{"id":26199,"date":"2026-10-23T18:33:59","date_gmt":"2026-10-23T14:33:59","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/dga-algorithm-detection-technology\/26199\/"},"modified":"2026-10-23T18:52:36","modified_gmt":"2026-10-23T14:52:36","slug":"dga-algorithm-detection-technology","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/dga-algorithm-detection-technology\/26199\/","title":{"rendered":"Technology that blocks spam domains in bulk"},"content":{"rendered":"

We use many technologies to detect email spam. They analyze every part of a message: headers, text, images, and links. But the first thing our email products focus on is the \u201cFrom\u201d field. If the address contains a domain that\u2019s already on our denylist, it\u2019s an easy call. But spammers know the drill, so they register domains in industrial quantities to make emails, even from a single campaign, arrive from completely different addresses. Clearly, they don\u2019t do that by hand. The process has long been automated, and attackers\u2019 algorithms can register huge numbers of domains in a matter of minutes. But every domain needs a name. Coming up with a unique one for each isn\u2019t feasible. So spammers use domain generation algorithms (DGAs), which create similar names with minor variations, based on date and time, pseudo-random numbers, and so on.<\/p>\n

In fact, to block mailings such as these, you don\u2019t need every address on your denylist. We\u2019re good at automating processes, too. For some time now, our email solutions have included a technology that detects domains generated by DGAs, and shuts down entire batch with a single rule. Let me explain how this technology works.<\/p>\n

How we detect and block generated domain names in bulk<\/h2>\n

As soon as any of our technologies flags an email as spam, its address becomes subject to further examination. If it meets a number of criteria, its domain is added to our database of domains we consider \u201cbad\u201d. We built a cascade of classifiers that compares these domains by similarity, groups them into clusters, and creates a short but comprehensive rule that blocks the entire cluster. Our email protection solutions receive this rule with an update. From then on, they block all emails sent from addresses on any domain that matches it \u2014 even if those domains have never been used in spam campaigns yet.<\/p>\n

Here\u2019s a real-world example. Let\u2019s say the classifier flags several lookalike domains in a collection of \u201cbad\u201d ones it has gathered:<\/p>\n