been happening for years (wouldn't surprise me with the amount of spam wielding Markov chain generators out there). That's definitely what I'd do if I was in the position of the VXer, if I was determined to use DNS at all. Wonder if any of those are 'fast-flux'?