Very interesting research Jaeson. An anomaly detection mechanism I see possible here is to flag as suspicious domains with a very large number of subdomains pointing to very compact or very distributed IP address spaces. What do you think?

Francesco Ongaro,
http://www.easyaudit.org/