Skip to content

DGA / Algorithmic

Algorithmically-generated domain patterns: entropy, n-gram improbability, DGA family matches. Each fires with named evidence and a 3-question analyst Q&A trail.

See 1 DGA / Algorithmic signalsSee verdicts firing these
About

What DGA / Algorithmic captures

Algorithmically-generated domain patterns: entropy, n-gram improbability, DGA family matches. Tier-1 SOC analysts use them to cut triage time on suspicious threat intelligence feed behavior; CTI teams pivot from them to the broader campaign graph.

Browse

1 signals in DGA / Algorithmic

Each row opens a leaf page with the signal's direction, named evidence, and 3-question Q&A trail. Use them as audit anchors when a verdict surfaces this subgroup.

DGA / Algorithmic1 signals
Verdict scenarios

How DGA / Algorithmic shapes the call

Three real-world situations where DGA / Algorithmic evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A domain with high character entropy, n-gram improbability, and string structure matching a known DGA family.

VerdictIQ explains

“Decline. The naming pattern is algorithmically generated to a known family; strong malware-infrastructure indicator.”

Medium riskVERDICT · REVIEW
The situation

A domain with moderate entropy that doesn't match any tracked DGA family but reads as machine-generated.

VerdictIQ explains

“Send to analyst review. The shape is suspicious without being conclusive; verify before granting trust.”

Low riskVERDICT · ALLOW
The situation

A domain with a human-readable name consistent with a real brand or word combination.

VerdictIQ explains

“Allow. The naming pattern is consistent with intentional, human-chosen branding. No DGA reason to delay.”

See full Verdict Gallery
Sibling subgroups

Other subgroups in Threat Intelligence Feed

4 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail

See DGA / Algorithmic signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.

Start FreeBack to Threat Intelligence Feed