From 360 Sandbox: A fix length of 12, a-x, tlds: [com, in, net, ru]. Looks like a new seed of Tinba. - Githubissues

360netlab / DGA

Suspicious DGA from PDNS and Sandbox.

MIT License

182 stars 35 forks source link

From 360 Sandbox: A fix length of 12, a-x, tlds: [com, in, net, ru]. Looks like a new seed of Tinba. #21

Closed suqitian closed 8 years ago

suqitian commented 8 years ago

MD5 7ae39dd4aa29005d4eac155b83b7689e
Example of domains dksmdvjfgpwt.com dksmdvjfgpwt.in dksmdvjfgpwt.net dksmdvjfgpwt.ru dns.msftncsi.com ebcfuwemulkk.com ebcfuwemulkk.in ebcfuwemulkk.net ebcfuwemulkk.ru ehidpbbpxxxs.com ehidpbbpxxxs.in ehidpbbpxxxs.net ehidpbbpxxxs.ru epsrfollswdw.com epsrfollswdw.in epsrfollswdw.net epsrfollswdw.ru
It should be the DGA of Tinba.

suqitian commented 8 years ago

A new seed of Tinba.

Seed: "jw72Gsmf620ohwy7" Domain: "i8274g1yxi9orjuy.cc" TLDs: ['com', 'net', 'in', 'ru'] The number of domains: 100

An implementation of DGA in Python is here.