CertStream is a free service for getting information from the Certificate Transparency Log Network. I decided to investigate the presence of domains generated by Domain Generation Algorithms (DGA) in this stream, and I found some interesting phenomena.

Looking at the between the days of July 1, 2018 and September 30, 2018, I found 698 DGA domains that had certificates. There were 10 DGA campaigns represented and the distribution looks like:

Now, if we consider the delta between the first time the domain showed up in CertStream versus the day it was an active DGA domain:

This doesn't mean much without the number of domains that showed up before or after, so that's summarized here:

Of the 514 suppobox domains, 494 had certificates before they showed up as DGA domains. Is this worrisome?

To investigate that, I looked at the websites for all of the domains using wget. 111 of the domains didn't have functioning websites, 33 of the domains had 'for sale' websites, and the rest were functioning.

These domains were pulled between July and September. The verification of the domains was made in October. It is possible that the 111 missing domains had functioning domains before the verification, we don't know.

We do know that DGA is usually used for ephemeral domains. The fact that these domains had certificates in CertStream does not change that, but it does make us wonder not only about the domains but about CertStream itself.

Are these legitimate websites or are they fronts for maliciousness? We don't know, unfortunately. The sites run the gamut from the legitimate looking:

To the pages that are missing content entirely:

Without additional information, we are unfortunately left with more questions than answers.