{"id":13591,"date":"2026-05-13T08:25:34","date_gmt":"2026-05-13T15:25:34","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=13591"},"modified":"2026-05-12T11:58:56","modified_gmt":"2026-05-12T18:58:56","slug":"amusing-numerology-analysis-of-the-numbers-in-domain-names","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/amusing-numerology-analysis-of-the-numbers-in-domain-names\/","title":{"rendered":"Amusing Numerology: Analysis of the Numbers in Domain Names"},"content":{"rendered":"

How a five-symbol alphabet exposes three \u201cindependent\u201d clusters as a single campaign<\/em><\/p>\n

The Missing Dimension<\/h3>\n

When analyzing bulk-registered domains for threat intelligence, clusters are commonly identified by two complementary methods: infrastructure signals<\/strong> (name server configuration, registrar, hosting) and naming properties<\/strong> (structural patterns, vocabulary, character composition). Both approaches are well established. Infrastructure signals work because provisioning large numbers of domains is invariably done through automation, and automation tools leave consistent fingerprints. Name servers, registrar choices, and tool-level configurations tend to be uniform across everything a given tool registers, making them reliable grouping criteria. Naming analysis has attracted considerable research attention. Character n-grams, entropy metrics, word-list membership, and domain length distributions are all routinely applied to characterize and separate domain clusters.<\/p>\n

What receives far less attention is the numeric component of the domain name when one is present. When a domain name contains digits, for example, chat-21004430.com<\/span>, connect-02043120.com<\/span>, the number is typically acknowledged at a surface level: how many digits it contains, whether they are leading or trailing, the digit-to-character ratio, perhaps a rough range check. Deeper statistical analysis of the numeric component, including its digit alphabet, its distributional properties, the encoding choices embedded in its generator, is largely absent from published threat analysis.<\/p>\n

That gap is worth closing. The numeric component is not just noise appended to make domains unique. It encodes decisions baked into the generator at design time, decisions that stay constant regardless of which infrastructure cluster the domain lands on, which registrar was used, or when registration happened. That invariance, if detectable, makes the numeric component a particularly reliable provenance indicator<\/strong> for the cluster merge problem: determining whether multiple distinct clusters are actually produced by the same generator.<\/p>\n

The case we walk through here involves three clusters, each detected independently by our system, and each appearing to be a self-contained campaign. Our goal is to show that despite appearing unrelated, all three were produced by the same generator. And we\u2019ll do it through the numbers. Infrastructure analysis does its job. It correctly identifies three separate clusters. Naming analysis finds strong but not conclusive overlap. It is the numeric component that settles the question, and it does so through a single observation.<\/p>\n

What\u2019s in a Number?<\/h3>\n

Before getting into the case, it helps to highlight critical distinction. All numbers are equal, but not all numbers in domain names are made equal.<\/p>\n

When a domain generation system produces a digit string, it can take two fundamentally different approaches.<\/p>\n

Character-level generation<\/strong> treats digits as characters with no numeric meaning. The generator samples from a character alphabet that happens to include some or all of 0\u20139<\/span>, the same way it might sample from a\u2013z<\/span>. The resulting string 31004430<\/span> is not the number 31 million. It is a sequence of eight characters, each independently drawn. Digit frequency, range, and distributional properties carry no special information beyond what any character-frequency analysis would reveal. Much of what gets labeled \u201crandom-looking\u201d domain number analysis in practice is implicitly assuming this model.<\/p>\n

Numeric generation<\/strong> treats the digit string as the representation of an actual number, whether decimal, fixed-width, or expressed in some other base. The generator is working in a numeric space: sampling integers, incrementing a counter, hashing an input, or encoding an index. The digit string you see in the domain name is simply that number rendered in a particular format. And this matters a lot. The choice of number space, how it is sampled, zero-padding conventions, and the base used all leave statistical traces that are specific to that generator and show consistently across every domain it produces.<\/p>\n

The two approaches aren\u2019t always easy to tell apart at a glance. A practical test is whether the digit string shows properties that only make sense at the numeric level: a restricted digit alphabet, a leading\u2011digit distribution that breaks Benford\u2019s Law, uniform coverage of a bounded range, or consistent fixed\u2011width formatting that points to a specific number space. When those show up, numeric analysis is the right tool to reach for.<\/p>\n

There\u2019s a subtlety worth calling out, though. In the case analyzed below, with fixed width strings where all eight positions are filled and digits are drawn uniformly, the two approaches produce output that looks exactly the same from the outside. A generator that samples a random integer from a base\u20115 space and formats it as an eight\u2011digit string is indistinguishable from one that just rolls each digit independently from {0, 1, 2, 3, 4}. Same alphabet. Same length. Same flat distribution.<\/p>\n

So, the data can\u2019t tell us how<\/em> the generator works internally. What it can<\/em> tell us is that the generator is constrained to a fixed\u2011width quinary space and samples it uniformly\u2014and that constraint is unusual enough to be diagnostic regardless of implementation.<\/p>\n

In the cluster we\u2019re looking at, that constraint is hard to miss. And it\u2019s exactly what turns the link between three separate infrastructure clusters into something you can actually prove, not just suspect.<\/p>\n

Three Clusters, One Pattern<\/h3>\n

Here\u2019s what detection system hands us: three separate clusters, each containing a few thousand .com<\/span> domains. Treated in isolation, each looks like a coherent cluster. The question is whether they\u2019re related.<\/p>\n

A first look at the domains themselves makes you lean toward yes but isn\u2019t sufficient for attribution.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Cluster 1<\/th>\nCluster 2<\/th>\nCluster 3<\/th>\n<\/tr>\n<\/thead>\n
engage-21111223.com<\/span><\/td>\nsales-41403444.com<\/span><\/td>\nconnect-13333210.com<\/span><\/td>\n<\/tr>\n
sales-43420231.com<\/span><\/td>\nlink-21123113.com<\/span><\/td>\njoin-13123303.com<\/span><\/td>\n<\/tr>\n
network-44300312.com<\/span><\/td>\njoin-20444321.com<\/span><\/td>\nnetwork-03331432.com<\/span><\/td>\n<\/tr>\n
join-03140312.com<\/span><\/td>\nnetwork-41220410.com<\/span><\/td>\nlink-02331130.com<\/span><\/td>\n<\/tr>\n
network-00022401.com<\/span><\/td>\nengage-33241442.com<\/span><\/td>\ninteract-34332404.com<\/span><\/td>\n<\/tr>\n
chat-01033432.com<\/span><\/td>\njoin-14244311.com<\/span><\/td>\ninteract-23410021.com<\/span><\/td>\n<\/tr>\n
chat-22431310.com<\/span><\/td>\nlink-03440423.com<\/span><\/td>\nconnect-10142201.com<\/span><\/td>\n<\/tr>\n
connect-42304321.com<\/span><\/td>\njoin-33343412.com<\/span><\/td>\nengage-31401033.com<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The resemblance is obvious at a glance: the same composition structure, use of overlapping vocabulary, and suspiciously similar-looking numbers. But resemblance isn\u2019t attribution. Any two bulk-registration campaigns targeting the same brand might independently land on {word}-{number}.com<\/span>. The words connect<\/em>, join<\/em>, and link<\/em> are generic enough that separate actors could pick them without coordination. And those eight-digit numbers could plausibly be random noise added to ensure uniqueness.<\/p>\n

So, we have three clusters, clearly similar domains, and reasonable grounds for suspicion. How do you get from suspicion to something you can actually stand behind?<\/p>\n

Even at the structural level, the three clusters look suspicious right away. Every single domain across all three follows the same template: {word}-{number}.com<\/span>. No variation, no outliers across nearly 7,000 domains. The word component is drawn from a fixed vocabulary of nine terms:<\/p>\n

chat, connect, engage, interact, join, link, meet, network, sales<\/em><\/p>\n

All nine words show up in all three clusters at nearly identical rates, roughly 11 percent each. That\u2019s not what you would expect from three teams independently building communication-themed infrastructure. That\u2019s a generator pulling uniformly from a fixed word list.<\/p>\n

<\/p>\n

Figure 1. Left: Domain count per cluster. Right: Word usage proportion per cluster. All nine words appear in all three clusters at nearly identical rates (~11 percent each), consistent with uniform random selection from a fixed vocabulary.<\/p>\n

Vocabulary overlap is useful, but it doesn\u2019t close the case on its own. Generic terms like connect<\/em> or link<\/em> are plausible independent choices for anyone building a communications-themed persona. What turns the coincidence into provenance is the numeric component.<\/p>\n

The Number That Shouldn\u2019t Look Like This<\/h3>\n

Each domain carries an eight-character numeric suffix: chat-21004430.com<\/span>, connect-02043120.com<\/span>, meet-30101420.com<\/span>. These strings look random. But before accepting that, it\u2019s worth asking a very simple question: which digits are actually used?<\/strong><\/p>\n

Across 6,958 domains and 55,664 individual digit positions, the answer is unambiguous.<\/p>\n

<\/p>\n

Figure 2. Frequency of each digit (0\u20139) across all 55,664 digit positions in the numeric component. Digits 5 through 9 are completely absent. The expected frequency if digits were drawn uniformly from 0\u20139 would be approximately 10 percent each (dashed line).<\/p>\n

The absence of five digits isn\u2019t just a frequency curiosity. It carves the entire decimal number line into isolated islands. Read naively as decimal integers, the domain numbers can never fall in the ranges such as 5,000,000\u20139,999,999, or 15,000,000\u201319,999,999, or 25,000,000\u201329,999,999, and so on. Every range containing a forbidden digit is structurally unreachable. Once converted to their true integer values (treating the strings as base-5 notation), those gaps disappear, and the underlying uniform distribution becomes immediately visible.<\/p>\n

<\/p>\n

Figure 3. Top row: Sorted scatter of all domain numbers\u2014as decimal readings (left) and as true base-10 integers after base-5 conversion (right). Bottom row: Stacked histograms of the same data. The left column exposes the staircase structure imposed by the absent digits 5\u20139; the right column shows the uniform distribution that was always underneath.<\/p>\n

Digits 5 through 9 do not exist anywhere in this dataset. The generator is producing numbers in base-5, the quinary number system, which uses only the symbols {0, 1, 2, 3, 4}. An eight-character base-5 string addresses a space of 5\u2078 or 390,625 distinct values. The 6,958 unique numbers in this cluster represent approximately 1.8 percent coverage of that space, consistent with uniform random sampling from it.<\/p>\n

Notably, base\u20115 is an extremely uncommon choice in computer systems, which overwhelmingly favor bases aligned with powers of two (binary, octal, hexadecimal) or decimal for human interfaces.<\/p>\n

The ~20 percent of domain numbers that begin with 0 (for example, connect-02043120.com) are not errors. They are fixed-width representations of base-5 values smaller than 10000000 base-5, zero-padded to maintain consistent domain name length. This is a formatting decision embedded in the generator.<\/p>\n

The Statistical Fingerprint<\/h3>\n

The digit restriction alone is enough, but there\u2019s a second layer of confirmation in the distribution of the digits that do appear. <\/p>\n

<\/p>\n

Figure 4. Left: Observed frequency of each digit (0\u20134) across all positions, compared to the expected uniform rate of 20 percent. Right: Leading digit distribution compared to Benford\u2019s Law. Naturally occurring numbers follow Benford\u2019s Law (digit 1 appears ~30 percent of the time; digit 4 only ~10 percent). These domain numbers show an approximately uniform distribution across 0\u20134, the fingerprint of uniform algorithmic sampling. <\/p>\n

Numbers that occur naturally, such as counters, prices, and identifiers that humans assign, tend to follow predictable patterns. The most familiar example is Benford\u2019s Law. In any large collection of naturally occurring numbers, digit 1 appears as the leading digit about 30 percent of the time, digit 2 about 18 percent, and so on, with higher digits becoming progressively rarer. The intuition is simple: in bounded real-world contexts, smaller numbers occur more frequently than larger ones. <\/p>\n

These domain numbers don\u2019t follow that pattern at all. Digits 1 through 4 each appear as the leading digit in 19\u201321 percent of cases, producing a flat, uniform distribution with no preference for any particular digit. That\u2019s the distribution you get from uniform random sampling within a bounded numeric space<\/strong>, not from anything a human would generate, or any natural process would produce. <\/p>\n

Restricted alphabet plus uniform distribution equals a generator fingerprint. Two independent actors don\u2019t accidentally build the same one.<\/p>\n

Simultaneous Operations Confirm Coordination<\/h3>\n

There\u2019s one additional piece of evidence. All three clusters have their domains registered within the same narrow window, primarily November and December 2024, in large daily batches of several hundred to over 2,000 domains per day. <\/p>\n

<\/p>\n

Figure 5. Daily domain registrations across all three clusters, November\u2013December 2024. Registration activity overlaps substantially, consistent with a single operator running parallel provisioning jobs rather than three independently timed campaigns.<\/p>\n

Campaigns do occasionally overlap in time by chance. At this point, however, the numeric evidence has already made the case, and the registration timeline just confirms it.<\/p>\n

Numeric Analysis as a Merge Criterion<\/h3>\n

Four lines of evidence support attribution to a single generator: structural pattern, vocabulary, numeric encoding, and registration timing. But they are not equally decisive: <\/p>\n\n\n\n\n\n\n\n\n\n
Evidence<\/th>\nWeight<\/th>\nReasoning<\/th>\n<\/tr>\n<\/thead>\n
Shared structural pattern<\/td>\nModerate<\/td>\nCommon in bulk domain campaigns generally<\/td>\n<\/tr>\n
Shared vocabulary (nine words)<\/td>\nModerate<\/td>\nGeneric terms; possible independent selection<\/td>\n<\/tr>\n
Identical digit alphabet (base-5)<\/td>\nStrong<\/td>\nStructural generator property; not reproducible independently<\/td>\n<\/tr>\n
Uniform digit distribution<\/td>\nStrong<\/td>\nStatistical generator fingerprint<\/td>\n<\/tr>\n
Overlapping registration timeline<\/td>\nModerate<\/td>\nCorroborating, not definitive<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The digit alphabet is what elevates resemblance to attribution. Pattern-based clustering groups domains by structure, and infrastructure correctly separates clusters, but neither of them tells you whether those clusters belong to one campaign. The numeric component does. <\/p>\n

That\u2019s the practical value here: numeric analysis characterizes the generator<\/strong>, not the deployment. The generator properties don\u2019t change based on which account the domain was registered under, which registrar was used, what name servers are configured in, or when it went live. Two clusters from the same generator will share numeric properties even when every other signal points in different directions.<\/p>\n

Conclusion<\/h3>\n

Numeric components of domain names are frequently undervalued. In practice, they are often treated as noise and either removed prior to analysis or reduced to coarse abstractions such as a binary \u201ccontains digits\u201d flag, generic n\u2011gram features, or entropy scores. This case argues strongly for more careful treatment. <\/p>\n

The choices baked into a number format, including its length, its digit alphabet, and how its values are distributed, are decisions made when the generator was built. They travel with every domain that generator ever produces, across every deployment, every registrar, and every registration batch. <\/p>\n

Here, a generator that works in base-5, one that simply cannot produce digits 5 through 9, is what ties three separately detected clusters into a single campaign. The odds of three independent actors independently landing on the same unusual encoding are, to put it generously, not meaningful. <\/p>\n

Amusing, perhaps. But unmistakable. <\/p>\n

Analysis performed on a cluster of 6,958 domains, registered November\u2013December 2024. All domain names, name server configurations, and registration dates are drawn from passive DNS and public WHOIS data.<\/em><\/p>\n