In reply to Francesco Ongaro.

Thanks for your comment Francesco. I think your idea has merit.

First, most domains do not have tens of thousands of subdomains. So that right there is one bit of behavior that should cause us to pause and take a closer look.

Second, many DNS names possess two, three, or even four subdomain labels (ex. "host.example.com" has two subdomain labels), but having a minimum of four and as many as eight labels for subdomains is certainly eyebrow raising. The fact that most of the subdomain labels are gibberish is yet another red flag.

Third, as you note, there are a large number of subdomains pointed at a small number of IPs. I have seen other cases where similar behavior has turned out to be bad. For example, spammers who encode the recipient's address in the hostname of a link, and all hostnames resolve to the same IP.

I don't know that a large number of subdomains resolving to wildly different IPs would be as useful a technique. In my opinion the potential for FPs may be greater here.

If you end up testing any of these we would appreciate hearing your feedback. Thanks again for your comment and for reading our blog!