Technology that blocks DGA domains | Kaspersky official blog

Spammers automatically register hundreds of near-identical domains to fool security solutions. We can block those domains automatically, too.

Roman Dedenok

October 23, 2026

We use many technologies to detect email spam. They analyze every part of a message: headers, text, images, and links. But the first thing our email products focus on is the “From” field. If the address contains a domain that’s already on our denylist, it’s an easy call. But spammers know the drill, so they register domains in industrial quantities to make emails, even from a single campaign, arrive from completely different addresses. Clearly, they don’t do that by hand. The process has long been automated, and attackers’ algorithms can register huge numbers of domains in a matter of minutes. But every domain needs a name. Coming up with a unique one for each isn’t feasible. So spammers use domain generation algorithms (DGAs), which create similar names with minor variations, based on date and time, pseudo-random numbers, and so on.

In fact, to block mailings such as these, you don’t need every address on your denylist. We’re good at automating processes, too. For some time now, our email solutions have included a technology that detects domains generated by DGAs, and shuts down entire batch with a single rule. Let me explain how this technology works.

As soon as any of our technologies flags an email as spam, its address becomes subject to further examination. If it meets a number of criteria, its domain is added to our database of domains we consider “bad”. We built a cascade of classifiers that compares these domains by similarity, groups them into clusters, and creates a short but comprehensive rule that blocks the entire cluster. Our email protection solutions receive this rule with an update. From then on, they block all emails sent from addresses on any domain that matches it — even if those domains have never been used in spam campaigns yet.

Here’s a real-world example. Let’s say the classifier flags several lookalike domains in a collection of “bad” ones it has gathered:

Then, one rule is enough to catch them all: @sxkjc[a-z0-9]\.asia\b

According toour analysis, 44.9% of emails sent last year were spam. Unwanted, unsolicited emails distract employees, waste working time, and clog inboxes. In some cases, they also contain scam, phishing, or malware content. To protect business customers from this deluge of threats, our solutions forcorporate email securityhave anti-spam technologies that we constantly improve. This includes the technology described above for blocking domains generated by DGAs.

On October 21, two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, affecting nearly 70% of websites worldwide. But if you think this’s only an admins’ headache, read on: we explain why your photos, music, archives, games, NAS and smart-home systems may be at risk, and how to protect your data and devices.

On October 21, two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, affecting nearly 70% of websites worldwide. But if you think this’s only an admins’ headache, read on: we explain why your photos, music, archives, games, NAS and smart-home systems may be at risk, and how to protect your data and devices.

Editorial Team

October 22, 2026

We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers

We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers

Oxana Frolova

October 30, 2026

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

Stan Kaminsky

October 28, 2026

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

Lama Saqqour

October 15, 2026

University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.

University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.

Maxim Baybarin

September 30, 2026