Why can whoever holds a malware sample pre-register its generated C2 domains?

## The wrong answer this question exists to correct The intuitive reading of "the malware generates twenty thousand new names a day" is *unpredictable*, and it is wrong. Volume is not entropy. A generated name is reachable by the implant only if the operator can compute the identical string in advance and register it, and the two sides never talk before the first contact — that is the whole point of a fallback. So the input to the generator must be something both parties can derive independently and offline. In practice that is the current date, sometimes combined with a constant compiled into the binary, occasionally hashed a few thousand times to slow enumeration down. Nothing in that is secret from someone holding the file. ## What determinism actually gives away Once the routine is understood, three things follow immediately. 1. **Any future date can be evaluated now.** The generator has no state that accumulates on the victim host; feed it next month's date and it prints next month's crop. 2. **Every infected host produces the same crop.** The names are a property of the family and the date, not of the machine. That is what makes them a rendezvous at all — a per-host name would give the operator nothing to register. 3. **The generator is a fingerprint.** Its output pattern — the length, the character distribution, the set of top-level domains it uses — belongs to that family, so the names themselves identify the code that produced them. The design is therefore an *economic* defence, not a cryptographic one. The operator's real advantage is asymmetry of cost: they need one name to answer this period, while denying the crop means taking all of it, every period, forever. Crews inflate that asymmetry deliberately — thousands of names per day, spread over many top-level domains including country registries with slow processes, awkward paperwork and per-name fees that make blanket registration unaffordable. ## Owning the name is not owning the bots A second correction worth having ready: registering a generated name gets you the connections, not the population. Competent implants authenticate the responder — an embedded public key, a challenge the operator must sign, a fixed value in the reply — precisely so that a stranger holding the name cannot task the installed base. The check runs in the direction that matters to the operator: the bot verifies the server, so whoever squats the name receives check-ins and can answer nothing that will be obeyed. Rivals were the original threat model here, not defenders; a competitor who could take over a generated name could steal an entire installed base for the price of one registration. And even a perfectly executed sweep of the crop is a rental, not a cure. It denies one path for the period it covers. The code is still resident, the trigger still fires, and the next pre-committed layer is still waiting. ## The two upgrades this pressure produces **Seed from data published on the day.** If the input is a value that genuinely does not exist until the period begins — something published publicly on that date and identical for everyone who looks — then the crop cannot be computed ahead of time, only alongside. It costs the operator robustness (the source has to be reachable and stable, and any mismatch orphans hosts) which is why it is a minority design, but it removes pre-registration entirely. **Add a dead drop.** Here the address is not derived at all: the implant fetches an ordinary public page — a profile field, a paste, a repository description, a comment thread — and reads the current address out of it, usually encoded or signed. Nothing in the sample enumerates the future, because the future is written later by the operator with an edit. Removing the account or page removes one signpost; the reader logic and the list of places to look are still compiled in, and the operator simply publishes at the next one. This is the direct answer to "generated names can be pre-registered", and a candidate who can name it has understood the arms race rather than one move of it. ## Clock skew, windows and the small print One mechanical detail that shows real familiarity: because hosts disagree about the date — wrong clocks, time zones, machines waking after weeks asleep — implants usually generate a *window*, trying the crops for yesterday, today and tomorrow, and the operator registers with the same slack. That widens the set to be taken, and it means a name can be contacted well outside the day it nominally belongs to. Also, implants rarely try the whole crop. They walk a subset in order and stop at the first that resolves and authenticates, which is why the operator only ever needs one live registration per period, and why enormous daily crops cost the operator nothing at all. ## What a good answer sounds like Say it in one line — "deterministic given a seed both sides can compute, so the sample is the schedule" — then give the economics, then give the two upgrades. That order shows you know why the design is chosen rather than just what it is called.