# Rotating Subdomains: When One Host Entry Is Always a Step Behind

Attackers who generate a new subdomain for every victim, so blocking the host you saw yesterday achieves nothing today.

Provenance: Observed in Report URI report telemetry.
Published: 2026-07-23. Updated: 2026-08-24.

Some of the hosts we track do not look like anything a person chose. `0a493bc161019.beer`.
`4f852800cedaf3ec.com`. `bsvrrkmpnyyyprmsnynnfrstlar.info`. They are generated, and the domain is
only half the story: underneath each one sits a stream of subdomains that changes faster than anyone
can write rules for.

## Why the obvious response fails

The instinct on seeing a hostile host in your reports is to block that host. It is the right instinct
and against this pattern it accomplishes almost nothing.

Consider the sequence. The skimmer connects to a generated subdomain. It appears in your reports. A
human reads it, decides it is hostile, and adds it to a policy or a blocklist. That change gets
reviewed and deployed.

By then the campaign has moved. Not because the attacker noticed you — because it was always going
to move, on a schedule that has nothing to do with your response. Every entry added this way is an
accurate record of where the attack used to be, and a policy accumulating them looks like diligence
while blocking nothing.

## What actually stays still

The subdomains are free and infinite. The registered domain is neither: somebody paid for it, with a
registrar, and replacing it costs time and money and leaves a trail.

So the domain is the durable thing to match, and matching it means covering everything beneath it. We
write those entries with a leading `*.` — the domain itself and every subdomain under it, however
many there turn out to be, including the ones that do not exist yet.

That last part is the whole point. The next subdomain in the rotation is matched before it has been
generated, which is the only way to stop being a step behind.

## The judgement it requires

Covering a whole domain is a decision that can go wrong in a way an exact-host block cannot, so we
only make it in one situation: the attacker registered the domain themselves.

Those are recognisable. A generated name on a cheap top-level domain, registered days before it
started serving, with nothing else beneath it. There is no innocent host under a domain like that,
because there is nobody else using it.

The opposite case is a legitimate site that has been compromised. Its subdomains belong to a real
business, that business will clean up, and covering the whole domain would take out services with
nothing to do with the attack. We stay narrow there, and accept that we will have to add hosts as we
see them.

## What to look for

The signal is the shape of the name and the shape of the traffic together.

A hostname that reads as machine-generated — long hex strings, consonant runs, no pronounceable
words — is worth attention on its own. But the stronger signal is a series of them: several
different subdomains under one domain, appearing in your reports across days, each seen once or
twice. One odd hostname is ambiguous. A rotation is not.

If you are keeping a manual blocklist and find yourself adding a third or fourth host under the same
registered domain, that is the moment to stop adding hosts and cover the domain.

## Indicators

- *.0a493bc161019.beer
- *.4f852800cedaf3ec.com
- *.bsvrrkmpnyyyprmsnynnfrstlar.info

## Questions

### What is a domain generation algorithm?

Code on both ends that derives hostnames from a shared rule, often a date or a seed, so the attacker and the payload agree on where to connect without the address being written down anywhere. In practice you see a stream of machine-looking subdomains under one registered domain.

### Why doesn't blocking the host I saw work?

Because by the time you have seen it, reviewed it and deployed a rule, the campaign is on a different one. Every exact-hostname block you add is a record of where the attacker used to be.

### Why block the whole domain instead?

The subdomains rotate; the registered domain does not, because registering domains costs money and time. Covering the domain and everything under it means the next subdomain is already blocked before it exists.

### Isn't blocking a whole domain risky?

It would be on a compromised legitimate site, where the subdomains belong to a real business. We only do it where the attacker registered the domain themselves, so there is no innocent host underneath it to catch.