It indicates that the domain name exhibits statistical patterns typical of algorithmically generated domains (DGA). Such domains are often used by malware and botnets to dynamically create command-and-control (C2) endpoints, making them harder to block or takedown.
Three questions every analyst asks before acting on this signal.
It indicates that the domain name exhibits statistical patterns typical of algorithmically generated domains (DGA). Such domains are often used by malware and botnets to dynamically create command-and-control (C2) endpoints, making them harder to block or takedown.
DGA allows attackers to automatically generate hundreds or thousands of pseudo-random domain names per day. Malware samples use these domains to connect back to their command servers, increasing resilience against domain takedowns or blacklists.
Not always. Some legitimate domains may occasionally appear random (e.g., due to hashing in CDN URLs or load-balancing systems). However, a high DGA score combined with indicators like low popularity, short uptime, or untrusted TLD strongly suggests malicious behavior.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "high_dga_score",
"name": "High DGA Score Detected",
"group": "threat_intelligence_feed",
"subgroup": "dga_algorithmic",
"direction": "malicious",
"evidence": {
"entropy_score": 4.21,
"ngram_score": 0.07,
"dga_family_match": "necurs",
"dga_confidence": 0.88
}
}The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.