项目说明
Domain Generation Algorithms
Domain Generation Algorithms (DGAs) of Malware reimplemented in Python.
O
<details><summary>banjori (aka MultiBanker 2, BankPatch(er))</summary>
Links
Example Domains
earnestnessbiophysicalohax.comkwtoestnessbiophysicalohax.comrx.comhjbtestnessbiophysicalohax.comtxmoestnessbiophysicalohax.comagekestnessbiophysicalohax.comdbzwestnessbiophysicalohax.comsgjxestnessbiophysicalohax.comigjyestnessbiophysicalohax.comzxahestnessbiophysicalohax.com</details>
<details><summary>bazarbackdoor (aka BazarLoader Team9Backdoor))</summary>
Links
Example Domains
Real DGA:
adegjkaiggjm.bazareehhjmejjhjo.bazardehiildjjiin.bazarceeiklcjgikn.bazardceikkdhgikm.bazarbfehjmbkghjo.bazaradegjmaiggjo.bazardchiikdhjiim.bazarefehikekghim.bazarbdhhjkbijhjm.bazarBuggy DGA:
-\_fdgimzkfgio.bazaar
-e\bfkieedfkk.bazaar
-efdgikekfgim.bazaar
-\]begimzgggio.bazaar
-bbbfhlbgdfhn.bazaar
-\^ehikizjjikk.bazaar
-aechimajehio.bazaar
-\]defiizigfik.bazaar
-\\geiizeieik.bazaar
-degfjkdjifjm.bazaar
</details>
<details><summary>bumblebee</summary>
Example Domains
cmid1s1zeiu.lifeitszko2ot5u.life3.lifenewdnq1xnl9.lifejkyj6awt1ao.lifeddrj.life1pnhp5o5za1.lifey13iq.lifexp0btfgegbo.life</details>
<details><summary>chinad</summary>
Links
Example Domains
8f6bacmw30xxv6sc.cn486txu3yjly0xcmz.ruxmi6x8zg9rkanmyo.infospy1jhdbm.nete.info7qbys97e3pcw262c.infokz89iy97c7n7vbur.bizzmk.rutr1yy6lxtry1gsts.bizmfq6uwq3p2hvc8zn.cn</details>
<details><summary>corebot</summary>
Links
Example Domains
lkhylm0mhyfuhg.ddns.nets63234wlu.ddns.netafe6mfy23xcxgfa.ddns.net7rsl1f34sfq0oj3jw.ddns.netir7l3po0gjy8ypqjm8o.ddns.net3lgrupwdi.ddns.neti8a0q2wdu8otulkfylo2gdq.ddns.netkh1her76a.ddns.netubgp1f1han7lu410eh5.ddns.netuliry8knadmpmdm4wti6oro.ddns.net</details>
<details><summary>darkcracks</summary>
Links
Example Domains
sTDFUgOAgjL.comE.comA.comM.comI.comU.comQ.comYTCFUgOAgjL.comkTCFUgOAgjL.comgTCFUgOAgjL.com</details>
<details><summary>dircrypt</summary>
Links
Example Domains
rauggyguyp.comllullzza.commluztamhnngwgh.commycojenxktsmozzthdv.cominbx.comfuriararji.comzrkd.comwyuhdsdttczd.comhpaxgpkteomjaxywwelr.commydojltbqjnwailyyoa.com</details>
<details><summary>dnschanger (aka Alureon)</summary>
Links
Example Domains
aktklyvbiu.comzgimjzlnrl.comtcfejerekw.comtfaunnjmxt.comyd.com</details>
<details><summary>fobber (aka Tinba v3)</summary>
Example Domains
.netbtpnxlsfdqbhzazyx.netukfmknjdenthvktgc.netqupxsrhrmuoinqrit.netgjsbydmrpfzsmnfiu.netindpstqbetcpcqprx.netgwrdmhyjfcpcutmhp.netbwnzcyypcbmnlpfsw.nettwkpwfuec.netpdwfuxgnahmgsxhit.net</details>
<details><summary>fosniw</summary>
Example Domains
app2.winsoft0.comapp2.winsoft1.comapp2.winsoft2.comapp2.winsoft3.comapp2.winsoft4.comapp2.winsoft5.comapp2.winsoft6.comapp2.winsoft7.comapp2.winsoft8.comapp2.winsoft9.com</details>
<details><summary>gozi (aka Ursnif, Snifula, Papras)</summary>
Links
Example Domains
quodpresidentemaxsagit.compertantumfitusu.comindulgentiarumlicet.commoriblasphemianegocii.comptribueretnossetnonin.comnonsicordinario.coms.cominestimabiler.comulpurgatoriopetrum.compapacricognitisipro.com</details>
<details><summary>kraken/v1 (aka Bobax, Oderoor)</summary>
Links
Example Domains
ibbwnhgh.mooo.comrbqdxflojkj.mooo.comsmhburg.dyndns.orgbltjhzqp.dyndns.orgclwafrfuuxq.yi.orgcffxugijxn.yi.orgi.dynserv.cometllejr.dynserv.comotpxmk.mooo.comejfjyd.mooo.com</details>
<details><summary>kraken/v2 (aka Bobax, Oderoor)</summary>
Links
Example Domains
xpdbwuimwag.comnwpegpjtx.comsmmyuhxlt.netxj.netl.tvl.tvcjuszcfwo.ccegbmbdey.ccwjxaprgne.com.com</details>
<details><summary>locky</summary>
Links
Example Domains
gegjiimqmlgtdmk.tfpccibcjncnhjn.ytrddipikmrap.usmmhmkqfc.be.pmqtysmobytagnrv.itsuhpqiumpjsv.rucscffbwbhs.uk</details>
<details><summary>m0yv</summary>
Links
YouTube video "Sinkholing the Domain Generation Algorithm of m0yv"Time independent in dga.py, time-dependent in dga-td.py.
Example Domains
pywolwnvd.bizssbzmoy.bizcvgrf.biznpukfztj.bizprzvgke.bizzlenh.bizknjghuig.bizuhxqin.bizanpmnmxo.bizlpuegx.biz</details>
<details><summary>monerodownloader</summary>
Example Domains
31b4bd31fg1x2.org31b4bd31fg1x2.tickets31b4bd31fg1x2.blackfriday31b4bd31fg1x2.hosting31b4bd31fg1x2.feedback3f8c8079fd4c5.org3f8c8079fd4c5.tickets3f8c8079fd4c5.blackfriday3f8c8079fd4c5.hosting3f8c8079fd4c5.feedback</details>
<details><summary>murofet/v1 (aka LICAT)</summary>
Links
Example Domains
giywswshrgxc.ruxaiqpbprgymb.comamgqgularpzxeapztxenbx.netpfscijbmthyfiyjgergugtkbqyh.orgxglfcmsgor.inforcteqwkequojntib.bizmjfqylbiaunffuaeunzdqdwscu.ruqobeylpxgpfknlptukyddq.comrgwgizukficdgetwsxo.infobetgyaeswxorwc.org</details>
<details><summary>murofet/v2 (aka LICAT)</summary>
Links
Example Domains
cmq.bizcmq.comrloqpoiongsuwyq.netrloqpoiongsuwyq.orgzsophzovtfor.infozsophzovtfor.biznlifthjnbgnfweq.orgnlifthjnbgnfweq.comhykpttqsxsmvkoc.infohykpttqsxsmvkoc.org</details>
<details><summary>murofet/v3 (aka LICAT)</summary>
Links
Example Domains
nxlya47huo61czerb18o51e11d30i55gycwe31lx.rujwdzptm69p62izce11.comp42p52ncqotp22e61.netb28n40i25b68gte41o61dwc19htc29jwgxiqfzbr.orgktirhsn50kzc49b58cyf32fwh14h64dzgxiqcz.infobre41hp52kwe21gw.bizn30mwhsoxfqe51j56lunsg13o11hyd60ewf52nu.ruh7c29kyi55fun50.comnzosg13oymzg63ntpxaro51btk.infoczfsn20exg53nzcqcrg43exf62b28p22pyd50lu.org</details>
<details><summary>mydoom (aka Novarg, Mimail.R, Shimgapi)</summary>
Example Domains
qehspqnmrn.infommahaesqar.inpwprhhnqqn.inmrspmramrn.inarphansaqh.comhrhspsrenn.netaepaaemrmn.comwsaehwmnms.inarwrseqssh.comewamspqwha.ws</details>
<details><summary>necurs</summary>
Links
Example Domains
nccojq.mxhoedwwwywnmmbi.acaeaeneaoinf.muccecggc.usmfffpmgtplxbyagbtegh.comthlxuwnadtdtsm.bizedkomqpeufjyafccj.inmxomklaqau.pwn.tvnhysbiomr.ir</details>
<details><summary>newgoz (aka Gameover Zeus, Peer-to-Peer Zeus)</summary>
Links
Example Domains
xzz3ug32bale1uo60y7xj6rge.com1hyzmw3l2phycet88hzr2do34.net2ppq821cfem5m1mdua46pxg7bj.bizunlm9w9l8upy1kdde0kba7ktf.org1ixhw3p1ncr3cf1pjfrpz14n1u0e.com1o460ktpdhna1k0lk3ecwujxn.net183t0wjzlthe51wigptk4rl29.org1i3ux5a1hj6ndqejmxone45g0v.net5mcdp71mbutpb1tglu0s4p0lrf.comn3i5yn19w82.org</details>
<details><summary>ngioweb</summary>
Links
Netlab - An Analysis of Linux.Ngioweb BotnetNetlab - Quick update on the Linux.Ngioweb botnet, now it is going after IoT devicesExample Domains
minihileth-subatudofy.org
re.info
enisobure-antidimadom-minike.org
semiridinution-postepudency.com
prolefexity-disorisance.org
nonebazish-disahibelen-misehurarage.name
ilolupage-nonurisudize-minikazolike.net
semicofaxiful-enixakor-subafapehen.info
o.net
pre.info
</details>
<details><summary>nymaim</summary>
Example Domains
oftbpec.comlotmpwyk.infoseikpwq.infobcfatyltdvp.inforfwstgy.comhokybhnf.bize.netmtzpbzbfvy.infohacckgiakhl.commosmeuw.net</details>
<details><summary>nymaim2</summary>
Links
Example Domains
surfaces-drawing.comshaft-criterion.ccstops-hash.idunitsknowledge.comwiredgraph.tmtimelydesignation.costablelikely.chstainless-loan.lkwagon-documents.sctrainerprocessors.tk</details>
<details><summary>padcrypt</summary>
Links
Example Domains
elkfcfnacacmofdf.commkmeeefncfnfdmbm.deffcdcnbmmnaeddcd.comddkfodnaadmbmofo.co.ukefneboaodnmbecoa.cobafomkfalcfcdkom.infoonlmcddadnacfclc.comdcfmddfbobkmafma.comlmmfdccmnnfnmfdl.cokcknconmceeemlnm.com</details>
<details><summary>pitou</summary>
Links
Example Domains
--------------+koohoavab.net |koohoavac.net |koohoavad.net |koohoavaf.net |koohoavag.net |koohoavah.net |koohoavaj.net |koohoavak.net |koohoaval.net |</details>
<details><summary>pizd</summary>
Links
Example Domains
difficultnearly.netdollarnearly.netdifficultpossible.netdollarpossible.neteearlynation.netescapenation.neteearlypleasure.netescapepleasure.neteearlynearly.netescapenearly.net</details>
<details><summary>proslikefan</summary>
Links
Example Domains
flarvcpk.eustjneohiod.biz.seqylptiin.infobs.comhjiknr.netarpeiezki.orggobqca.ruti.insmutloo.name</details>
<details><summary>pushdo</summary>
Example Domains
weafokuggeir.kzsictemuborug.kzcirpicficj.kzgeijanmap.kzfuxhuxsabi.kzsiclisozdokq.kzsozcoqnafrex.kzqeobifups.kzcokoqdeah.kzlatqafbuxwic.kz</details>
<details><summary>pykspa/improved</summary>
Links
Example Domains
uammskmq.orgjqplflktas.inforybwtr.netuyznvxlof.infogakcmqiw.comwewsvat.netowhadwkskevw.netnkndlzhjgrpc.infoisypszqe.netjoebbaamoyt.info</details>
<details><summary>pykspa/precursor</summary>
Links
Example Domains
llfwhgn.comguqqkaiq.bizwctymo.netlo.comoruhbanansnan.ccmkncjk.bizyunonsuiwcymao.netyxpojufqbex.comqhxgzufqbex.ccyywiywiq.biz</details>
<details><summary>qadars</summary>
Links
Example Domains
jk9enwhansl2.orgsdqfodmf81m7.net5uro1uzspejk.netub4hinsduf0p.netzs9ijo1er81u.com0t67c5arw9yf.netle.net67k1q3c1mr8x.org7w1yf49irk5m.netgdunwhq7s9qb.org</details>
<details><summary>qakbot</summary>
Links
Example Domains
bqkrtxgkmriwsiwcngtivpx.infojdtmfupdyueqeld.netguhmpoxzivhba.comnqqxqhuacaqhzurde.orglgqsqgpqzijwid.infoykolyecdcyk.bizzt.bizzqrmkpi.orgiqyqwhntrxfeq.orgftadkbomxlnsib.info</details>
<details><summary>qsnatch</summary>
Links
Example Domains
t2q2r.cfgc9nz.tk07tvvc.com7ubqo.ml53bcm.de6zltf.rockshv7uv.mxnypno.bizqkzccy.netrassb.cn</details>
<details><summary>ramnit</summary>
Links
Example Domains
knpqxlxcwtl.comn.comhgyudheedieibxy.comanrylixwcbnjopdd.com.comjhghrlufoh.comtqjhvylf.comhufqifjq.comitktxexjghvvxa.comppyblaohb.com</details>
<details><summary>ranbyus/may</summary>
Links
Example Domains
ikwoqkwuajpbyx.comniukpdrluwlfox.pwrcnxisuibbadng.inwbqtidj.mejrdyumcieyipnv.ccy.sut.twlycyr.netepddeukdimbpft.comtrbhxhmbsikoaq.pw</details>
<details><summary>ranbyus/september</summary>
Links
Example Domains
jxbdxeyxttdmcjagi.meiqmadgybfhnrssadm.ccgdoldaognceaedkke.sujnbnyrmxmpblfgstk.twucjetnyaitygjidva.netjejocqwtcbtuymvao.comstuctjsqfxghcesyw.pwgfidctymbxiaqyuyk.inojrqwrlhesfshawva.mebqjq.cc</details>
<details><summary>reconyc</summary>
This DGA has unpredictable seeding, i.e., it uses GetTickCount` as the seed. I still list the DGA as it might be useful for testing or training DGA detection algorithms.
Example Domains
E5zHail0Mw.comgabb.comCumpP2A4d7.com5eswmwNQyF.comlExfSzyuwP.comJZpESGsPFF.comUmIaRnijeT.comsHr0xE9Idm.comnYcEX7wlCF.com.com</details>
<details><summary>sharkbot</summary>
Example Domains
64f30398ecda3bbf.xyzf008fc473fddedc4.livecfbadaf0cd7b0ac3.comb8dfe.store99c485497c079a09.info6d54b683fc2cc58f.topabb7547058fef9fb.net</details>
<details><summary>shiotob (aka Urlzone, Bebloh)</summary>
Links
Example Domains
wtipubctwiekhir.netrwmu35a.comrskb5bsfhm2fk5h.netrbp9pprrxgflut9.comzzxeyzgy45yy2a.nete3oa4wgl.commqmq1h.netpd4o4wu24vimn.comtlmrz.netpbmnz59uzndpo.com</details>
<details><summary>simda (aka Shiz)</summary>
Links
Example Domains
gatyfus.comlyvyxor.com.comqetyfuv.compuvyxil.comgahyqah.comlyryfyd.com.comqegyqaq.compurydyv.com</details>
<details><summary>sisron (aka TOMB, Win32/Agent.WRQ, Trojan.Scar)</summary>
Links
Example Domains
mdiwnjiwmtya.commdewnjiwmtya.commzewntiwmtya.commzawntiwmtya.commjkwntiwmtya.commjgwntiwmtya.commjcwntiwmtya.commjywntiwmtya.commjuwntiwmtya.commjqwntiwmtya.com</details>
<details><summary>suppobox</summary>
Links
Example Domains
journeydestroyagainstnightwithineffortstreetbetterhusbandlittle</details>
<details><summary>symmi</summary>
Links
Example Domains
ogo.ddns.netafowkaupbabe.ddns.netipkureleakm.ddns.nethegiruqo.ddns.netluimreim.ddns.nettiakqukoahuvu.ddns.netloelkuanduur.ddns.netagdehukoev.ddns.netgiagkuekorla.ddns.netleufiroqipomu.ddns.net</details>
<details><summary>tempedreve</summary>
Links
Example Domains
dlbebsga.netenqbgrmt.comxjlwpfnk.infoebabkjcx.orgh.nets.comglknxfgq.infoadoduloh.orgjgrxrxwh.netctmrgbmz.com</details>
<details><summary>tinba (aka TinyBanker, Zusy)</summary>
Links
Example Domains
blackfreeqazyio.ccn.comn.netn.inn.rusjhuqlwrqhqx.comsjhuqlwrqhqx.netsjhuqlwrqhqx.insjhuqlwrqhqx.rupxqgonyogeee.com</details>
<details><summary>tufik</summary>
Example Domains
dbqwpmpnruesywj.comqxxmubfleztlnkx.comrrnywowqgmjvnltg.comrqnjd.comutoiopxjrphvoiy.orgttoouemmimnxnmj.comnmjsoourllgveecj.orgjupr.biznmjsoourllgveecj.bizdotqwjmhqlushjlo.biz</details>
<details><summary>dmsniff</summary>
Example Domains
albdfhln.comalcgkown.comaldjpvqt.comalemuown.comalfpmrnq.orgalgspvqt.orgalhvrytw.orgaliyuown.orgaljnwpyo.orgalkpmrnq.net</details>
<details><summary>unnamed_downloader</summary>
Example Domains
ddknt.github.ioddktn.github.ioddnkt.github.ioddntk.github.ioddtkn.github.ioddtnk.github.iodkdnt.github.iodkdtn.github.iodkndt.github.iodkntd.github.io</details>
<details><summary>unnamed_ja</summary>
Links
Example Domains
rxxeqcoy.cckmymbyzd.cocfukbzbmg.eusblwtafc.cclqdoacat.codplmjcjic.euttukaiwjdx.ccmeimklqh.coenmxqcxhtl.euunmias.cc</details>
<details><summary></summary>
Links
Example Domains
usahwutle.comfolocnam.comawumsah.comedorwufli.commisocgutlah.comedarwotda.commelarwetdic.comusucnitdohg.comregomseh.comosicnumd.com</details>
<details><summary>xmrig_genesis (a XMRig malware using the bitcoin genesis block as seed))</summary>
Example Domains
1d78e50d.com1d78e50d.net1d78e50d.org1d78e50d.duckdns.org2b04216f.com2b04216f.net2b04216f.org2b04216f.duckdns.org2e1d985c.com2e1d985c.net</details>
<details><summary>zloader</summary>
Links
Example Domains
gdurfdsywubjaaqcqhrh.com.comjcaofaekffeojktmpdax.comiiphrhkculpnub.combjdbpgbjdyredhfyvpie.comwramit.comohyjybhogoeoabjqvpie.comfscqtelyeogmxudotlao.comnsdtx.combohcha.com</details>
项目信息
开发语言：Python
Star 数：692
技术要点
该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Some results of my DGA reversing efforts展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。