{"id":33197044,"url":"https://github.com/baderj/domain_generation_algorithms","last_synced_at":"2026-02-01T02:35:10.147Z","repository":{"id":1780602,"uuid":"41666728","full_name":"baderj/domain_generation_algorithms","owner":"baderj","description":"Some results of my DGA reversing efforts","archived":false,"fork":false,"pushed_at":"2025-09-28T09:33:39.000Z","size":7054,"stargazers_count":679,"open_issues_count":0,"forks_count":166,"subscribers_count":65,"default_branch":"master","last_synced_at":"2025-11-16T08:11:19.887Z","etag":null,"topics":["dga","domain-generation-algorithm","malware","python","reverse-engineering"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/baderj.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2015-08-31T09:14:32.000Z","updated_at":"2025-10-29T13:24:33.000Z","dependencies_parsed_at":"2024-01-12T03:36:19.153Z","dependency_job_id":"71f32557-0604-463d-9a3b-08dc0912cbf4","html_url":"https://github.com/baderj/domain_generation_algorithms","commit_stats":{"total_commits":184,"total_committers":10,"mean_commits":18.4,"dds":"0.30434782608695654","last_synced_commit":"907dbe456fb995cff2071c273d89026524b5e78d"},"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/baderj/domain_generation_algorithms","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baderj%2Fdomain_generation_algorithms","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baderj%2Fdomain_generation_algorithms/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baderj%2Fdomain_generation_algorithms/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baderj%2Fdomain_generation_algorithms/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/baderj","download_url":"https://codeload.github.com/baderj/domain_generation_algorithms/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baderj%2Fdomain_generation_algorithms/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28965430,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-01T02:14:24.993Z","status":"ssl_error","status_checked_at":"2026-02-01T02:13:55.706Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dga","domain-generation-algorithm","malware","python","reverse-engineering"],"created_at":"2025-11-16T08:00:29.002Z","updated_at":"2026-02-01T02:35:10.130Z","avatar_url":"https://github.com/baderj.png","language":"Python","readme":"# Domain Generation Algorithms \nDomain Generation Algorithms (DGAs) of Malware reimplemented in Python.\n\n## Overview\n\n\u003cdetails\u003e\u003csummary\u003ebanjori (aka MultiBanker 2, BankPatch(er))\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/02/the-dga-of-banjori/](http://johannesbader.ch/2015/02/the-dga-of-banjori/)\n\n### Example Domains\n- earnestnessbiophysicalohax.com\n- kwtoestnessbiophysicalohax.com\n- rvcxestnessbiophysicalohax.com\n- hjbtestnessbiophysicalohax.com\n- txmoestnessbiophysicalohax.com\n- agekestnessbiophysicalohax.com\n- dbzwestnessbiophysicalohax.com\n- sgjxestnessbiophysicalohax.com\n- igjyestnessbiophysicalohax.com\n- zxahestnessbiophysicalohax.com\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003ebazarbackdoor (aka BazarLoader Team9Backdoor))\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/blog/the-dga-of-bazarbackdoor/](https://johannesbader.ch/blog/the-dga-of-bazarbackdoor/)\n- [https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/](https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/)\n- [https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/](https://johannesbader.ch/blog/yet-another-bazarloader-dga/)\n\n### Example Domains\nReal DGA:\n- adegjkaiggjm.bazar\n- eehhjmejjhjo.bazar\n- dehiildjjiin.bazar\n- ceeiklcjgikn.bazar\n- dceikkdhgikm.bazar\n- bfehjmbkghjo.bazar\n- adegjmaiggjo.bazar\n- dchiikdhjiim.bazar\n- efehikekghim.bazar\n- bdhhjkbijhjm.bazar\n\nBuggy DGA:\n-\\_fdgimzkfgio.bazaar\n-e\\`bfkieedfkk.bazaar\n-efdgikekfgim.bazaar\n-\\]begimzgggio.bazaar\n-bbbfhlbgdfhn.bazaar\n-\\^ehikizjjikk.bazaar\n-aechimajehio.bazaar\n-\\]defiizigfik.bazaar\n-\\`\\`geiizeieik.bazaar\n-degfjkdjifjm.bazaar\n\n\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003ebumblebee\u003c/summary\u003e\n\n### Example Domains\n- cmid1s1zeiu.life\n- itszko2ot5u.life\n- 3v1n35i5kwx.life\n- newdnq1xnl9.life\n- jkyj6awt1ao.life\n- ddrjv6y42b8.life\n- 1pnhp5o5za1.life\n- y13iqvlfjl5.life\n- xp0btfgegbo.life\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003echinad\u003c/summary\u003e\n\n### Links\n- [https://github.com/360netlab/DGA/issues/1](https://github.com/360netlab/DGA/issues/1)\n\n### Example Domains\n- 8f6bacmw30xxv6sc.cn\n- 486txu3yjly0xcmz.ru\n- xmi6x8zg9rkanmyo.info\n- spy1jhdbmvt2ueva.net\n- evybt5gtf2tprvbi.info\n- 7qbys97e3pcw262c.info\n- kz89iy97c7n7vbur.biz\n- zmkvvlsvkbffnuez.ru\n- tr1yy6lxtry1gsts.biz\n- mfq6uwq3p2hvc8zn.cn\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003ecorebot\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/09/the-dga-of-corebot/](https://johannesbader.ch/2015/09/the-dga-of-corebot/)\n\n### Example Domains\n- lkhylm0mhyfuhg.ddns.net\n- s63234wluv5v365bwp5.ddns.net\n- afe6mfy23xcxgfa.ddns.net\n- 7rsl1f34sfq0oj3jwvmfa6c.ddns.net\n- ir7l3po0gjy8ypqjm8o.ddns.net\n- 3lgrupwdivsfm2w4kng2iha.ddns.net\n- i8a0q2wdu8otulkfylo2gdq.ddns.net\n- kh1her76avy0qnelivijwd1.ddns.net\n- ubgp1f1han7lu410eh5.ddns.net\n- uliry8knadmpmdm4wti6oro.ddns.net\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003edarkcracks\u003c/summary\u003e\n\n### Links\n- [https://blog.xlab.qianxin.com/uncovering_darkcracks_payload_delivery_framework_cn/#part2-runner%E5%88%86%E6%9E%90](https://blog.xlab.qianxin.com/uncovering_darkcracks_payload_delivery_framework_cn/#part2-runner%E5%88%86%E6%9E%90)\n\n### Example Domains\n- sTDFUgOAgjL.com\n- EVDFUgOAgjL.com\n- AVDFUgOAgjL.com\n- MVDFUgOAgjL.com\n- IVDFUgOAgjL.com\n- UVDFUgOAgjL.com\n- QVDFUgOAgjL.com\n- YTCFUgOAgjL.com\n- kTCFUgOAgjL.com\n- gTCFUgOAgjL.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003edircrypt\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/03/the-dga-of-dircrypt/](http://johannesbader.ch/2015/03/the-dga-of-dircrypt/)\n\n### Example Domains\n- rauggyguyp.com\n- llullzza.com\n- mluztamhnngwgh.com\n- mycojenxktsmozzthdv.com\n- inbxvqkegoyapgv.com\n- furiararji.com\n- zrkdvzjhse.com\n- wyuhdsdttczd.com\n- hpaxgpkteomjaxywwelr.com\n- mydojltbqjnwailyyoa.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003ednschanger (aka Alureon)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/](https://johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/)\n\n### Example Domains\n- aktklyvbiu.com\n- zgimjzlnrl.com\n- tcfejerekw.com\n- tfaunnjmxt.com\n- ydvlfpkguw.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003efobber (aka Tinba v3)\u003c/summary\u003e\n\n### Example Domains\n- vhkintjtksyxgjrzz.net\n- btpnxlsfdqbhzazyx.net\n- ukfmknjdenthvktgc.net\n- qupxsrhrmuoinqrit.net\n- gjsbydmrpfzsmnfiu.net\n- indpstqbetcpcqprx.net\n- gwrdmhyjfcpcutmhp.net\n- bwnzcyypcbmnlpfsw.net\n- twkpwfuecvvzcincq.net\n- pdwfuxgnahmgsxhit.net\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003efosniw\u003c/summary\u003e\n\n### Example Domains\n- app2.winsoft0.com\n- app2.winsoft1.com\n- app2.winsoft2.com\n- app2.winsoft3.com\n- app2.winsoft4.com\n- app2.winsoft5.com\n- app2.winsoft6.com\n- app2.winsoft7.com\n- app2.winsoft8.com\n- app2.winsoft9.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003egozi (aka Ursnif, Snifula, Papras)\u003c/summary\u003e\n\n### Links\n- [http://www.govcert.admin.ch/blog/18/gozi-isfb-when-a-bug-really-is-a-feature](http://www.govcert.admin.ch/blog/18/gozi-isfb-when-a-bug-really-is-a-feature)\n\n### Example Domains\n- quodpresidentemaxsagit.com\n- pertantumfitusu.com\n- indulgentiarumlicet.com\n- moriblasphemianegocii.com\n- ptribueretnossetnonin.com\n- nonsicordinario.com\n- svivacpecunias.com\n- inestimabiler.com\n- ulpurgatoriopetrum.com\n- papacricognitisipro.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003ekraken/v1 (aka Bobax, Oderoor)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/](https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/)\n\n### Example Domains\n- ibbwnhgh.mooo.com\n- rbqdxflojkj.mooo.com\n- smhburg.dyndns.org\n- bltjhzqp.dyndns.org\n- clwafrfuuxq.yi.org\n- cffxugijxn.yi.org\n- ivxcxbj.dynserv.com\n- etllejr.dynserv.com\n- otpxmk.mooo.com\n- ejfjyd.mooo.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003ekraken/v2 (aka Bobax, Oderoor)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/](https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/)\n\n### Example Domains\n- xpdbwuimwag.com\n- nwpegpjtx.com\n- smmyuhxlt.net\n- xjvyvnzivvt.net\n- lvctmusxcyz.tv\n- lvctmusxcyz.tv\n- cjuszcfwo.cc\n- egbmbdey.cc\n- wjxaprgne.com\n- vxbuggxhrgi.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003elocky\u003c/summary\u003e\n\n### Links\n- [https://blogs.forcepoint.com/security-labs/lockys-new-dga-seeding-new-domains](https://blogs.forcepoint.com/security-labs/lockys-new-dga-seeding-new-domains)\n\n### Example Domains\n- gegjiimqmlgtdmk.tf\n- pccibcjncnhjn.yt\n- rddipikmrap.us\n- mmhmkqfc.be\n- vkcims.pm\n- qtysmobytagnrv.it\n- suhpqiumpjsv.ru\n- cscffbwbhs.uk\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003em0yv\u003c/summary\u003e\n\n### Links\n\n- [https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv](https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv)\n- [YouTube video \"Sinkholing the Domain Generation Algorithm of m0yv\"](https://youtu.be/3RYbkORtFnk)\n\nTime independent version in `dga.py`, time-dependent version in `dga-td.py`.\n\n### Example Domains\n\n- pywolwnvd.biz\n- ssbzmoy.biz\n- cvgrf.biz\n- npukfztj.biz\n- przvgke.biz\n- zlenh.biz\n- knjghuig.biz\n- uhxqin.biz\n- anpmnmxo.biz\n- lpuegx.biz\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003emonerodownloader\u003c/summary\u003e\n\n### Example Domains\n- 31b4bd31fg1x2.org\n- 31b4bd31fg1x2.tickets\n- 31b4bd31fg1x2.blackfriday\n- 31b4bd31fg1x2.hosting\n- 31b4bd31fg1x2.feedback\n- 3f8c8079fd4c5.org\n- 3f8c8079fd4c5.tickets\n- 3f8c8079fd4c5.blackfriday\n- 3f8c8079fd4c5.hosting\n- 3f8c8079fd4c5.feedback\n\u003c/details\u003e \n\n\u003cdetails\u003e\u003csummary\u003emurofet/v1 (aka LICAT)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)\n\n### Example Domains\n- giywswshrgxcvoqgvrkthmfa.ru\n- xaiqpbprgymbvrwmzgiyprgdsk.com\n- amgqgularpzxeapztxenbx.net\n- pfscijbmthyfiyjgergugtkbqyh.org\n- xglfcmsgorvwfilhmzlcxxvkfege.info\n- rcteqwkequojntibvfyfaluwh.biz\n- mjfqylbiaunffuaeunzdqdwscu.ru\n- qobeylpxgpfknlptukyddqvklztg.com\n- rgwgizukficdgetwsxovtcknwkfm.info\n- betgyaeswxorwcvsdezdupbmb.org\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003emurofet/v2 (aka LICAT)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)\n\n### Example Domains\n- cmqvvxtppnibli.biz\n- cmqvvxtppnibli.com\n- rloqpoiongsuwyq.net\n- rloqpoiongsuwyq.org\n- zsophzovtfor.info\n- zsophzovtfor.biz\n- nlifthjnbgnfweq.org\n- nlifthjnbgnfweq.com\n- hykpttqsxsmvkoc.info\n- hykpttqsxsmvkoc.org\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003emurofet/v3 (aka LICAT)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)\n\n### Example Domains\n- nxlya47huo61czerb18o51e11d30i55gycwe31lx.ru\n- jwdzptm69p62izcve41f22k37oyj16g63fqote11.com\n- p42p52nvd50izkqazaqe21lvo21pycqotp22e61.net\n- b28n40i25b68gte41o61dwc19htc29jwgxiqfzbr.org\n- ktirhsn50kzc49b58cyf32fwh14h64dzgxiqcz.info\n- bre41hvc29kri15ewpwdsazjyn40p52kwe21gw.biz\n- n30mwhsoxfqe51j56lunsg13o11hyd60ewf52nu.ru\n- hvcsjxd20mzm29d40nznunta27c29kyi55fun50.com\n- nzosg13oymzg63ntpxaro51btkvfyoshrk27.info\n- czfsn20exg53nzcqcrg43exf62b28p22pyd50lu.org\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003emydoom (aka Novarg, Mimail.R, Shimgapi)\u003c/summary\u003e\n\n### Example Domains\n- qehspqnmrn.info\n- mmahaesqar.in\n- pwprhhnqqn.in\n- mrspmramrn.in\n- arphansaqh.com\n- hrhspsrenn.net\n- aepaaemrmn.com\n- wsaehwmnms.in\n- arwrseqssh.com\n- ewamspqwha.ws\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003enecurs\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/02/the-dgas-of-necurs/](http://johannesbader.ch/2015/02/the-dgas-of-necurs/)\n\n### Example Domains\n- nccojqvabqvkiwhj.mx\n- hoedwwwywnmmbi.ac\n- aeaeneaoinf.mu\n- ccecggc.us\n- mfffpmgtplxbyagbtegh.com\n- thlxuwnadtdtsm.biz\n- edkomqpeufjyafccj.in\n- mxomklaqau.pw\n- nvutiptwteltin.tv\n- nhysbiomr.ir\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003enewgoz (aka Gameover Zeus, Peer-to-Peer Zeus)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2014/12/the-dga-of-newgoz/](https://johannesbader.ch/2014/12/the-dga-of-newgoz/)\n\n### Example Domains\n- xzz3ug32bale1uo60y7xj6rge.com\n- 1hyzmw3l2phycet88hzr2do34.net\n- 2ppq821cfem5m1mdua46pxg7bj.biz\n- unlm9w9l8upy1kdde0kba7ktf.org\n- 1ixhw3p1ncr3cf1pjfrpz14n1u0e.com\n- 1o460ktpdhna1k0lk3ecwujxn.net\n- 183t0wjzlthe51wigptk4rl29.org\n- 1i3ux5a1hj6ndqejmxone45g0v.net\n- 5mcdp71mbutpb1tglu0s4p0lrf.com\n- n3i5yn19w82vmmpxv1k1l4xrjg.org\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003engioweb\u003c/summary\u003e\n\n### Links\n- [Netlab - An Analysis of Linux.Ngioweb Botnet](https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/)\n- [Netlab - Quick update on the Linux.Ngioweb botnet, now it is going after IoT devices](https://blog.netlab.360.com/linux-ngioweb-v2-going-after-iot-devices-en/)\n\n### Example Domains\nminihileth-subatudofy.org\nrevodihudom.info\nenisobure-antidimadom-minikevuship.org\nsemiridinution-postepudency.com\nprolefexity-disorisance.org\nnonebazish-disahibelen-misehurarage.name\nilolupage-nonurisudize-minikazolike.net\nsemicofaxiful-enixakor-subafapehen.info\noveredaxive-nonameraness.net\nprevomozary-microfemaly.info\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003enymaim\u003c/summary\u003e\n\n### Example Domains\n- oftbpec.com\n- lotmpwyk.info\n- seikpwq.info\n- bcfatyltdvp.info\n- rfwstgy.com\n- hokybhnf.biz\n- evlovrxuw.net\n- mtzpbzbfvy.info\n- hacckgiakhl.com\n- mosmeuw.net\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003enymaim2\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2018/04/the-new-domain-generation-algorithm-of-nymaim/](https://johannesbader.ch/2018/04/the-new-domain-generation-algorithm-of-nymaim/)\n\n### Example Domains\n- surfaces-drawing.com\n- shaft-criterion.cc\n- stops-hash.id\n- unitsknowledge.com\n- wiredgraph.tm\n- timelydesignation.co\n- stablelikely.ch\n- stainless-loan.lk\n- wagon-documents.sc\n- trainerprocessors.tk\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003epadcrypt\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2016/03/the-dga-of-padcrypt/](http://johannesbader.ch/2016/03/the-dga-of-padcrypt/)\n\n### Example Domains\n- elkfcfnacacmofdf.com\n- mkmeeefncfnfdmbm.de\n- ffcdcnbmmnaeddcd.com\n- ddkfodnaadmbmofo.co.uk\n- efneboaodnmbecoa.co\n- bafomkfalcfcdkom.info\n- onlmcddadnacfclc.com\n- dcfmddfbobkmafma.com\n- lmmfdccmnnfnmfdl.co\n- kcknconmceeemlnm.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003epitou\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2019/07/the-dga-of-pitou/](https://johannesbader.ch/2019/07/the-dga-of-pitou/)\n\n### Example Domains\n- --------------+\n- koohoavab.net |\n- koohoavac.net |\n- koohoavad.net |\n- koohoavaf.net |\n- koohoavag.net |\n- koohoavah.net |\n- koohoavaj.net |\n- koohoavak.net |\n- koohoaval.net |\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003epizd\u003c/summary\u003e\n\n### Links\n- [https://blog.avast.com/2013/06/18/your-facebook-connection-is-now-secured/](https://blog.avast.com/2013/06/18/your-facebook-connection-is-now-secured/)\n\n### Example Domains\n- difficultnearly.net\n- dollarnearly.net\n- difficultpossible.net\n- dollarpossible.net\n- eearlynation.net\n- escapenation.net\n- eearlypleasure.net\n- escapepleasure.net\n- eearlynearly.net\n- escapenearly.net\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eproslikefan\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2016/06/proslikefan/](https://johannesbader.ch/2016/06/proslikefan/)\n\n### Example Domains\n- flarvcpk.eu\n- stjneohiod.biz\n- vcevvkc.se\n- qylptiin.info\n- bsvisbttr.com\n- hjiknr.net\n- arpeiezki.org\n- gobqca.ru\n- tivqfahrmxdl.in\n- smutloo.name\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003epushdo\u003c/summary\u003e\n\n### Example Domains\n- weafokuggeir.kz\n- sictemuborug.kz\n- cirpicficj.kz\n- geijanmap.kz\n- fuxhuxsabi.kz\n- siclisozdokq.kz\n- sozcoqnafrex.kz\n- qeobifups.kz\n- cokoqdeah.kz\n- latqafbuxwic.kz\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003epykspa/improved\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/03/the-dga-of-pykspa/](http://johannesbader.ch/2015/03/the-dga-of-pykspa/)\n\n### Example Domains\n- uammskmq.org\n- jqplflktas.info\n- rybwtr.net\n- uyznvxlof.info\n- gakcmqiw.com\n- wewsvat.net\n- owhadwkskevw.net\n- nkndlzhjgrpc.info\n- isypszqe.net\n- joebbaamoyt.info\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003epykspa/precursor\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/07/pykspas-inferior-dga-version/](http://johannesbader.ch/2015/07/pykspas-inferior-dga-version/)\n\n### Example Domains\n- llfwhgn.com\n- guqqkaiq.biz\n- wctymo.net\n- lovfjsfox.com\n- oruhbanansnan.cc\n- mkncjk.biz\n- yunonsuiwcymao.net\n- yxpojufqbex.com\n- qhxgzufqbex.cc\n- yywiywiq.biz\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eqadars\u003c/summary\u003e\n\n### Links\n- [https://www.johannesbader.ch/2016/04/the-dga-of-qadars/](https://www.johannesbader.ch/2016/04/the-dga-of-qadars/)\n\n### Example Domains\n- jk9enwhansl2.org\n- sdqfodmf81m7.net\n- 5uro1uzspejk.net\n- ub4hinsduf0p.net\n- zs9ijo1er81u.com\n- 0t67c5arw9yf.net\n- lev41encha38.net\n- 67k1q3c1mr8x.org\n- 7w1yf49irk5m.net\n- gdunwhq7s9qb.org\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eqakbot\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2016/02/the-dga-of-qakbot/](https://johannesbader.ch/2016/02/the-dga-of-qakbot/)\n\n### Example Domains\n- bqkrtxgkmriwsiwcngtivpx.info\n- jdtmfupdyueqeldvhsjzdvzob.net\n- guhmpoxzivhba.com\n- nqqxqhuacaqhzurde.org\n- lgqsqgpqzijwid.info\n- ykolyecdcyk.biz\n- ztvflnxqzpxvpfobv.biz\n- zqrmkpivrbxccawozqwqpfzh.org\n- iqyqwhntrxfeq.org\n- ftadkbomxlnsib.info\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eqsnatch\u003c/summary\u003e\n\n### Links\n- [https://www.kyberturvallisuuskeskus.fi/en/news/qsnatch-malware-designed-qnap-nas-devices](https://www.kyberturvallisuuskeskus.fi/en/news/qsnatch-malware-designed-qnap-nas-devices)\n\n- [https://johannesbader.ch/blog/the-dga-of-qsnatch/](https://johannesbader.ch/blog/the-dga-of-qsnatch/)\n\n### Example Domains\n- t2q2r.cf\n- gc9nz.tk\n- 07tvvc.com\n- 7ubqo.ml\n- 53bcm.de\n- 6zltf.rocks\n- hv7uv.mx\n- nypno.biz\n- qkzccy.net\n- rassb.cn\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eramnit\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2014/12/the-dga-of-ramnit/](https://johannesbader.ch/2014/12/the-dga-of-ramnit/)\n\n### Example Domains\n- knpqxlxcwtlvgrdyhd.com\n- nvlyffua.com\n- hgyudheedieibxy.com\n- anrylixwcbnjopdd.com\n- vrndmdrdrjoff.com\n- jhghrlufoh.com\n- tqjhvylf.com\n- hufqifjq.com\n- itktxexjghvvxa.com\n- ppyblaohb.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eranbyus/may\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/05/the-dga-of-ranbyus/](http://johannesbader.ch/2015/05/the-dga-of-ranbyus/)\n\n### Example Domains\n- ikwoqkwuajpbyx.com\n- niukpdrluwlfox.pw\n- rcnxisuibbadng.in\n- wbqtidjvsdiwee.me\n- jrdyumcieyipnv.cc\n- yvyfwikedfxitk.su\n- tviurcntxylxnj.tw\n- lycyrvfcemepfm.net\n- epddeukdimbpft.com\n- trbhxhmbsikoaq.pw\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eranbyus/september\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/09/ranbyuss-dga-revisited/](http://johannesbader.ch/2015/09/ranbyuss-dga-revisited/)\n\n### Example Domains\n- jxbdxeyxttdmcjagi.me\n- iqmadgybfhnrssadm.cc\n- gdoldaognceaedkke.su\n- jnbnyrmxmpblfgstk.tw\n- ucjetnyaitygjidva.net\n- jejocqwtcbtuymvao.com\n- stuctjsqfxghcesyw.pw\n- gfidctymbxiaqyuyk.in\n- ojrqwrlhesfshawva.me\n- bqjqvwwjirftwkjel.cc\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003ereconyc\u003c/summary\u003e\n\n**This DGA has unpredictable seeding**, i.e., it uses ``GetTickCount`` as the seed. I still list the DGA as it might be useful for testing or training DGA detection algorithms.\n\n### Example Domains\n- E5zHail0Mw.com\n- gabbvK2o6s.com\n- CumpP2A4d7.com\n- 5eswmwNQyF.com\n- lExfSzyuwP.com\n- JZpESGsPFF.com\n- UmIaRnijeT.com\n- sHr0xE9Idm.com\n- nYcEX7wlCF.com\n- VCiZNQXwpO.com\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003esharkbot\u003c/summary\u003e\n\n### Example Domains\n- 64f30398ecda3bbf.xyz\n- f008fc473fddedc4.live\n- cfbadaf0cd7b0ac3.com\n- b8d28386413029fe.store\n- 99c485497c079a09.info\n- 6d54b683fc2cc58f.top\n- abb7547058fef9fb.net\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eshiotob (aka Urlzone, Bebloh)\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/01/the-dga-of-shiotob/](https://johannesbader.ch/2015/01/the-dga-of-shiotob/)\n\n### Example Domains\n- wtipubctwiekhir.net\n- rwmu35avqo12tqc.com\n- rskb5bsfhm2fk5h.net\n- rbp9pprrxgflut9.com\n- zzxeyzgy45yy2a.net\n- e3oa4wglvd21xa.com\n- mqmq1hvmtxzjv.net\n- pd4o4wu24vimn.com\n- tlmrzvpbpsqsb.net\n- pbmnz59uzndpo.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003esimda (aka Shiz)\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/03/the-dga-of-simda-shiz/](http://johannesbader.ch/2015/03/the-dga-of-simda-shiz/)\n\n### Example Domains\n- gatyfus.com\n- lyvyxor.com\n- vojyqem.com\n- qetyfuv.com\n- puvyxil.com\n- gahyqah.com\n- lyryfyd.com\n- vocyzit.com\n- qegyqaq.com\n- purydyv.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003esisron (aka TOMB, Win32/Agent.WRQ, Trojan.Scar)\u003c/summary\u003e\n\n### Links\n- [https://www.johannesbader.ch/2016/06/the-dga-of-sisron/](https://www.johannesbader.ch/2016/06/the-dga-of-sisron/)\n\n### Example Domains\n- mdiwnjiwmtya.com\n- mdewnjiwmtya.com\n- mzewntiwmtya.com\n- mzawntiwmtya.com\n- mjkwntiwmtya.com\n- mjgwntiwmtya.com\n- mjcwntiwmtya.com\n- mjywntiwmtya.com\n- mjuwntiwmtya.com\n- mjqwntiwmtya.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003esuppobox\u003c/summary\u003e\n\n### Links\n- [http://www.rsaconference.com/writable/presentations/file_upload/br-r01-end-to-end-analysis-of-a-domain-generating-algorithm-malware-family.pdf](http://www.rsaconference.com/writable/presentations/file_upload/br-r01-end-to-end-analysis-of-a-domain-generating-algorithm-malware-family.pdf)\n\n### Example Domains\n- journey\n- destroy\n- against\n- night\n- within\n- effort\n- street\n- better\n- husband\n- little\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003esymmi\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/01/the-dga-of-symmi/](http://johannesbader.ch/2015/01/the-dga-of-symmi/)\n\n### Example Domains\n- ogovugtuipawi.ddns.net\n- afowkaupbabe.ddns.net\n- ipkureleakm.ddns.net\n- hegiruqo.ddns.net\n- luimreim.ddns.net\n- tiakqukoahuvu.ddns.net\n- loelkuanduur.ddns.net\n- agdehukoev.ddns.net\n- giagkuekorla.ddns.net\n- leufiroqipomu.ddns.net\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003etempedreve\u003c/summary\u003e\n\n### Links\n- [https://github.com/baderj/domain_generation_algorithms/tree/master/tempedreve/images](https://github.com/baderj/domain_generation_algorithms/tree/master/tempedreve/images)\n\n### Example Domains\n- dlbebsga.net\n- enqbgrmt.com\n- xjlwpfnk.info\n- ebabkjcx.org\n- hvisietg.net\n- svyjglen.com\n- glknxfgq.info\n- adoduloh.org\n- jgrxrxwh.net\n- ctmrgbmz.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003etinba (aka TinyBanker, Zusy)\u003c/summary\u003e\n\n### Links\n- [http://johannesbader.ch/2015/04/new-top-level-domains-for-tinbas-dga/](http://johannesbader.ch/2015/04/new-top-level-domains-for-tinbas-dga/)\n\n### Example Domains\n- blackfreeqazyio.cc\n- nvfowikhevmy.com\n- nvfowikhevmy.net\n- nvfowikhevmy.in\n- nvfowikhevmy.ru\n- sjhuqlwrqhqx.com\n- sjhuqlwrqhqx.net\n- sjhuqlwrqhqx.in\n- sjhuqlwrqhqx.ru\n- pxqgonyogeee.com\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003etufik\u003c/summary\u003e\n\n### Example Domains\n- dbqwpmpnruesywj.com\n- qxxmubfleztlnkx.com\n- rrnywowqgmjvnltg.com\n- rqnjdvzpsmbuw.com\n- utoiopxjrphvoiy.org\n- ttoouemmimnxnmj.com\n- nmjsoourllgveecj.org\n- juprvzxqotonvvs.biz\n- nmjsoourllgveecj.biz\n- dotqwjmhqlushjlo.biz\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003edmsniff\u003c/summary\u003e\n\n### Example Domains\n- albdfhln.com\n- alcgkown.com\n- aldjpvqt.com\n- alemuown.com\n- alfpmrnq.org\n- algspvqt.org\n- alhvrytw.org\n- aliyuown.org\n- aljnwpyo.org\n- alkpmrnq.net\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eunnamed_downloader\u003c/summary\u003e\n\n### Example Domains\n- ddknt.github.io\n- ddktn.github.io\n- ddnkt.github.io\n- ddntk.github.io\n- ddtkn.github.io\n- ddtnk.github.io\n- dkdnt.github.io\n- dkdtn.github.io\n- dkndt.github.io\n- dkntd.github.io\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003eunnamed_javascript_dga\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/2015/11/a-javascript-based-dga/](https://johannesbader.ch/2015/11/a-javascript-based-dga/)\n\n### Example Domains\n- rxxeqcoy.cc\n- kmymbyzd.co\n- cfukbzbmg.eu\n- sblwtafc.cc\n- lqdoacat.co\n- dplmjcjic.eu\n- ttukaiwjdx.cc\n- meimklqh.co\n- enmxqcxhtl.eu\n- unmias.cc\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003evawtrak\u003c/summary\u003e\n\n### Links\n- [http://www.threatgeek.com/2016/11/vawtrak-dga-round-2.html](http://www.threatgeek.com/2016/11/vawtrak-dga-round-2.html)\n\n### Example Domains\n- usahwutle.com\n- folocnam.com\n- awumsah.com\n- edorwufli.com\n- misocgutlah.com\n- edarwotda.com\n- melarwetdic.com\n- usucnitdohg.com\n- regomseh.com\n- osicnumd.com\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003exmrig_genesis (a XMRig malware using the bitcoin genesis block as seed))\u003c/summary\u003e\n\n### Example Domains\n- 1d78e50d.com\n- 1d78e50d.net\n- 1d78e50d.org\n- 1d78e50d.duckdns.org\n- 2b04216f.com\n- 2b04216f.net\n- 2b04216f.org\n- 2b04216f.duckdns.org\n- 2e1d985c.com\n- 2e1d985c.net\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003ezloader\u003c/summary\u003e\n\n### Links\n- [https://johannesbader.ch/blog/the-dga-of-zloader/](https://johannesbader.ch/blog/the-dga-of-zloader/)\n\n\n### Example Domains\n- gdurfdsywubjaaqcqhrh.com\n- vudktykcecigekhtwwqn.com\n- jcaofaekffeojktmpdax.com\n- iiphrhkculpnubvvxnbh.com\n- bjdbpgbjdyredhfyvpie.com\n- wramitvqeojecedajxoj.com\n- ohyjybhogoeoabjqvpie.com\n- fscqtelyeogmxudotlao.com\n- nsdtxvnwtxjwphbuqffe.com\n- bohchavtvhbejwcmekvo.com\n\u003c/details\u003e\n\n","funding_links":[],"categories":["\u003ca id=\"1d9dec1320a5d774dc8e0e7604edfcd3\"\u003e\u003c/a\u003e工具-新添加的","\u003ca id=\"7485e724ef5efd1daf9d672bd72fb595\"\u003e\u003c/a\u003eDNS协议"],"sub_categories":["\u003ca id=\"8f1b9c5c2737493524809684b934d49a\"\u003e\u003c/a\u003e文章\u0026\u0026视频","\u003ca id=\"41df71c75c08038e17e5526fe0afceb5\"\u003e\u003c/a\u003eDomain Generation Algorithm(DGA)"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbaderj%2Fdomain_generation_algorithms","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbaderj%2Fdomain_generation_algorithms","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbaderj%2Fdomain_generation_algorithms/lists"}