Potemkin Loader DGA DNS Pattern

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•12

Detects DNS lookups targeting the .xyz TLD indicative of Potemkin DGA behavior, specifically when initiated by 'RunSearch.exe'. The regex identifies domain names with a pattern of 2 or 3 hyphen-separated alphanumeric strings, followed by the .xyz TLD.