Technology that blocks DGA domains | Kaspersky official blog

Kaspersky employs a technology that detects domains generated by domain generation algorithms (DGAs), which spammers use to register large numbers of similar domains automatically. When an email is flagged as spam, its domain is analyzed and, if meeting certain criteria, added to a database of 'bad' domains. A cascade of classifiers groups similar domains into clusters and generates concise blocking rules that cover entire clusters of DGA-generated domains. These rules are distributed to Kaspersky's email protection solutions, enabling them to block emails from these domains, even if the domains have not yet been used in spam campaigns. This approach allows efficient bulk blocking of spam domains and reduces the impact of spam, phishing, and malware emails on corporate customers.

The technology reduces the volume of spam, phishing, and malware emails reaching users by blocking entire clusters of DGA-generated domains with a single rule. This decreases employee distraction, wasted time, and exposure to malicious content delivered via email. It improves the effectiveness of email security solutions by addressing the challenge posed by the automated, large-scale registration of similar spam domains.

This technology is already implemented in Kaspersky's email security solutions and continuously updated. Organizations using these solutions benefit from automated detection and blocking of DGA-generated spam domains without requiring additional action. No specific user action is required beyond maintaining updated Kaspersky email protection products.