Kaspersky 官方部落格：封鎖 DGA 域名的技術

• spam

Spammers automatically register hundreds of near-identical domains to fool security solutions. We can block those domains automatically, too.

• 

  Roman Dedenok

• October 23, 2026

We use many technologies to detect email spam. They analyze every part of a message: headers, text, images, and links. But the first thing our email products focus on is the “From” field. If the address contains a domain that’s already on our denylist, it’s an easy call. But spammers know the drill, so they register domains in industrial quantities to make emails, even from a single campaign, arrive from completely different addresses. Clearly, they don’t do that by hand. The process has long been automated, and attackers’ algorithms can register huge numbers of domains in a matter of minutes. But every domain needs a name. Coming up with a unique one for each isn’t feasible. So spammers use domain generation algorithms (DGAs), which create similar names with minor variations, based on date and time, pseudo-random numbers, and so on.

In fact, to block mailings such as these, you don’t need every address on your denylist. We’re good at automating processes, too. For some time now, our email solutions have included a technology that detects domains generated by DGAs, and shuts down entire batch with a single rule. Let me explain how this technology works.

How we detect and block generated domain names in bulk

As soon as any of our technologies flags an email as spam, its address becomes subject to further examination. If it meets a number of criteria, its domain is added to our database of domains we consider “bad”. We built a cascade of classifiers that compares these domains by similarity, groups them into clusters, and creates a short but comprehensive rule that blocks the entire cluster. Our email protection solutions receive this rule with an update. From then on, they block all emails sent from addresses on any domain that matches it — even if those domains have never been used in spam campaigns yet.

Here’s a real-world example. Let’s say the classifier flags several lookalike domains in a collection of “bad” ones it has gathered:

• sxkjcc.asia
• sxkjcd.asia
• sxkjcy.asia

Then, one rule is enough to catch them all: @sxkjc[a-z0-9].asiab

How to protect your company from spam

According to our analysis, 44.9% of emails sent last year were spam. Unwanted, unsolicited emails distract employees, waste working time, and clog inboxes. In some cases, they also contain scam, phishing, or malware content. To protect business customers from this deluge of threats, our solutions for corporate email security have anti-spam technologies that we constantly improve. This includes the technology described above for blocking domains generated by DGAs.

How new PHP vulnerabilities threaten home users

On October 21, two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, affecting nearly 70% of websites worldwide. But if you think this’s only an admins’ headache, read on: we explain why your photos, music, archives, games, NAS and smart-home systems may be at risk, and how to protect your data and devices.

Tips

Nine reasons to set up a VPN on your router

Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.

Fact and fiction about hidden Wi-Fi network names

Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.