How a five-symbol alphabet exposes three “independent” clusters as a single campaign The Missing Dimension When analyzing bulk-registered domains for threat intelligence, clusters are commonly identified by two complementary methods: infrastructure signals (name server configuration, registrar, hosting) and naming properties (structural patterns, vocabulary, character composition). Both approaches are well established. Infrastructure signals work because provisioning […] The post Amusing Numerology: Analysis of the Numbers in Domain Names appeared first on Infoblox Blog .