Abstract: A method and an apparatus for detecting botnet domains is described. In one embodiment, the method includes monitoring network traffic associated with a plurality of clients in a network. Based on the monitoring, information related to a plurality of domains that are queried is stored. The method includes identifying one or more suspect clients in the network based on the stored information and determining a subset of suspect domains based on the stored information related to the domains queried by the suspect clients. The method can include determining client activity information and using the client activity information to determine a polytope region for a client. The method includes comparing each suspect domain to the polytope region and associating a domain with a group of blocked domains if the domain falls within the polytope region.

Abstract: The methodology for detecting spammer domains includes storing a plurality of DNS requests, wherein each DNS request comprises a combination of a higher level domain name and a lower level domain name, and wherein the higher level domain name corresponds to a blacklist server and the lower level domain name is a domain name that is to be used as a query directed towards the blacklist server, filtering the DNS requests to obtain a plurality of lower level domains, calculating a popularity score for each unique lower level domain name of the plurality of lower level domain names, determining whether a given unique lower level domain name is suspicious based on the popularity score, and when the given unique lower level domain name is determined to be suspicious based on the popularity score, adding the given unique lower level domain name to a blocklist.