DGA Domain Resolution

Attackers can install malware on a compromised device that periodically establishes connections from the device to an attacker-controlled C&C server. To avoid detection, the attacker frequently changes the C&C server domain name with the help of a DGA that is embedded into the malware. DGA domain names can be an unusual length, contain multiple vowels or consonants in a row, or include a random mix of letters, numbers, and top-level domains (TLD). Because the attacker knows how the algorithm works, the DGA domain name is easy to predict by the attacker but difficult to predict by network defenders.

Legitimate domains can appear similar to algorithmically generated domains; however, legitimate domains can be verified with a domain reputation service.