Abstract: The methodology for detecting spammer domains includes storing a plurality of DNS requests, wherein each DNS request comprises a combination of a higher level domain name and a lower level domain name, and wherein the higher level domain name corresponds to a blacklist server and the lower level domain name is a domain name that is to be used as a query directed towards the blacklist server, filtering the DNS requests to obtain a plurality of lower level domains, calculating a popularity score for each unique lower level domain name of the plurality of lower level domain names, determining whether a given unique lower level domain name is suspicious based on the popularity score, and when the given unique lower level domain name is determined to be suspicious based on the popularity score, adding the given unique lower level domain name to a blocklist.

Abstract: A method includes arranging a plurality of network domains from DNS server logs into a cohort of network domains, wherein the DNS server logs are for at least one client internet protocol (IP) source address, extracting, from the cohort of network domains, a plurality of features related to the network domains in the cohort of network domains, training a recurrent neural network (RNN) based on values of the plurality of features related to the network domains, operating the RNN to make a prediction of expected values for the plurality of features for a future period of time, comparing the expected values to actual values of the plurality of features for the future period of time, and when the expected values differ from the actual values by a predetermined threshold, indicating that a host associated with the at least one client IP source address is operating with an anomaly.