Whitepaper: Botnet Analysis Leveraging Domain Ratio Analysis

Zscaler analysed Transactions:Unique Domains per TLD ratios to surface anomalous TLD traffic; this process highlighted a .NU domain that received numerous HTTP connections over TCP/53 from multiple customers. Further investigation found those customers infected with a previously undetected variant of the Win32.PcClient backdoor, and the report describes the detection methodology and incident analysis.