DGA botnet domains: malicious usage of pseudo random domains

The report surveys multiple sources of pseudo-random domains that can be mistaken for DGA botnet activity, including pseudo-random subdomain DDoS attacks on authoritative DNS, DNS tunneling for covert channels and exfiltration, Tor proxy access to .onion services, malicious IDN/Punycode abuse (including IDN-based DGAs), domain shadowing for exploit kit delivery, and subdomain brute forcing. It explains how these techniques generate high-entropy queries, complicate detection, and increase false positives, and it offers context to guide network defenders in refining DGA detection and prioritizing follow-up analysis.