| Domain | Category | First seen | Queries | Hosts | Verdict | |
|---|---|---|---|---|---|---|
| bb-goaml-update[.]com | Look-alike of goAML | 2026-10-26 | 212 | 14 | Blocked | |
| x7f3k9q2[.]duckdns[.]org | Dynamic DNS · high entropy | 2026-10-27 | 4,812 | 1 | Blocked | |
| bangladeshbank-portal[.]top | Look-alike, newly registered | 2026-10-25 | 38 | 6 | Blocked | |
| cdn-telemetry[.]net | Unclassified | 2026-10-20 | 2,041 | 212 | Review |
H(label) = − Σ p(c) · log2 p(c) # Shannon entropy of the sub-domain
flag if H > 3.8 and len(label) > 40
or unique sub-domains per host per hour > 300
or TXT/NULL record ratio > 0.2
score = 0.5·norm(H) + 0.3·norm(volume) + 0.2·record_ratio