Suspicious Top-level Domain

Attackers might evade detection by cycling through numerous domain names for their malicious command-and-control (C&C) server. Instead of choosing a standard top-level domain (TLD) for their malicious server, attackers might choose non-standard TLDs. These TLDs are often free and can offer more anonymity than standard TLDs, such as .com, which are registered to owner accounts. Frequent visits to suspicious, non-standard TLDs can indicate malware on a device or malicious activity on the network.