Is this domain talking to malware?

Malware reaches its command-and-control server through domains generated by an algorithm, thousands a day, too fast for a blocklist to follow. These models read the domain name itself and tell you which ones were never chosen by a human.

domains · one per line or comma-separated 0

Free, no sign-up, up to 50 at a time.

How the domain gets there

The malware on an infected machine and the attacker run the same generator, seeded by the date. Both produce the same list of domains for today. The attacker registers one of them; the rest resolve to nothing. The malware walks the list until something answers, and that answer is the command-and-control server.

An infected phone runs a DGA that produces two domains. One returns NXDOMAIN from the DNS server; the other resolves to an address registered by the attacker, and the malware connects to that command-and-control server. — A blocklist cannot keep up with this: the list changes every day, and only one entry is ever live. What does not change is how the names look — and that is what the models read.

What it looks at

Only the domain string. No DNS lookup, no WHOIS, no visit to the site. A name like kwtoestnessbiophysicalohax.com carries the statistical fingerprint of the algorithm that produced it, and that fingerprint survives even when the domain is registered minutes ago and appears on no list anywhere.

When a domain is flagged, the models also name the malware family behind it — conficker, cryptolocker, emotet, locky, necurs, qakbot, ramnit, tinba and others, 35 in total.

What it will not catch

Ordinary phishing. A domain like itau-seguranca.com was typed by a person and reads as a plausible name, so it is correctly classified as benign here. This is a narrow, high-precision signal for botnet infrastructure — not a general-purpose blocklist.

For scam links arriving by message or email, the same models run locally in Aruana, alongside detection built for that problem.

API

One GET request, comma-separated domains, JSON back. No key, no rate limit worth mentioning. Built to drop into pfSense, AdGuard, a Squid proxy, or whatever already sees your DNS traffic.

curl -X GET "https://detectmalware.rj.r.appspot.com/detect/?domain=earnestnessbiophysicalohax.com,google.com"

{
  "earnestnessbiophysicalohax.com": { "Malware": true,  "Family": ["cryptolocker"] },
  "google.com":                     { "Malware": false }
}

Where the models come from

A CNN1D and an LSTM trained on labelled DGA traffic during doctoral research at UnB, in collaboration with UW Tacoma. A domain is only flagged when both models agree, which is what keeps false positives on ordinary sites near zero.

The work sits in a larger question: a network administrator who wants this analysis has to hand someone their DNS traffic, which is a record of everywhere the company goes. Secure multi-party computation removes that trade — the model scores a domain it never sees in the clear, and the model owner never reveals the weights.

Maia RJM, Ray D, Pentyala S, Dowsley R, De Cock M, Nascimento ACA, Jacobi R. An end-to-end framework for private DGA detection as a service. PLOS ONE 19(8): e0304476, 2024. Open access · source

The paper builds private versions of the same two architectures used here, plus the embedding layer, and adds differential privacy to the model’s outputs. Post-training quantization cuts inference time by 23–42% with no loss of accuracy. Related work in the same line appeared at PETS 2024, took first place at iDASH 2021, and second in the White House / UK Privacy-Enhancing Technologies Prize Challenge.

This endpoint is the plain version: it runs the models directly and sees the domains you type. The private protocols are research, not what answers here. If you would rather nothing leave your machine at all, the same models run locally in Aruana.